--- title: "Auth | SurrealDB" description: "Authentication and access control built into the database: record access, JWT and system users, and row- and field-level permissions." url: https://surrealdb.com/surrealdb/auth --- AUTH # Auth built into the database Authentication and access control are part of the engine, not a service beside it. Define who can sign in and exactly what they can see - down to the row and the field - in SurrealQL, and enforce it inside the same transaction as the query. [Read the docs](https://surrealdb.com/docs/learn/security/authentication/authentication) [Start free with SurrealDB](https://studio.surrealdb.com/current/instances/deploy) 1. ![Babcock](https://surrealdb.com/assets/static/babcock.lo4rnVg1.svg) 2. ![ING](https://surrealdb.com/assets/static/ing.X3I6S3_V.svg) 3. ![British Airways](https://surrealdb.com/assets/static/british-airways.KEsZiwV-.svg) 4. ![Nvidia](https://surrealdb.com/assets/static/nvidia.DaIEuMil.svg) 5. ![Apple](https://surrealdb.com/assets/static/apple.D5pq4flY.svg) 6. ![SpaceX](https://surrealdb.com/assets/static/spacex.CQJEk-IL.svg) 7. ![Samsung](https://surrealdb.com/assets/static/samsung.CH-vQgnb.svg) 8. ![adidas](https://surrealdb.com/assets/static/adidas.DdTC5qhk.svg) 9. ![Tencent](https://surrealdb.com/assets/static/tencent.paQmLxyy.svg) 10. ![Alibaba](https://surrealdb.com/assets/static/alibaba.B16idgfM.svg) 11. ![PolyAI](https://surrealdb.com/assets/static/poly-ai.c3w_fAg6.svg) 12. ![Later](https://surrealdb.com/assets/static/later.Ds736jFO.svg) 13. ![Verizon](https://surrealdb.com/assets/static/verizon.BI7CajdX.svg) 14. ![Liberty Mutual](https://surrealdb.com/assets/static/liberty-mutual.B7qOU1pd.svg) 15. ![Walmart](https://surrealdb.com/assets/static/walmart.BjDg_Sr8.svg) 16. ![Carrier](https://surrealdb.com/assets/static/carrier.D21gC6NX.svg) 17. ![Saks Fifth Avenue](https://surrealdb.com/assets/static/saks-fifth-avenue.COIDpLSb.svg) 18. ![San Francisco Compute Company](https://surrealdb.com/assets/static/sfcc.B7jlImq4.svg) 19. ![Shield AI](https://surrealdb.com/assets/static/shield-ai.pINZ0KJr.svg) 20. ![Wix](https://surrealdb.com/assets/static/wix.DvHhmoBi.svg) 01 |ACCESS CONTROL ## Identity and permissions, defined in the query language Sign-up and sign-in logic, token verification, and per-row rules all live in your schema - versioned with your data and enforced by the engine on every query. ``` DEFINE ACCESS account ON DATABASE TYPE RECORD SIGNIN ( SELECT * FROM user WHERE email = $email AND crypto::argon2::compare(pass, $pass) );-- After sign-in, $auth is the user's record, so table-- permissions scope every query to it automatically:SELECT * FROM order WHERE user = $auth.id; ``` RECORD ACCESS ## Users authenticate against your own tables DEFINE ACCESS turns SurrealDB into a web database: users sign up and sign in against the records you already have, with password hashing built in. ``` DEFINE ACCESS account ON DATABASE TYPE RECORD SIGNUP ( CREATE user SET email = $email, pass = crypto::argon2::generate($pass) ) SIGNIN ( SELECT * FROM user WHERE email = $email AND crypto::argon2::compare(pass, $pass) ); ``` ROW-LEVEL PERMISSIONS ## Rules travel with the data Permissions are declared on the table and enforced by the engine, so the same rule protects every query, live subscription, and API call - there is no application layer to forget it. ``` DEFINE TABLE order PERMISSIONS FOR select WHERE user = $auth.id FOR create WHERE $auth.id != NONE;DEFINE TABLE post SCHEMALESS PERMISSIONS FOR select WHERE published = true OR user = $auth.id FOR create, update WHERE user = $auth.id FOR delete WHERE user = $auth.id OR $auth.admin = true; ``` FIELD-LEVEL CONTROL ## Validate and constrain every field Type, assert, and default each field in the schema. Constraints run on write, so bad or unauthorised data never lands. ``` DEFINE FIELD email ON TABLE user TYPE string ASSERT string::is_email($value);DEFINE INDEX email ON TABLE user FIELDS email UNIQUE; ``` ## Everything an auth layer needs, in the engine Sign-in methods, token verification, and access scopes are first-class database objects - defined once and enforced everywhere. ### [Record access](https://surrealdb.com/docs/learn/security/authentication/authentication) Sign users up and in against your own tables, with flexible rules and built-in password hashing. Learn more ### [JWT and third-party](https://surrealdb.com/docs/learn/security/authentication/authentication) Verify tokens from Auth0, Clerk, or any provider across the RS, ES, PS, and HS algorithm families. Learn more ### [System users and scopes](https://surrealdb.com/docs/learn/security/authentication/authentication) Root, namespace, and database users with role-based access, scoped to exactly the resources they need. Learn more ### [Row and field permissions](https://surrealdb.com/surrealdb/features#security-and-authorisation) PERMISSIONS clauses on tables and fields enforce access on every read and