# Namespaces

A namespace is the boundary everything lives inside: devices, members, identities, policies, tags, settings. Two namespaces share nothing.

![Namespace Settings page](https://docs.shellhub.io/img/shots/namespace-settings.png)

## Name and Tenant ID

Every namespace has both, and they do different jobs.

The **name** is human-facing and can be changed. It must be a valid hostname — lowercase, no dots — because it appears in an SSHID:

```bash
$ ssh root@mycompany.raspberrypi@cloud.shellhub.io
#          ^^^^^^^^^ the namespace name
```

The **Tenant ID** is an immutable UUID generated when the namespace is created. It is what devices, API keys and sessions actually reference.

![The Tenant ID setting, with the control that copies it](https://docs.shellhub.io/img/shots/tenant-id.png)

Renaming a namespace changes every SSHID for it. Anything with a stored SSHID — an SSH config alias, an Ansible inventory, a script — breaks. The tenant ID does not change, so agent configuration is unaffected.

## Creating one

![The Create a Namespace dialog, asking for a name](https://docs.shellhub.io/img/shots/namespace-create.png)

> **Availability**
>
> Creating a namespace is on **Cloud** and **Enterprise**. Community is single-namespace: the one namespace is created at setup and the server refuses to create another. The route is not registered, so an attempt returns 404 rather than an error explaining itself.
>
> [See all editions →](https://docs.shellhub.io/about/editions)

Reasons to have more than one: separating customers, separating environments where the separation must be absolute, or separating teams that should not see each other’s devices. Within a single namespace, [tags](https://docs.shellhub.io/manage/devices/tags) and [access policies](https://docs.shellhub.io/manage/access-control/access-policies) handle most separation without the overhead of a second workspace.

## Switching

Each namespace you open is a tab at the top of the console. To open another, click **+** next to the tabs and pick it from the list. The namespace you’re in comes first, then the ones already open as tabs, then the rest in alphabetical order.

![The new-tab picker open under the + button, listing the namespaces this account belongs to](https://docs.shellhub.io/img/shots/namespace-switch.png)

Membership is per namespace, and so is your role — you can be an administrator in one and an observer in another.

## Legacy or new

A namespace is either legacy or new, which decides how connections are authorized and how devices enroll. Namespaces created today are new. Namespaces predating identity-based access are legacy, and can be upgraded once.

A new namespace never becomes legacy. See [How Authorization Works](https://docs.shellhub.io/manage/access-control) and [Upgrading a Legacy Namespace](https://docs.shellhub.io/manage/access-control/migrating-from-legacy).

## Deleting

![The Delete Namespace dialog, which asks for the namespace name before it will proceed](https://docs.shellhub.io/img/shots/namespace-delete.png)

Deleting takes the devices, identities, policies and history with it. Only the owner can do it — an administrator cannot.

Agents keep running on the devices. They no longer have a namespace to enroll into, so stop them if the machines are staying in service.

## Device limits

Self-hosted Community has no limit. The Cloud free plan is limited to 3 devices.

## Where to go next

- [Members](https://docs.shellhub.io/manage/team) — Who is in the namespace.
- [Settings](https://docs.shellhub.io/manage/settings) — Recording, announcements, MFA requirements.