tenant-key is now passed as string