<p>
    You can extend Appwrite's APIs by building backend apps using <a href="/docs/getting-started-for-server">Server SDKs</a>. To secure your backend app's APIs, client apps must prove their identity against your backend app before accessing sensitive information. You can secure these APIs and enforce access permissions in your backend app by using JWT authentication.
</p>

<p>
    If you are already authenticated on your client-side app and need your backend app to <b>act on behalf of the user</b>, this guide will walk you through the process.
</p>

<h2><a href="/docs/authentication-server#proof-of-identity" id="proof-of-identity">Proof of Identity</a></h2>
<p>Before making requests to your backend APIs, your client application needs to first create a session <b>directly with Appwrite</b> using the account service. This session will act like an ID card for the user and can be used to access resources in Appwrite. The client will <b>only receive information accessible to the user</b> based on the resources' <a href="/docs/permissions">permissions</a>.</p>

<p>When you build backend APIs to extend Appwrite's functionality, these APIs should still <b>respect access permissions</b> to keep user data secure. Appwrite's backend SDKs allows you to securely act on behalf of a user with the same permissions by using JWT authentication.</p>

<h2><a href="/docs/authentication-server#jwt" id="jwt">JWT Authentication</a></h2>
<p><a href="https://jwt.io/introduction" target="_blank" rel="noopener">JSON Web Tokens</a> (JWTs) are a secure means to transfer information or claims between two parties. JWTs act like temporary copies of the user's ID card that allow Appwrite's Server SDKs to access information on behalf of a user.</p>

<p>You need to create a session using the Client SDKs <b>before</b> generating a JWT. The JWT will be a stateless proof of claim for the identity of the authenticated user and expire after 15 minutes or when the session is deleted.</p>

<p>You can generate a JWT like this:</p>

<ul class="phases clear" data-ui-phases>
    <li>
        <h3>Web</h3>
        <div class="ide" data-lang="javascript" data-lang-label="Web SDK">
            <pre class="line-numbers"><code class="prism language-javascript" data-prism>import { Client, Account } from "appwrite";

const client = new Client()
    .setEndpoint('https://cloud.appwrite.io/v1') // Your API Endpoint
    .setProject('[PROJECT_ID]');                 // Your project ID

const account = new Account(client);

const user = await account.createJWT();</code></pre>
        </div>
    </li>
    <li>
        <h3>Flutter</h3>
        <div class="ide" data-lang="dart" data-lang-label="Flutter SDK">
            <pre class="line-numbers"><code class="prism language-dart" data-prism>import 'package:appwrite/appwrite.dart';

final client = Client()
    .setEndpoint('https://cloud.appwrite.io/v1') // Your API Endpoint
    .setProject('[PROJECT_ID]');                 // Your project ID

final account = Account(client);

final jwt = await account.createJWT();

 </code></pre>
    </li>
    <li>
        <h3>Android</h3>
        <div class="ide" data-lang="kotlin" data-lang-label="Android SDK">
            <pre class="line-numbers"><code class="prism language-kotlin" data-prism>import io.appwrite.Client
import io.appwrite.services.Account

val client = Client(context)
    .setEndpoint("https://cloud.appwrite.io/v1") // Your API Endpoint
    .setProject("[PROJECT_ID]")                  // Your project ID

val account = Account(client)

val jwt = account.createJWT()</code></pre>
    </li>
    <li>
        <h3>Apple</h3>
        <div class="ide" data-lang="swift" data-lang-label="Apple SDK">
            <pre class="line-numbers"><code class="prism language-swift" data-prism>import Appwrite

let client = Client()
    .setEndpoint("https://cloud.appwrite.io/v1") // Your API Endpoint
    .setProject("[PROJECT_ID]")                  // Your project ID

let account = Account(client)

let jwt = try await account.createJWT()</code></pre>
    </li>
    <li>
        <h3>GraphQL</h3>
        <div class="ide" data-lang="graphql" data-lang-label="GraphQL">
            <pre class="line-numbers"><code class="prism language-graphql" data-prism>mutation {
    accountCreateJWT {
        jwt
    }
}</code></pre>
        </div>
    </li>
</ul>

