Payload Local API: zero HTTP, but full access control when you want it

payload.find() hits the database directly, in the same process — no HTTP, no fetch. By default it also bypasses access control, on the assumption that server-side code trusts itself.

That assumption is exactly where holes appear. In server functions and endpoints that run on behalf of a user, you have to consciously turn enforcement on:

// DANGEROUS — full access, ignores access control

const docs = await payload.find({ collection: 'posts' })



// SAFE — respects access control for the given user

const docs = await payload.find({

  collection: 'posts',

  overrideAccess: false,

  user,

})

The trap is the default: overrideAccess is true unless you say otherwise. Any Local API call that returns data to an end user should pass overrideAccess: false and the user.