Security Rules

Rules decide who may read or write each collection. Edit in Console → Rules (JSON). The secret key always bypasses rules.

Format

{
  "*":        { "read": "auth",   "write": "owner" },        // default for all collections
  "products": { "read": "public", "write": "admin" },
  "orders":   { "read": "owner",  "write": "owner" },
  "profiles": { "read": "public", "write": "owner", "ownerField": "uid" },
  "logs":     { "read": "none",   "write": "auth" },
  "posts":    { "read": "public", "write": "verified" }
}

Levels

Level	Who
`public`	anyone with the API key (no login)
`auth`	any signed-in user
`verified`	signed-in with verified email
`owner`	only the user who created the document (create allowed for any signed-in user). Reads/queries are automatically filtered to own docs.
`admin`	user with custom claim `{"admin": true}`
`none`	nobody except secret key (server only)

ownerField

By default ownership is the built-in owner column. Set "ownerField": "uid" to instead compare a field inside data (useful for profile docs keyed by user).

Tips

Put sensitive server-only data in a none collection and access it with the secret key from PHP.
Use admin + claims for staff panels.
Rules apply to realtime streams too.

Was this page helpful? Tell us. · Download SDK