<p>Your server application can use the JWT to act on behalf of the user by creating a <code>Client</code> instance with the JWT for <b>each request it receives</b>. To keep your API secure, <b>discard the client object</b> after each request.</p>

<ul class="phases clear" data-ui-phases>
    <li>
        <h3>Node.js</h3>
        <div class="ide margin-top-small" data-lang="nodejs" data-lang-label="Node.js SDK">
            <pre class="line-numbers"><code class="prism language-javascript" data-prism>const { Client } = require('node-appwrite');

const client = new Client()
    .setEndpoint('https://cloud.appwrite.io/v1') // Your API Endpoint
    .setProject('[PROJECT_ID]')                  // Your project ID
    .setJWT('eyJJ9.eyJ...886ca');                // Your secret JSON Web Token</code></pre>
        </div>
    </li>
    <li>
        <h3>PHP</h3>

        <div class="ide margin-top-small" data-lang="php" data-lang-label="PHP SDK">
            <pre class="line-numbers"><code class="prism language-php" data-prism>use Appwrite\Client;

$client = (new Client())
    ->setEndpoint('https://cloud.appwrite.io/v1')            // Your API Endpoint
    ->setProject('[PROJECT_ID]')                             // Your project ID
    ->setJWT('eyJJ9.eyJ...886ca');                           // Your secret JSON Web Token</code></pre>
        </div>
    </li>
    <li>
        <h3>Python</h3>
        <div class="ide margin-top-small" data-lang="python" data-lang-label="Python SDK">
            <pre class="line-numbers"><code class="prism language-python" data-prism>from appwrite.client import Client

client = Client()

(client
  .set_endpoint('https://cloud.appwrite.io/v1') # Your API Endpoint
  .set_project('[PROJECT_ID]')                  # Your project ID
  .set_jwt('eyJJ9.eyJ...886ca')                 # Your secret JSON Web Token
)</code></pre>
        </div>
    </li>
    <li>
        <h3>Ruby</h3>
        <div class="ide margin-top-small" data-lang="ruby" data-lang-label="Ruby SDK">
            <pre class="line-numbers"><code class="prism language-ruby" data-prism>require 'appwrite'

include Appwrite

client = Client.new
    .set_endpoint('https://cloud.appwrite.io/v1')   # Your API Endpoint
    .set_project('[PROJECT_ID]')                    # Your project ID
    .set_jwt('eyJJ9.eyJ...886ca')                   # Your secret JSON Web Token</code></pre>
        </div>
    </li>
    <li>
        <h3>Deno</h3>
        <div class="ide margin-top-small" data-lang="typescript" data-lang-label="Deno SDK">
            <pre class="line-numbers"><code class="prism language-typescript" data-prism>import { Client } from "https://deno.land/x/appwrite/mod.ts";

let client = new Client()
    .setEndpoint('https://cloud.appwrite.io/v1')    // Your API Endpoint
    .setProject('[PROJECT_ID]')                     // Your project ID
    .setJWT('eyJJ9.eyJ...886ca');                   // Your secret JSON Web Token</code></pre>
        </div>
    </li>
    <li>
        <h3>Dart</h3>
        <div class="ide margin-top-small" data-lang="dart" data-lang-label="Dart SDK">
            <pre class="line-numbers"><code class="prism language-dart" data-prism>import 'package:dart_appwrite/dart_appwrite.dart';

final client = Client()
    .setEndpoint('https://cloud.appwrite.io/v1')    // Your API Endpoint
    .setProject('[PROJECT_ID]')                     // Your project ID
    .setJWT('eyJJ9.eyJ...886ca');                   // Your secret JSON Web Token</code></pre>
        </div>
    </li>
    <li>
        <h3>Kotlin</h3>
        <div class="ide margin-top-small" data-lang="kotlin" data-lang-label="Kotlin SDK">
            <pre class="line-numbers"><code class="prism language-kotlin" data-prism>import io.appwrite.Client

