About the Permissions Router API

The Permissions Router API is a utility for organizing channel permission logic. The router lets you set up a default permissions handler as well as handlers specific to channels or resources.

Note: Alternatively, you can include permissions logic directly in the realtime_check_permission() hook.

Learn more about the Site API and the Realtime APIs.

With the Permissions Router API, you can:

Setting up permissions

To set up permissions using the router:

  1. Create a realtime-permissions.js file in a site's backend.

  2. Import the permissionsRouter:

    Copy
  3. Define permission handlers. Use add() for specific channels or resources, and default() for a default fallback handler:

    Copy
  4. Export the realtime_check_permission hook and call check() in the body of the hook to delegate to the router:

    Copy

Permission resolution

Permissions can be set at the channel level or the resource level. They determine whether subscribers can receive messages published to that channel or resource.

Permissions follow a cascading pattern:

Note: Permissions are checked once per subscription attempt, including re-subscriptions after reconnection. Changes to permissions don't affect active subscriptions until the subscriber reconnects.

Before you begin

It's important to note the following points before starting to code:

  • You must create a realtime-permissions.js file in a site's backend, even if you don't define any custom permissions. Without it, all subscriptions fail in Wix Studio.
  • When the realtime_check_permission hook isn't defined, all subscribers receive the default permissions of {"read": true}.
  • When previewing a site, read permissions are always true.

Use cases

Restrict the announcements channel so only logged-in members can receive messages. All other channels remain open to everyone:

Copy

See also

Last updated: 6 July 2026

Did this help?