Hi Roemer, you can also have a look at OAuth2 Provider forge component, which allows you to use the OAuth2 standard to propagate which user is invoking the REST API.
The TenantSwitch is handled automatically by the OAuth2 Provider component, so you can rely on your APIs being invoked on the context of the correct tenant. OAuth2 also has some standard support for security and access control, and interoperates quite nicely with clients in any technology.