val client = Client()
    .setEndpoint("https://cloud.appwrite.io/v1")    // Your API Endpoint
    .setProject("[PROJECT_ID]")                     // Your project ID
    .setJWT("eyJJ9.eyJ...886ca")                    // Your secret JSON Web Token</code></pre>
        </div>
    </li>
    <li>
        <h3>Swift</h3>
        <div class="ide margin-top-small" data-lang="swift" data-lang-label="Swift SDK">
            <pre class="line-numbers"><code class="prism language-swift" data-prism>import Appwrite

let client = Client()
    .setEndpoint("https://cloud.appwrite.io/v1")    // Your API Endpoint
    .setProject("[PROJECT_ID]")                     // Your project ID
    .setJWT("eyJJ9.eyJ...886ca")                    // Your secret JSON Web Token</code></pre>
        </div>
    </li>
    <li>
        <h3>.NET</h3>
        <div class="ide margin-top-small" data-lang="csharp" data-lang-label=".NET SDK">
            <pre class="line-numbers"><code class="prism language-csharp" data-prism>using Appwrite;

var client = new Client()
    .SetEndpoint("https://cloud.appwrite.io/v1")    // Your API Endpoint
    .SetProject("[PROJECT_ID]")                     // Your project ID
    .SetJWT("eyJJ9.eyJ...886ca");                   // Your secret JSON Web Token</code></pre>
        </div>
    </li>
</ul>

<h2><a href="/docs/authentication-server#when-to-use" id="when-to-use">When Should I Use JWT Auth?</a></h2>
<p>JWT auth is useful when you need your backend app's Server SDK to be restricted by the same set of permissions.</p>

<p>If your backend app's Server SDK is using an <a href="/docs/keys">API key</a>, it will fetch <b>all resources</b> regardless of permissions. This means the Server SDK might fetch files and documents your user should not be able to see, which is not helpful when you need to act on behalf of a user.</p>

<p>If your backend app's Server SDK is using a <b>JWT</b>, it will only fetch resources your user has permissions to access.</p>

<h2><a href="/docs/authentication-server#when-to-use-example" id="when-to-use-example">Example</a></h2>

<p>Here's an example collection of birthdays with the following documents. Notice how they all have <b>different permissions</b>.</p>

<table class="full text-size-small">
    <thead>
    <tr>
        <td>$id</td>
        <td>name</td>
        <td>birthday</td>
        <td>$permissions</td>
    </tr>
    </thead>
    <tbody>
    <tr>
        <td>ac5fc866ad1e</td>
        <td>Kevin</td>
        <td>2012-02-03</td>
        <td>"read(\"user:user-a\")"</td>
    </tr>
    <tr>
        <td>bc7fc866ad1e</td>
        <td>Laura</td>
        <td>1999-09-22</td>
        <td>"read(\"user:user-b\")"</td>
    </tr>
    <tr>
        <td>cc2fc886ad1e</td>
        <td>Bob</td>
        <td>1982-05-11</td>
        <td>"read(\"user:user-c\")"</td>
    </tr>
    </tbody>
</table>

<p>If you're authenticated on the client-side as <code>user-a</code> and created a JWT <code>'eyJJ9.eyJ...886ca'</code>, you can pass this JWT to a Server SDK on the backend server to fetch only the birthdays <code>user-a</code> can read.</p>

