Respecting Access Control with Local API Operations

Local API operations that support overrideAccess now default it to false — they respect Access Control by default. A few operations do not expose this option, and resetPassword requires it explicitly.

overrideAccess: false (default where optional) — respect Access Control. Pass the authenticated user when the operation acts on their behalf; without one, Payload evaluates access as an anonymous request.
overrideAccess: true — skip Access Control. The operation runs with full permissions.

Respecting Access Control

Use overrideAccess: false whenever the operation acts for a person — server functions, API routes, custom endpoints, and anything reached from the front end. Pass the authenticated user so Payload knows whose permissions to check.

1const authedCreate = await payload.create({
collection: 'users',
overrideAccess: false, // access control is enforced
user, // whose permissions to check
data: {
  email: 'test@test.com',
  password: 'test',
},
9})

This creates the document only if user has permission to do so. Without the user, Payload treats the request as unauthenticated and applies the access rules for an anonymous visitor.

Skipping Access Control

Use overrideAccess: true for trusted server-side work with no user behind it — seed scripts, migrations, cron jobs, and independently authenticated system integrations that are intended to run with full permissions.

Treat webhooks according to the authority they represent. A webhook acting for a Payload user should pass that user with overrideAccess: false. After independently authenticating and authorizing a system webhook, use overrideAccess: true only when it is intentionally allowed to bypass Payload Access Control.

1const seeded = await payload.create({
collection: 'users',
overrideAccess: true, // access control is skipped
data: {
  email: 'test@test.com',
  password: 'test',
},
8})

Choosing a value

Ask who the operation is for. If a person triggered it, pass their user — you can set overrideAccess: false explicitly, or simply omit the property, since that's now the default. If your server triggered it on its own schedule, set overrideAccess: true explicitly.

When you are unsure, leave the default in place so that Payload enforces the configured Access Control instead of bypassing it.

Was this page helpful?

See what others are building with Payload.

"Payload has transformed the way our clients manage content. It's an indispensable tool for any modern agency."

Get the resources you need to start building today

Microsoft chose Payload to tell the world about AI.

Respecting Access Control with Local API Operations