AUTH

Auth built into the database

Read the docs Start free with SurrealDB

Sign in. Who can sign in, defined in SurrealQL.

Scope. What each user sees, down to the row and the field.

One place. Auth lives beside the data it guards.

Everything an auth layer needs, in the engine.Sign-in methods, token verification and access scopes are database objects, defined once and enforced everywhere.

Read the docs

Record access

Sign users up and in against your own tables, with password hashing built in.

Record access docs

JWT and third-party

Verify tokens from Auth0, Clerk or any provider across the RS, ES, PS and HS families.

JWT docs

System users and scopes

Root, namespace and database users with role-based access, scoped to the resources they need.

System users docs

Row and field permissions

PERMISSIONS clauses on tables and fields run on every read and write, inside the transaction.

Permissions docs

Encryption and TLS

Encryption at rest and end-to-end TLS in transit, configurable per deployment.

Encryption and TLS

Multi-tenant isolation

Namespaces and databases isolate tenants, so one permission model serves every customer.

Multi-tenancy deep dive

ACCESS CONTROL

Identity and permissions, in the query language

Sign-in logic, token verification and per-row rules live in the schema, versioned with the data and enforced by the engine.

RECORD ACCESS

Users authenticate against your own tables

DEFINE ACCESS account ON DATABASE
    TYPE RECORD
    SIGNUP (
        CREATE user SET
            email = $email,
            pass = crypto::argon2::generate($pass)
    )
    SIGNIN (
        SELECT * FROM user WHERE
            email = $email AND
            crypto::argon2::compare(pass, $pass)
    );

ROW-LEVEL PERMISSIONS

Rules travel with the data

DEFINE TABLE order PERMISSIONS
    FOR select WHERE user = $auth.id
    FOR create WHERE $auth.id != NONE;

DEFINE TABLE post SCHEMALESS PERMISSIONS
    FOR select WHERE published = true OR user = $auth.id
    FOR create, update WHERE user = $auth.id
    FOR delete WHERE user = $auth.id OR $auth.admin = true;

FIELD-LEVEL CONTROL

Validate every field

DEFINE FIELD email ON TABLE user
    TYPE string
    ASSERT string::is_email($value);

DEFINE INDEX email ON TABLE user
    FIELDS email UNIQUE;

Auth evaluated where the data lives

One source of truth

Access rules live in the schema beside the data they protect, versioned together.

Enforced in the transaction

The engine checks permissions on every query, live subscription and API call.

One operation

The check and the query are the same operation, with no auth server in between.

Keep exploring

THE PLATFORM

Everything an application and its agents know. Five surfaces, one engine.

Database

Document, graph, vector, time-series and relational in one engine.

Five data models as dotted tiles: documents, graph, vector, time-series and relational

Agent Memory

What an agent learns, with its source and its time, in the same engine.

A timeline of remembered facts, each with its source

Cloud

Managed clusters in the regions you choose, scaled on demand.

Clusters in three regions on a world map, each running or scaling

Studio

Query, explore and design the schema from the browser.

MCP

Every model that speaks MCP reaches the database and the memory directly.

Three models connected through MCP to the database and Agent Memory

IN PRODUCTION

Trusted at scale. Samsung, Nvidia, Verizon, Tencent, and Walmart run on SurrealDB.

14,000+

Developers building on SurrealDB Cloud

4M+

Developers building on SurrealDB worldwide

FROM THE TEAMS

SurrealDB gives us a foundation where we can unify semantic search, knowledge graphs, and AI-driven decision making without stitching together multiple systems. Collapsing responsibility into SurrealDB has become our default engineering posture.

Justin Foley

VP of Engineering, Later

GET STARTED

Build auth into your data. Access, permissions and validation in SurrealQL, enforced on every request.

Read the docs Start free with SurrealDB

Auth built into the database

Everything an auth layer needs, in the engine.Sign-in methods, token verification and access scopes are database objects, defined once and enforced everywhere.

Record access

JWT and third-party

System users and scopes

Row and field permissions

Encryption and TLS

Multi-tenant isolation

Identity and permissions, in the query language

Users authenticate against your own tables

Rules travel with the data

Validate every field

Auth evaluated where the data lives

One source of truth

Enforced in the transaction

One operation

Keep exploring

Security documentation

All features

Technical deep dive

Everything an application and its agents know. Five surfaces, one engine.

Trusted at scale. Samsung, Nvidia, Verizon, Tencent, and Walmart run on SurrealDB.

Build auth into your data. Access, permissions and validation in SurrealQL, enforced on every request.