<ul class="phases clear" data-ui-phases>
    <li>
        <h3>Node.js</h3>
        <div class="ide margin-top-small" data-lang="nodejs" data-lang-label="Node.js SDK">
            <pre class="line-numbers"><code class="prism language-javascript" data-prism>const { Client } = require('node-appwrite');

const client = new Client()
    .setEndpoint('https://cloud.appwrite.io/v1') // Your API Endpoint
    .setProject('[PROJECT_ID]')                  // Your project ID
    .setJWT('eyJJ9.eyJ...886ca');                // Your secret JSON Web Token

const databases = new sdk.Databases(client);

const documents = await databases.listDocuments(
    '642f358bf4084c662590',
    '642f3592aa5fc856ad1e'
);
// ... More code to manipulate the results</code></pre>
        </div>
    </li>
    <li>
        <h3>PHP</h3>

        <div class="ide margin-top-small" data-lang="php" data-lang-label="PHP SDK">
            <pre class="line-numbers"><code class="prism language-php" data-prism>use Appwrite\Client;

$client = (new Client())
    ->setEndpoint('https://cloud.appwrite.io/v1')            // Your API Endpoint
    ->setProject('[PROJECT_ID]')                           // Your project ID
    ->setJWT('eyJJ9.eyJ...886ca');                          // Your secret JSON Web Tokens

$databases = new Databases($client);

$documents = $databases->listDocuments(
    databaseId: '642f358bf4084c662590',
    collectionId: '642f3592aa5fc856ad1e'
);
// ... More code to manipulate the results</code></pre>
        </div>
    </li>
    <li>
        <h3>Python</h3>
        <div class="ide margin-top-small" data-lang="python" data-lang-label="Python SDK">
            <pre class="line-numbers"><code class="prism language-python" data-prism>from appwrite.client import Client

client = Client()

(client
  .set_endpoint('https://cloud.appwrite.io/v1')              # Your API Endpoint
  .set_project('[PROJECT_ID]')                             # Your project ID
  .set_jwt('eyJJ9.eyJ...886ca')                             # Your secret JSON Web Token
)

databases = Databases(client)

documents = databases.list_documents(
    database_id='642f358bf4084c662590',
    collection_id='642f3592aa5fc856ad1e'
)
# ... More code to manipulate the results</code></pre>
</code></pre>
        </div>
    </li>
    <li>
        <h3>Ruby</h3>
        <div class="ide margin-top-small" data-lang="ruby" data-lang-label="Ruby SDK">
            <pre class="line-numbers"><code class="prism language-ruby" data-prism>require 'appwrite'

include Appwrite

client = Client.new
    .set_endpoint('https://cloud.appwrite.io/v1')            # Your API Endpoint
    .set_project('[PROJECT_ID]')                           # Your project ID
    .set_jwt('eyJJ9.eyJ...886ca')                           # Your secret JSON Web Token

databases = Databases.new(client)

documents = databases.list_documents(
    database_id: '642f358bf4084c662590',
    collection_id: '642f3592aa5fc856ad1e'
)
# ... More code to manipulate the results</code></pre>
        </div>
    </li>
    <li>
        <h3>Deno</h3>
        <div class="ide margin-top-small" data-lang="typescript" data-lang-label="Deno SDK">
            <pre class="line-numbers"><code class="prism language-typescript" data-prism>import { Client } from "https://deno.land/x/appwrite/mod.ts";

let client = new Client()
    .setEndpoint('https://cloud.appwrite.io/v1')    // Your API Endpoint
    .setProject('[PROJECT_ID]')                     // Your project ID
    .setJWT('eyJJ9.eyJ...886ca');                   // Your secret JSON Web Token

let databases = new sdk.Databases(client);

let documents = await databases.listDocuments(
    '642f358bf4084c662590',
    '642f3592aa5fc856ad1e'
);
// ... More code to manipulate the results</code></pre>
        </div>
    </li>
    <li>
        <h3>Dart</h3>
        <div class="ide margin-top-small" data-lang="dart" data-lang-label="Dart SDK">
            <pre class="line-numbers"><code class="prism language-dart" data-prism>import 'package:dart_appwrite/dart_appwrite.dart';

final client = Client()
    .setEndpoint('https://cloud.appwrite.io/v1')    // Your API Endpoint
    .setProject('[PROJECT_ID]')                     // Your project ID
    .setJWT('eyJJ9.eyJ...886ca');                   // Your secret JSON Web Token

