Simplify your stack and build anything. Or everything.
Schedule a Demo
USE CASES
Headless CMSEnterprise App BuilderHeadless E-CommerceDigital Asset Management
FEATURES
Multi-TenancyWhite LabelLocalizationAccess ControlAuth
CASE STUDIES

See what others are building with Payload.

Browse Case Studies
Build tomorrow’s web with a modern solution you truly own.
PAYLOAD IS FOR
DevelopersMarketing teamsEnterprise companiesAgencies & Consultancies
COMPARE PAYLOAD
Payload vs WordPressPayload vs ContentfulPayload vs SanityPayload vs StrapiPayload vs Directus
AGENCY TESTIMONIAL

"Payload has transformed the way our clients manage content. It's an indispensable tool for any modern agency."

Become a PartnerFind a Partner
Code-based nature means you can build on top of it to power anything.
Resources
DocumentationExamplesTemplatesGitHubReleasesBlog
Community
RoadmapDiscordCommunity Help
Payload Cloud

Deploy your entire stack in one place with Payload Cloud.

LoginCloud Pricing
It’s time to take back your content infrastructure.
Schedule a Demo
Enterprise Features
SSOAI Auto-EmbeddingPublishing WorkflowsVisual EditorStatic A/B testingAI features
Customer Stories
MicrosoftASICSBlue OriginHello BelloTekton
Featured Customer Story

Microsoft chose Payload to tell the world about AI.

Read the case studyBrowse all
LoginGet Started

Collection Access Control

You can define Collection-level Access Control within each Collection's access property. All Access Control functions accept one args argument.

Available Controls
FunctionAllows/Denies Access
createUsed in the create operation
readUsed in the find and findByID operations
updateUsed in the update operation
deleteUsed in the delete operation

Auth-enabled Controls

If a Collection supports Authentication, the following Access Controls become available:

FunctionAllows/Denies Access
adminUsed to restrict access to the Payload Admin panel
unlockUsed to restrict which users can access the unlock operation

Example Collection config:

1
import { CollectionConfig } from 'payload/types';
2
3
export const Posts: CollectionConfig = {
4
slug: "posts",
5
access: {
6
create: ({ req: { user } }) => { ... },
7
read: ({ req: { user } }) => { ... },
8
update: ({ req: { user } }) => { ... },
9
delete: ({ req: { user } }) => { ... },
10
admin: ({ req: { user } }) => { ... },
11
},
12
};

Create

Returns a boolean which allows/denies access to the create request.

Available argument properties:

OptionDescription
reqThe Express request object containing the currently authenticated user
dataThe data passed to create the document with.

Example:

1
const PublicUsers = {
2
slug: 'public-users',
3
access: {
4
// allow guest users to self-registration
5
create: () => true,
6
...
7
},
8
fields: [ ... ],
9
}

Read

Read access functions can return a boolean result or optionally return a query constraint which limits the documents that are returned to only those that match the constraint you provide. This can be helpful to restrict users' access to only certain documents however you specify.

Available argument properties:

OptionDescription
reqThe Express request object containing the currently authenticated user
idid of document requested, if within findByID

Example:

1
import { Access } from 'payload/config'
2
3
const canReadPage: Access = ({ req: { user } }) => {
4
// allow authenticated users
5
if (user) {
6
return true
7
}
8
// using a query constraint, guest users can access when a field named 'isPublic' is set to true
9
return {
10
// assumes we have a checkbox field named 'isPublic'
11
isPublic: {
12
equals: true,
13
},
14
}
15
}

Update

Update access functions can return a boolean result or optionally return a query constraint to limit the document(s) that can be updated by the currently authenticated user. For example, returning a query from the update Access Control is helpful in cases where you would like to restrict a user to only being able to update the documents containing a createdBy relationship field equal to the user's ID.

Available argument properties:

OptionDescription
reqThe Express request object containing the currently authenticated user
idid of document requested to update
dataThe data passed to update the document with

Example:

1
import { Access } from 'payload/config'
2
3
const canUpdateUser: Access = ({ req: { user }, id }) => {
4
// allow users with a role of 'admin'
5
if (user.roles && user.roles.some((role) => role === 'admin')) {
6
return true
7
}
8
// allow any other users to update only oneself
9
return user.id === id
10
}

Delete

Similarly to the Update function, returns a boolean or a query constraint to limit which documents can be deleted by which users.

Available argument properties:

OptionDescription
reqThe Express request object with additional user property, which is the currently logged in user
idid of document requested to delete

Example:

1
import { Access } from 'payload/config'
2
3
const canDeleteCustomer: Access = async ({ req, id }) => {
4
if (!id) {
5
// allow the admin UI to show controls to delete since it is indeterminate without the id
6
return true
7
}
8
// query another collection using the id
9
const result = await req.payload.find({
10
collection: 'contracts',
11
limit: 0,
12
depth: 0,
13
where: {
14
customer: { equals: id },
15
},
16
})
17
18
return result.totalDocs === 0
19
}

Admin

If the Collection is used to access the Payload Admin panel, the Admin Access Control function determines whether or not the currently logged in user can access the admin UI.

Available argument properties:

OptionDescription
reqThe Express request object containing the currently authenticated user

Unlock

Determines which users can unlock other users who may be blocked from authenticating successfully due to failing too many login attempts.

Available argument properties:

OptionDescription
reqThe Express request object containing the currently authenticated user
Next

Field-level Access Control

Related Help Topics