3. Concepts

Tenant                     billing + isolation boundary; your company
  └── Organization         a team; members and roles live here
        └── Project        one app, one repo, one environment
              └── Key      pk_live_… — what your code actually holds

• Tenant — the unit of billing, quotas and data isolation. Cross-tenant reads are refused; a key minted in one tenant cannot see another's anything.
• Organization — where humans and roles live (owner, admin, developer, viewer). A user may belong to organizations across several tenants.
• Project — the natural unit for "one of my repos". Each gets its own keys, its own webhooks, and its own line in the cost ledger.
• Key — scoped to a project, carries its own scopes and rate limit.

The intended shape for many projects: one organization, one project per repo, one key per project. Every project's spend is separately attributable and any single key can be revoked without touching the others.