final databases = Databases(client);

final documents = await databases.listDocuments(
    databaseId: '642f358bf4084c662590',
    collectionId: '642f3592aa5fc856ad1e',
);
// ... More code to manipulate the results</code></pre>
        </div>
    </li>
    <li>
        <h3>Kotlin</h3>
        <div class="ide margin-top-small" data-lang="kotlin" data-lang-label="Kotlin SDK">
            <pre class="line-numbers"><code class="prism language-kotlin" data-prism>import io.appwrite.Client

val client = Client()
    .setEndpoint("https://cloud.appwrite.io/v1")    // Your API Endpoint
    .setProject("[PROJECT_ID]")                     // Your project ID
    .setJWT("eyJJ9.eyJ...886ca")                    // Your secret JSON Web Token

val databases = Databases(client)

val documents = databases.listDocuments(
    databaseId = "642f358bf4084c662590",
    collectionId = "642f3592aa5fc856ad1e",
)
// ... More code to manipulate the results</code></pre>
        </div>
    </li>
    <li>
        <h3>Swift</h3>
        <div class="ide margin-top-small" data-lang="swift" data-lang-label="Swift SDK">
            <pre class="line-numbers"><code class="prism language-swift" data-prism>import Appwrite

let client = Client()
    .setEndpoint("https://cloud.appwrite.io/v1")    // Your API Endpoint
    .setProject("[PROJECT_ID]")                     // Your project ID
    .setJWT("eyJJ9.eyJ...886ca")                    // Your secret JSON Web Token
    
let databases = Databases(client)

let documents = try await databases.listDocuments(
    databaseId: "642f358bf4084c662590",
    collectionId: "642f3592aa5fc856ad1e"
)
// ... More code to manipulate the results</code></pre>
        </div>
    </li>
    <li>
        <h3>.NET</h3>
        <div class="ide margin-top-small" data-lang="csharp" data-lang-label=".NET SDK">
            <pre class="line-numbers"><code class="prism language-csharp" data-prism>using Appwrite;
using Appwrite.Services;
using Appwrite.Models;

var client = new Client()
    .SetEndpoint("https://cloud.appwrite.io/v1")    // Your API Endpoint
    .SetProject("[PROJECT_ID]")                     // Your project ID
    .SetJWT("eyJJ9.eyJ...886ca");                   // Your secret JSON Web Token

var databases = new Databases(client);

var documents = await databases.ListDocuments(
    databaseId: "642f358bf4084c662590",
    collectionId: "642f3592aa5fc856ad1e");

// ... More code to manipulate the results</code></pre>
        </div>
    </li>
</ul>

<p>Only Kevin's birthday is returned and documents where <code>user-A</code> has no permissions to access are not returned.</p>
<div class="ide">
    <pre class="line-numbers"><code class="prism language-javascript" data-prism>{
  "total": 1,
  "documents": [
    {
      "name": "Kevin",
      "birthday": "2012-02-03T00:00:00.000+00:00",
      "$id": "ac5fc866ad1e",
      "$permissions": [
        "read(\"user:user-a\")"
      ],
      "$collectionId": "642f3592aa5fc856ad1e",
      "$databaseId": "642f358bf4084c662590",
      ...
    }
  ]
}</code></pre>
</div>

<p>If the same request is made where the Server SDK's <code>client</code> is authenticated with an API key instead of a JWT, the results returned will be different.</p>
<ul class="phases clear" data-ui-phases>
    <li>
        <h3>Node.js</h3>
        <div class="ide margin-top-small" data-lang="nodejs" data-lang-label="Node.js SDK">
            <pre class="line-numbers"><code class="prism language-javascript" data-prism>const { Client } = require('node-appwrite');

const client = new Client()
    .setEndpoint('https://cloud.appwrite.io/v1') // Your API Endpoint
    .setProject('[PROJECT_ID]')                  // Your project ID
    .setKey('98fd4...a2ad2');                    // Your secret API key

const databases = new sdk.Databases(client);

const documents = await databases.listDocuments(
    '642f358bf4084c662590',
    '642f3592aa5fc856ad1e'
);
// ... More code to manipulate the results</code></pre>
        </div>
    </li>
    <li>
        <h3>PHP</h3>

