SurrealDB provides a layered security model that covers how users and systems prove their identity, what they are allowed to do once authenticated, and the operational practices that keep a deployment safe.
This section is organised into three areas:
Authentication - signing in with credentials, record-based access, and third-party identity providers.
Authorization - controlling access at the table, field, and row level with the
PERMISSIONSclause and JWTs.Best practices - guidance on secure configuration, token handling, network exposure, and common pitfalls.
Authorization
Tokens & JWTs - how a token carries identity and what the database checks
Guest access - letting clients that have not signed in read public tables or call public functions, turned on with
--allow-guestsand limited by each table's and function'sPERMISSIONS
Logic that goes beyond reading and writing records, such as an order that has to update stock and create an invoice together, can live in the database as a custom function or behind an HTTP endpoint defined with DEFINE API. A function's PERMISSIONS clause decides who may call it, while its body runs with the caller's own table and field permissions - see function permissions.
Troubleshooting
Troubleshooting - what a rejected token, an expired session or a denied permission looks like, and what to check