Everything an auth layer needs, in the engine.Sign-in methods, token verification and access scopes are database objects, defined once and enforced everywhere.
Record access
Sign users up and in against your own tables, with password hashing built in.
JWT and third-party
Verify tokens from Auth0, Clerk or any provider across the RS, ES, PS and HS families.
System users and scopes
Root, namespace and database users with role-based access, scoped to the resources they need.
Row and field permissions
PERMISSIONS clauses on tables and fields run on every read and write, inside the transaction.
Encryption and TLS
Encryption at rest and end-to-end TLS in transit, configurable per deployment.
Multi-tenant isolation
Namespaces and databases isolate tenants, so one permission model serves every customer.
ACCESS CONTROL
Identity and permissions, in the query language
Sign-in logic, token verification and per-row rules live in the schema, versioned with the data and enforced by the engine.
Users authenticate against your own tables
DEFINE ACCESS account ON DATABASE
TYPE RECORD
SIGNUP (
CREATE user SET
email = $email,
pass = crypto::argon2::generate($pass)
)
SIGNIN (
SELECT * FROM user WHERE
email = $email AND
crypto::argon2::compare(pass, $pass)
);
Rules travel with the data
DEFINE TABLE order PERMISSIONS
FOR select WHERE user = $auth.id
FOR create WHERE $auth.id != NONE;
DEFINE TABLE post SCHEMALESS PERMISSIONS
FOR select WHERE published = true OR user = $auth.id
FOR create, update WHERE user = $auth.id
FOR delete WHERE user = $auth.id OR $auth.admin = true;
Validate every field
DEFINE FIELD email ON TABLE user
TYPE string
ASSERT string::is_email($value);
DEFINE INDEX email ON TABLE user
FIELDS email UNIQUE;
Auth evaluated where the data lives
One source of truth
Enforced in the transaction
One operation
THE PLATFORM
Everything an application and its agents know. Five surfaces, one engine.
Database
Document, graph, vector, time-series and relational in one engine.
Agent Memory
What an agent learns, with its source and its time, in the same engine.
Cloud
Managed clusters in the regions you choose, scaled on demand.
Studio
Query, explore and design the schema from the browser.
MCP
Every model that speaks MCP reaches the database and the memory directly.
IN PRODUCTION
Trusted at scale. Samsung, Nvidia, Verizon, Tencent, and Walmart run on SurrealDB.
14,000+
Developers building on SurrealDB Cloud
4M+
Developers building on SurrealDB worldwide
FROM THE TEAMS
SurrealDB gives us a foundation where we can unify semantic search, knowledge graphs, and AI-driven decision making without stitching together multiple systems. Collapsing responsibility into SurrealDB has become our default engineering posture.
VP of Engineering, Later
GET STARTED