        <div class="ide margin-top-small" data-lang="php" data-lang-label="PHP SDK">
            <pre class="line-numbers"><code class="prism language-php" data-prism>use Appwrite\Client;

$client = (new Client())
    ->setEndpoint('https://cloud.appwrite.io/v1') // Your API Endpoint
    ->setProject('[PROJECT_ID]')                  // Your project ID
    ->setKey('98fd4...a2ad2');                    // Your secret API key

$databases = new Databases($client);

$documents = $databases->listDocuments(
    databaseId: '642f358bf4084c662590',
    collectionId: '642f3592aa5fc856ad1e'
);
// ... More code to manipulate the results</code></pre>
        </div>
    </li>
    <li>
        <h3>Python</h3>
        <div class="ide margin-top-small" data-lang="python" data-lang-label="Python SDK">
            <pre class="line-numbers"><code class="prism language-python" data-prism>from appwrite.client import Client

client = Client()

(client
    .set_endpoint('https://cloud.appwrite.io/v1') # Your API Endpoint
    .set_project('[PROJECT_ID]')                  # Your project ID
    .set_key('98fd4...a2ad2')                     # Your secret API key
)

databases = Databases(client)

documents = databases.list_documents(
    database_id='642f358bf4084c662590',
    collection_id='642f3592aa5fc856ad1e'
)
# ... More code to manipulate the results</code></pre>
            </code></pre>
        </div>
    </li>
    <li>
        <h3>Ruby</h3>
        <div class="ide margin-top-small" data-lang="ruby" data-lang-label="Ruby SDK">
            <pre class="line-numbers"><code class="prism language-ruby" data-prism>require 'appwrite'

include Appwrite

client = Client.new
    .set_endpoint('https://cloud.appwrite.io/v1') # Your API Endpoint
    .set_project('[PROJECT_ID]')                  # Your project ID
    .set_key('98fd4...a2ad2')                     # Your secret API key

databases = Databases.new(client)

documents = databases.list_documents(
    database_id: '642f358bf4084c662590',
    collection_id: '642f3592aa5fc856ad1e'
)
# ... More code to manipulate the results</code></pre>
        </div>
    </li>
    <li>
        <h3>Deno</h3>
        <div class="ide margin-top-small" data-lang="typescript" data-lang-label="Deno SDK">
            <pre class="line-numbers"><code class="prism language-typescript" data-prism>import { Client } from "https://deno.land/x/appwrite/mod.ts";

let client = new Client()
    .setEndpoint('https://cloud.appwrite.io/v1') // Your API Endpoint
    .setProject('[PROJECT_ID]')                  // Your project ID
    .setKey('98fd4...a2ad2');                    // Your secret API key

let databases = new sdk.Databases(client);

let documents = await databases.listDocuments(
    '642f358bf4084c662590',
    '642f3592aa5fc856ad1e'
);
// ... More code to manipulate the results</code></pre>
        </div>
    </li>
    <li>
        <h3>Dart</h3>
        <div class="ide margin-top-small" data-lang="dart" data-lang-label="Dart SDK">
            <pre class="line-numbers"><code class="prism language-dart" data-prism>import 'package:dart_appwrite/dart_appwrite.dart';

final client = Client()
    .setEndpoint('https://cloud.appwrite.io/v1') // Your API Endpoint
    .setProject('[PROJECT_ID]')                  // Your project ID
    .setKey('98fd4...a2ad2');                    // Your secret API key

final databases = Databases(client);

