#Access and permissions
Every user and API client in Hygraph is assigned a set of permissions that controls what they can read, write, and configure. This section covers how to set that up, whether you are onboarding a team member, creating a custom role, or securing an API integration.
Hygraph uses three mechanisms to grant permissions:
- Roles control what authenticated users can do in the project.
- Permanent Auth Tokens (PATs) control what API clients can do.
- Content API permissions control what unauthenticated requests to the public Content API can read.
All three use the same permission types: content permissions (read, create, update, delete, publish, unpublish) and Management API permissions (schema, environments, settings). Content permissions are environment-specific. Management API permissions apply across all environments in the project.
When setting up access for your project, work through these decisions in order:
- Who needs access? Identify everyone who needs access to your project. For each person or system, determine whether they should be granted access through a role, a PAT, or the public Content API settings.
- What can they do? Define the content permissions (which models, locales, and content stages) and any Management API permissions relevant to their role or token.
- On which environments? Content permissions are environment-specific, so you configure them separately per environment. Management API permissions apply globally across all environments in the project.
#Who is this section for?
- Project admins managing users and environments
- Developers securing API access for applications
#Manage your team
- Manage team members: Invite collaborators to your project, assign roles, and manage access as your team grows.
- User roles and permissions: Understand system roles, create custom roles, and define what users can read, write, publish, or manage.
#Configure API access
- API access: Configure public Content API access, create Permanent Auth Tokens (PATs), and authenticate API requests.
- Content API permissions: Reference for content permission rules, including model-level, locale, and content stage configuration.
- Management API permissions: Reference for permissions that control UI visibility for roles and programmatic access for PATs across schema, environments, and project settings.