Disable one tenant or route without flipping the whole killswitch

Use the killswitch per-key "switches" feature to set a named override on one tenant or route in one environment — without killing the feature for everyone.

Production readyOn this page · 3 min readUpdated · June 19, 2026Works with · Server SDK · CLI · Dashboard

One tenant is hammering your export pipeline and degrading it for everyone else. You have a killswitch for exports — but flipping it stops exports for all customers, which is a much bigger blast radius than the one account causing the problem. You want to pause exports for that single tenant and leave everyone else running.

That's the killswitch per-key switches feature: a named per-key boolean override, set on one environment, layered on top of the killswitch's global state.

The shape. A killswitch has one global default. A switch is a named override on a specific key — tenant:acme, route:/exports — that you set or unset independently, per environment. The global switch stays off; the per-key override scopes the kill to exactly one tenant or route.

Set a per-key override on one env

# pause exports for just this tenant, in prod only
shipeasy killswitch toggle exports.pipeline --switch tenant:acme --on --env prod

In code the killswitch read names the switch so the SDK can apply the right per-key override:

import { configure, Client } from "@shipeasy/sdk/server";

configure({ apiKey: process.env.SHIPEASY_SERVER_KEY! });

export async function runExport(tenantId: string) {
  const flags = new Client({ user_id: tenantId });
  // getKillswitch(name, switch) resolves the named per-key switch for this
  // tenant, falling back to the global state
  if (flags.getKillswitch("exports.pipeline", `tenant:${tenantId}`)) {
    return { status: "paused", reason: "Exports are briefly paused for your account." };
  }
  return processExport(tenantId);
}

When the tenant recovers, unset the one switch — every other tenant was never affected:

shipeasy killswitch toggle exports.pipeline --switch tenant:acme --off --env prod

Scoped blast radius, full audit trail

The per-key override is recorded in the audit log like any killswitch flip — who, when, which key, which env. You get the surgical scope of a per-tenant pause with the same incident-grade trail as the global switch.

Rollout & measurement plan

Reach for it instead of the global flip. When the problem is one tenant or one route, a per-key switch contains the blast radius to exactly that key.
Scope to the right env. Switches are per-environment — set the override in prod only, so staging keeps testing the normal path.
Clean up after the incident. Unset the switch once the tenant recovers; a forgotten per-key override is a quiet, account-specific outage waiting to confuse the next person.

Was this page helpful?

✎ Edit this page