Host tenant
One customer account inside your application — the level most people get wrong.
A host tenant represents one of your customers inside your application. If you sell a CRM to fifty companies, that is fifty host tenants. If you run one internal tool for your own staff, that is one host tenant — not one per employee.
External key
The external key is the identifier your own system already uses for that customer. It is not a secret and it is used for routing, so use the value your database uses — an account id, not a display name.
Binding to an environment
A tenant belongs to the application, but it is not addressable until it is bound to a specific environment. That is what lets the same customer exist in staging and production with different configuration. Suspending a binding stops new runs for that tenant in that environment only.
Provisioning at scale
Tenants are not created automatically. If your product signs up new customers continuously, call the management API from your own signup flow to provision the tenant, bind it to the environment, and map it to your issuer — the same three steps the console performs.