write, inside the transaction. Learn more ### [Encryption and TLS](https://surrealdb.com/surrealdb/features#security-and-authorisation) Encryption at rest with standard algorithms and end-to-end TLS in transit, configurable per deployment. Learn more ### [Multi-tenant isolation](https://surrealdb.com/surrealdb/deep-dive) Namespaces and databases isolate tenants completely, so one permission model serves every customer. Learn more 02 |ONE ENGINE ## No separate auth service to run Bolt-on auth means a second system to deploy, a second place for rules to drift, and a network hop on every check. In SurrealDB, identity and permissions are evaluated where the data lives. ### One source of truth Access rules live in the schema beside the data they protect, versioned together and impossible to bypass from another client. ### Enforced in the transaction Permissions are checked by the engine on every query, live subscription, and API call - not by application code you have to remember to write. ### No extra hop There is no auth server to call before the database call. The check and the query are the same operation. ## Keep exploring ### [Security documentation](https://surrealdb.com/docs/learn/security/authentication/authentication) Authentication, access methods, and permissions in full. Explore ### [All features](https://surrealdb.com/surrealdb/features#security-and-authorisation) The complete security and authorisation feature set. Explore ### [Technical deep-dive](https://surrealdb.com/surrealdb/deep-dive) How the permission model works inside the engine. Explore GET STARTED ## Build auth into your data, not beside it Define access, permissions, and validation in SurrealQL and let the engine enforce them on every request. ![Samsung](https://surrealdb.com/assets/static/4c58b81e7b3c9466.C_Hv0eml.svg)![NVIDIA](https://surrealdb.com/assets/static/nvidia.DaIEuMil.svg)![Apple](https://surrealdb.com/assets/static/f7dc2519e0d212bc.Cn8MYAK7.svg)![Verizon](https://surrealdb.com/assets/static/18b99996c689000f.B5PQ-nI9.svg)![Tencent](https://surrealdb.com/assets/static/401d8346058682c8.DqM87mst.svg) SOC 2 Type 2 GDPR Cyber Essentials Plus ISO 27001 [Read the docs](https://surrealdb.com/docs/learn/security/authentication/authentication) [Start free with SurrealDB](https://studio.surrealdb.com/current/instances/deploy) ```json {"@context":"https://schema.org","@type":"Organization","name":"SurrealDB","url":"https://surrealdb.com","logo":"https://surrealdb.com/assets/static/logo.BG7_TG2b.svg","description":"SurrealDB is the unified data layer for AI. A multi-model database for documents, graphs, vectors, and time-series.","foundingDate":"2022","legalName":"SurrealDB Ltd","identifier":{"@type":"PropertyValue","propertyID":"GB-COH","value":"13615201"},"address":{"@type":"PostalAddress","streetAddress":"3rd Floor, 1 Ashley Road","addressLocality":"Altrincham","addressRegion":"Cheshire","postalCode":"WA14 2DT","addressCountry":"GB"},"contactPoint":[{"@type":"ContactPoint","contactType":"customer support","email":"support@surrealdb.com","url":"https://surrealdb.com/contact","availableLanguage":"English"},{"@type":"ContactPoint","contactType":"sales","email":"info@surrealdb.com","url":"https://surrealdb.com/contact","availableLanguage":"English"},{"@type":"ContactPoint","contactType":"security","email":"security@surrealdb.com","url":"https://surrealdb.com/.well-known/security.txt","availableLanguage":"English"},{"@type":"ContactPoint","contactType":"legal","email":"legal@surrealdb.com","url":"https://surrealdb.com/legal","availableLanguage":"English"}],"hasCertification":[{"@type":"Certification","name":"SOC 2 Type 2"},{"@type":"Certification","name":"GDPR"},{"@type":"Certification","name":"Cyber Essentials Plus"},{"@type":"Certification","name":"ISO 27001"}],"owns":[{"@type":"SoftwareApplication","name":"SurrealDB","url":"https://surrealdb.com/surrealdb"},{"@type":"SoftwareApplication","name":"Agent Memory","url":"https://surrealdb.com/agent-memory"}],"knowsAbout":["multi-model databases","document databases","graph databases","vector search","time-series databases","SurrealQL","Agent Memory","real-time databases","embedded databases","context layer","graph ontology","distributed database","knowledge graphs","distributed transaction protocols","highly-scalable databases"],"sameAs":["https://www.wikidata.org/wiki/Q124316308","https://github.com/surrealdb/surrealdb","https://twitter.com/surrealdb","https://www.youtube.com/@surrealdb","https://www.linkedin.com/company/surrealdb","https://discord.gg/surrealdb","https://www.reddit.com/r/surrealdb","https://www.instagram.com/surrealdb","https://medium.com/surrealdb","https://dev.to/surrealdb"]} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://surrealdb.com"},{"@type":"ListItem","position":2,"name":"SurrealDB","item":"https://surrealdb.com/surrealdb"},{"@type":"ListItem","position":3,"name":"Auth","item":"https://surrealdb.com/surrealdb/auth"}]} ```