How do you implement multi-tenant architecture with Firebase?

Multi-tenancy with Firebase can be implemented at different isolation levels: (1) Data isolation with security rules — store a tenantId field in every document; rules enforce tenant boundaries: allow read: if request.auth.token.tenantId == resource.data.tenantId. Simplest approach, lowest cost, but no complete tenant isolation; (2) Collection-per-tenant — prefix all collections with tenant ID: /tenants/{tenantId}/users/{userId}. Enables per-tenant queries easily; rules protect cross-tenant access; (3) Firebase project-per-tenant — each enterprise customer gets their own Firebase project. Complete data isolation, separate billing, separate security rules. Most secure but complex to manage (Admin SDK multi-project initialization, separate Firebase console access); (4) Firebase Auth tenants — Firebase Identity Platform (paid) supports multi-tenancy in Firebase Auth natively with tenant-specific sign-in providers, users, and settings. Custom tokens include a tenant_id; Firestore rules can check request.auth.firebase.tenant; (5) Hybrid — Firebase Auth tenants for identity + collection-per-tenant for data. This is the recommended enterprise approach.