A method comprising: receiving, by a multi-tenant web relay service and from a tenant-specific cloud service, a Hypertext Transfer Protocol, HTTP, request to connect to a web service hosted within a tenant datacenter, wherein the HTTP request comprises data indicating a display-friendly name of the web service and the tenant datacenter, and a tenant-specific signature generated by the tenant-specific cloud service using a tenant-specific private key for authenticating the tenant-specific cloud service to multi-tenant web relay service; responsive to receiving the HTTP request from the tenant-specific cloud service, authenticating, by the multi-tenant web relay service, the HTTP request using the tenant-specific signature generated by the tenant-specific cloud service using the tenant-specific private key; responsive to authenticating the HTTP request, establishing, by the multi-tenant web relay service, and via a rendezvous support service, a communication channel with a web relay agent, wherein the web relay agent is located at the tenant datacenter; creating, by the multi-tenant web relay service, a modified HTTP request, wherein creating the modified HTTP request comprises removing the tenant-specific signature generated by the tenant-specific cloud service using the tenant-specific private key from the HTTP request received from the tenant-specific cloud service; forwarding, by the multi-tenant web relay service and to the web relay agent, the modified HTTP request via the communication channel; causing, by the multi-tenant web relay service, the web relay agent to access the web service hosted within the tenant datacenter based on the display-friendly name of the web service, wherein causing the web relay agent to access the web service hosted within the tenant datacenter based on the display-friendly name of the web service comprises: causing the web relay agent to determine a service-account credential using only the display-friendly name of the web service; and causing the web relay agent to authenticate to the web service with the service-account credential; receiving, by the multi-tenant web relay service and from the web relay agent, a response to the modified HTTP request; and relaying, by the multi-tenant web relay service and to the tenant-specific cloud service, the received response to the modified HTTP request. receiving, by a multi-tenant web relay service and from a tenant-specific cloud service, a Hypertext Transfer Protocol, HTTP, request to connect to a web service hosted within a tenant datacenter, wherein the HTTP request comprises data indicating a display-friendly name of the web service and the tenant datacenter, and a tenant-specific signature generated by the tenant-specific cloud service using a tenant-specific private key for authenticating the tenant-specific cloud service to multi-tenant web relay service; responsive to receiving the HTTP request from the tenant-specific cloud service, authenticating, by the multi-tenant web relay service, the HTTP request using the tenant-specific signature generated by the tenant-specific cloud service using the tenant-specific private key; responsive to authenticating the HTTP request, establishing, by the multi-tenant web relay service, and via a rendezvous support service, a communication channel with a web relay agent, wherein the web relay agent is located at the tenant datacenter; creating, by the multi-tenant web relay service, a modified HTTP request, wherein creating the modified HTTP request comprises removing the tenant-specific signature generated by the tenant-specific cloud service using the tenant-specific private key from the HTTP request received from the tenant-specific cloud service; forwarding, by the multi-tenant web relay service and to the web relay agent, the modified HTTP request via the communication channel; causing, by the multi-tenant web relay service, the web relay agent to access the web service hosted within the tenant datacenter based on the display-friendly name of the web service, wherein causing the web relay agent to access the web service hosted within the tenant datacenter based on the display-friendly name of the web service comprises: causing the web relay agent to determine a service-account credential using only the display-friendly name of the web service; and causing the web relay agent to authenticate to the web service with the service-account credential; causing the web relay agent to determine a service-account credential using only the display-friendly name of the web service; and causing the web relay agent to authenticate to the web service with the service-account credential; receiving, by the multi-tenant web relay service and from the web relay agent, a response to the modified HTTP request; and relaying, by the multi-tenant web relay service and to the tenant-specific cloud service, the received response to the modified HTTP request.