Web API Authentication with multi-tenant data access

I agree with you in the fact that the tenant selection must be done in a stateless way, in order to avoid stateful interaction in a REST-based architecture. The caching approach may lead to many pitfalls and introduces a strong dependency on a session-based interaction.

I can think of two main options to make the tenant selection stateless:

1. URI based selection: you could add to you API a tenant parameter, shared between all your controllers. A mapping similar to this: api/{tenantId}/{controller}/{id} could allow you to switch between tenants in a simple way client-side. This can be done using both the convention-based routing:

   routes.MapHttpRoute(
       name: "API Default",
       routeTemplate: "api/{tenantId}/{controller}/{id}",
       defaults: new { id = RouteParameter.Optional }
   );
   

   Or the attribute-based routing, using RoutePrefixAttribute on your controllers:

   [RoutePrefix("api/{tenantId}/myentities")]
   public class EntityController : ApiController
   {
       [Route("")]
       public IHttpActionResult GetAllEntities(string tenantId)
       {
           //...
   

2. Header based selection: you could consider adding a custom HTTP header, which will contain information about the selected tenant: e.g. X-Tenant-Selection: TenantId, then you could read this Header inside a custom Filter, or in a OwinMiddleware executed before Web API, and set a context variable (or even a user claim that will last for the current request) to be used inside your controllers.

Of course in both scenarios you have to validate that the current user can access to the selected tenant before returning data.

Frankly I would exclude the possibility to include the tenantId inside the access token, and the sub-domain approach appears too complicated to me.