Users, ownership, and @request.auth

August 11, 2026

The win for today: two real users created through the API, each owning their own posts — with PocketBase itself refusing to let one touch the other's. Roughly twenty-five minutes, entirely in the terminal.

In lesson 1 you proved that rules are authorisation-as-data. Today the rules get an identity to work with.

Key idea —

An auth collection is just a base collection whose records can log in. Users are rows. Registration is a plain record create; login returns a stateless JWT — no sessions, nothing stored server-side, no logout endpoint. Every rule can then see the caller as @request.auth (Authentication docs).

1. Register two users (5 min)

PocketBase ships with a users auth collection. Creating a user is the same endpoint as creating any record:

curl -X POST http://127.0.0.1:8090/api/collections/users/records \
  -H "Content-Type: application/json" \
  -d '{"email":"alice@example.com","password":"pass1234567","passwordConfirm":"pass1234567"}'

Repeat for bob@example.com. (The default create rule on users allows public sign-up — worth noticing: sign-up policy is also just a rule.)

2. Log in and hold the token (5 min)

curl -X POST http://127.0.0.1:8090/api/collections/users/auth-with-password \
  -H "Content-Type: application/json" \
  -d '{"identity":"alice@example.com","password":"pass1234567"}'

The response contains a token. Stash each user's token in a shell variable (ALICE=..., BOB=...). Authenticated requests just add -H "Authorization: $ALICE".

3. Give posts an owner (5 min)

In the dashboard, add a field to posts: author, type relation, single, pointing at users. Then set the collection's rules:

listRule / viewRule:    published = true || author = @request.auth.id
createRule:             @request.auth.id != "" && @request.body.author = @request.auth.id
updateRule / deleteRule: author = @request.auth.id

Read them aloud — they're the whole authorisation story: anyone sees published posts, owners also see their drafts, you must be logged in to create (and can only create as yourself), and only owners mutate (API rules and filters).

4. Prove it (10 min)

As Alice, create a post (include "author" set to her record id from the login response). Then try to update it as Bob:

curl -X PATCH http://127.0.0.1:8090/api/collections/posts/records/POST_ID \
  -H "Authorization: $BOB" \
  -H "Content-Type: application/json" \
  -d '{"title":"bob was here"}'

You should get a 404, not a 403 — records your rules hide from a caller simply don't exist for them. Repeat as Alice and watch it succeed. Also try creating a post as Alice with Bob's id in author; the create rule blocks it.

Check yourself

Q1. What does @request.auth refer to inside a rule?

Q2. An updateRule of `author = @request.auth.id` lets whom update?

Q3. How does PocketBase track a logged-in user between requests?

Primary source

Read the official Authentication docs — the identity flows (password, OAuth2, OTP) in one page, and the source for everything above.

Keep for reference

The mental-model cheat sheet now has an auth section with these endpoints.

Lesson 3 leaves configuration and enters your territory: importing PocketBase as a Go library — main.go, your first event hook, and a custom route. From there the course builds the actual backend shape your product needs.