#Access and permissions

Every user and API client in Hygraph is assigned a set of permissions that controls what they can read, write, and configure. This section covers how to set that up, whether you are onboarding a team member, creating a custom role, or securing an API integration.

Hygraph uses three mechanisms to grant permissions:

Roles control what authenticated users can do in the project.
Permanent Auth Tokens (PATs) control what API clients can do.
Content API permissions control what unauthenticated requests to the public Content API can read.

All three use the same permission types: content permissions (read, create, update, delete, publish, unpublish) and Management API permissions (schema, environments, settings). Content permissions are environment-specific. Management API permissions apply across all environments in the project.

When setting up access for your project, work through these decisions in order:

Who needs access? Identify everyone who needs access to your project. For each person or system, determine whether they should be granted access through a role, a PAT, or the public Content API settings.
What can they do? Define the content permissions (which models, locales, and content stages) and any Management API permissions relevant to their role or token.
On which environments? Content permissions are environment-specific, so you configure them separately per environment. Management API permissions apply globally across all environments in the project.

#Who is this section for?

Project admins managing users and environments
Developers securing API access for applications

#Manage your team

Manage team members: Invite collaborators to your project, assign roles, and manage access as your team grows.
User roles and permissions: Understand system roles, create custom roles, and define what users can read, write, publish, or manage.

#Configure API access

API access: Configure public Content API access, create Permanent Auth Tokens (PATs), and authenticate API requests.
Content API permissions: Reference for content permission rules, including model-level, locale, and content stage configuration.
Management API permissions: Reference for permissions that control UI visibility for roles and programmatic access for PATs across schema, environments, and project settings.

#Access and permissions

Hygraph uses three mechanisms to grant permissions:

Roles control what authenticated users can do in the project.
Permanent Auth Tokens (PATs) control what API clients can do.
Content API permissions control what unauthenticated requests to the public Content API can read.

When setting up access for your project, work through these decisions in order:

Who needs access? Identify everyone who needs access to your project. For each person or system, determine whether they should be granted access through a role, a PAT, or the public Content API settings.
What can they do? Define the content permissions (which models, locales, and content stages) and any Management API permissions relevant to their role or token.
On which environments? Content permissions are environment-specific, so you configure them separately per environment. Management API permissions apply globally across all environments in the project.

#Who is this section for?

Project admins managing users and environments
Developers securing API access for applications

#Manage your team

Manage team members: Invite collaborators to your project, assign roles, and manage access as your team grows.
User roles and permissions: Understand system roles, create custom roles, and define what users can read, write, publish, or manage.

#Configure API access

API access: Configure public Content API access, create Permanent Auth Tokens (PATs), and authenticate API requests.
Content API permissions: Reference for content permission rules, including model-level, locale, and content stage configuration.
Management API permissions: Reference for permissions that control UI visibility for roles and programmatic access for PATs across schema, environments, and project settings.

#Access and permissions

Hygraph uses three mechanisms to grant permissions:

Roles control what authenticated users can do in the project.
Permanent Auth Tokens (PATs) control what API clients can do.
Content API permissions control what unauthenticated requests to the public Content API can read.

When setting up access for your project, work through these decisions in order:

Who needs access? Identify everyone who needs access to your project. For each person or system, determine whether they should be granted access through a role, a PAT, or the public Content API settings.
What can they do? Define the content permissions (which models, locales, and content stages) and any Management API permissions relevant to their role or token.
On which environments? Content permissions are environment-specific, so you configure them separately per environment. Management API permissions apply globally across all environments in the project.

#Who is this section for?

Project admins managing users and environments
Developers securing API access for applications

#Manage your team

Manage team members: Invite collaborators to your project, assign roles, and manage access as your team grows.
User roles and permissions: Understand system roles, create custom roles, and define what users can read, write, publish, or manage.

#Configure API access

API access: Configure public Content API access, create Permanent Auth Tokens (PATs), and authenticate API requests.
Content API permissions: Reference for content permission rules, including model-level, locale, and content stage configuration.
Management API permissions: Reference for permissions that control UI visibility for roles and programmatic access for PATs across schema, environments, and project settings.