final documents = await databases.listDocuments(
    databaseId: '642f358bf4084c662590',
    collectionId: '642f3592aa5fc856ad1e',
);
// ... More code to manipulate the results</code></pre>
        </div>
    </li>
    <li>
        <h3>Kotlin</h3>
        <div class="ide margin-top-small" data-lang="kotlin" data-lang-label="Kotlin SDK">
            <pre class="line-numbers"><code class="prism language-kotlin" data-prism>import io.appwrite.Client

val client = Client()
    .setEndpoint("https://cloud.appwrite.io/v1") // Your API Endpoint
    .setProject("[PROJECT_ID]")                  // Your project ID
    .setKey('98fd4...a2ad2');                    // Your secret API key

val databases = Databases(client)

val documents = databases.listDocuments(
    databaseId = "642f358bf4084c662590",
    collectionId = "642f3592aa5fc856ad1e",
)
// ... More code to manipulate the results</code></pre>
        </div>
    </li>
    <li>
        <h3>Swift</h3>
        <div class="ide margin-top-small" data-lang="swift" data-lang-label="Swift SDK">
            <pre class="line-numbers"><code class="prism language-swift" data-prism>import Appwrite

let client = Client()
    .setEndpoint("https://cloud.appwrite.io/v1") // Your API Endpoint
    .setProject("[PROJECT_ID]")                  // Your project ID
    .setKey('98fd4...a2ad2');                    // Your secret API key

let databases = Databases(client)

let documents = try await databases.listDocuments(
    databaseId: "642f358bf4084c662590",
    collectionId: "642f3592aa5fc856ad1e"
)
// ... More code to manipulate the results</code></pre>
        </div>
    </li>
    <li>
        <h3>.NET</h3>
        <div class="ide margin-top-small" data-lang="csharp" data-lang-label=".NET SDK">
            <pre class="line-numbers"><code class="prism language-csharp" data-prism>using Appwrite;
using Appwrite.Services;
using Appwrite.Models;

var client = new Client()
    .SetEndpoint("https://cloud.appwrite.io/v1") // Your API Endpoint
    .SetProject("[PROJECT_ID]")                  // Your project ID
    .SetKey('98fd4...a2ad2');                    // Your secret API key

var databases = new Databases(client);

var documents = await databases.ListDocuments(
    databaseId: "642f358bf4084c662590",
    collectionId: "642f3592aa5fc856ad1e");

// ... More code to manipulate the results</code></pre>
        </div>
    </li>
</ul>

<p>This will return every document regardless of permissions, which could lead to privacy and security problems.</p>

<div class="ide">
    <pre class="line-numbers"><code class="prism language-javascript" data-prism>{
  "total": 3,
  "documents": [
    {
      "name": "Kevin",
      "birthday": "2012-02-03T00:00:00.000+00:00",
      "$id": "ac5fc866ad1e",
      "$permissions": [
        "read(\"user:user-a\")"
      ],
      "$collectionId": "642f3592aa5fc856ad1e",
      "$databaseId": "642f358bf4084c662590",
      ...
    },
    {
      "name": "Laura",
      "birthday": "1999-09-22T11:21:23.334+00:00",
      "$id": "bc7fc866ad1e",
      "$permissions": [
        "read(\"user:user-b\")"
      ],
      "$collectionId": "642f3592aa5fc856ad1e",
      "$databaseId": "642f358bf4084c662590",
      ...
    },
    {
      "name": "Bob",
      "birthday": "1982-05-11T12:31:39.381+00:00",
      "$id": "cc2fc886ad1e",
      "$permissions": [
        "read(\"user:user-c\")"
      ],
      "$collectionId": "642f3592aa5fc856ad1e",
      "$databaseId": "642f358bf4084c662590",
      ...
    }
  ]
}</code></pre>
</div>

<p>If you're integrating existing backend services with Appwrite or adding backend endpoints to perform more complex logic, JWT authentication helps them behave similarly to actual Appwrite endpoints.</p>
