> For the complete documentation index, see [llms.txt](https://ans-dev.gitbook.io/datareplicator/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ans-dev.gitbook.io/datareplicator/api-reference/server-side-api/setauthorizationcallback.md).

# :SetAuthorizationCallback

Sets a single, powerful function on the server that acts as a central security checkpoint for all client data requests. This callback is your primary tool for controlling precisely which players can access which data keys.

When a client attempts to [:Request()](/datareplicator/api-reference/client-side-api/request.md) or [:Listen()](/datareplicator/api-reference/client-side-api/listen.md) to a realKey, this function is invoked on the server. You can then implement any logic you need.

***

**`DataReplicator:SetAuthorizationCallback(callback)`**

{% tabs %}
{% tab title="Parameters" %}
`callback: ((player: Player, realKey: string) -> boolean)?`

* A function that takes the Player object initiating the request and the `realKey` ([string](https://create.roblox.com/docs/luau/strings)) they are trying to access.
* It **must** return `true` if access is allowed, or `false` if it should be denied.
* Pass `nil` to remove the current authorization callback.
  {% endtab %}

{% tab title="Notes" %}

* **Security Best Practice:** It is highly recommended to set an authorization callback and enable `REQUIRE_AUTHORIZATION_CALLBACK` in the internal configuration. This creates a "deny-by-default" security posture, which is much safer.
* If no callback is set and `REQUIRE_AUTHORIZATION_CALLBACK` is `false` (the default), all client requests for valid, registered keys will be allowed.
* Any errors that occur inside your callback function will be caught, and access will be denied to prevent accidental data exposure.
  {% endtab %}

{% tab title="Example" %}
{% code title="GameAuthorization.luau" %}

```lua
-- This function defines all our data access rules in one place.
local function myGameAuthorization(player, realKey)

	-- Rule 1: Only allow admins to access admin-specific data.
	local ADMIN_USER_IDS = {12345, 67890} -- Your admin UserIDs
	if string.sub(realKey, 1, 6) == "Admin_" then
		if table.find(ADMIN_USER_IDS, player.UserId) then
			return true -- Allow access
		else
			return false -- Deny access for non-admins
		end
	end

	-- Rule 2: Allow players to access their own data, but not others'.
	-- Assumes keys are formatted like "PlayerData_12345678"
	local success, _, userIdString = string.find(realKey, "^PlayerData_(%d+)$")
	if success then
		if tonumber(userIdString) == player.UserId then
			return true -- Allow access to their own data
		else
			return false -- Deny access to other players' data
		end
	end
	
	-- Rule 3: Allow all players to access public game state data.
	if string.sub(realKey, 1, 7) == "Public_" then
		return true
	end

	-- Default Rule: Deny everything else.
	return false
end

DataReplicator:SetAuthorizationCallback(myGameAuthorization)
```

{% endcode %}
{% endtab %}
{% endtabs %}