Terraform Multi-Tenant Agents (Shared)
Deploy the same agent for every customer, each isolated in their own ChatBotKit child User. One parent User token plus the provider's run_as attribute targets each child User through a provider alias - no per-customer tokens.
This example runs a multi-tenant product on ChatBotKit where every customer gets the same agent inside their own isolated child User with its own bots, datasets, conversations, and settings.
Isolation comes from the provider's run_as attribute. You hold one parent User token (CHATBOTKIT_API_KEY) and configure one provider alias per customer, each with run_as set to that customer's child User ID, which sends the X-RunAs-UserId header. There are no per-customer tokens - account IDs are not secret. This is the standard Terraform multi-account pattern, provider aliases, the same way the AWS provider uses assume_role.
The agent is defined once in a reusable module and deployed into each child User via its alias - no for_each. Improve the agent once and it ships to every customer on the next apply.
This is the foundation for white-label and B2B SaaS products where account separation, per-tenant limits, and reproducible provisioning matter.
