Strapi Users & Roles — Authenticated, Public, and Custom Roles Explained

In this tutorial, you will learn how Strapi manages users and roles through the Users & Permissions plugin, including the built-in Authenticated and Public roles, and how to create custom roles that match your application's access control requirements.

What You'll Learn

• The Users & Permissions plugin and its role in Strapi
• The difference between Public and Authenticated roles
• How to create custom roles for different user types
• How to configure user registration and profile fields
• How user data is stored and accessed through the API
• How to manage users through the admin panel

Why It Matters

Almost every application needs user accounts. A recipe site might have readers (public), recipe submitters (authenticated), and editors (custom role). Each group needs different access levels. Strapi's role system lets you define these groups and control what each can see and do through the API without writing any custom code.

Real-World Use

A cooking school platform has three user types: Free members who can read recipes, Premium members who can save favorites and submit recipes, and Admin instructors who can create courses and manage content. Each user type is a role with different permissions. Free members use the Public role. Premium members use the Authenticated role. Instructors use a custom "Instructor" role with elevated permissions.

Learning Path

flowchart LR
  A["API Security"] --> B["Users & Roles
-- You are here"]:::current
  B --> C["Permissions"]
  C --> D["Authentication"]
  D --> E["SSO & OAuth"]
  E --> F["Advanced Auth"]

  classDef current fill:#4945ff,color:#fff,stroke-width:2px

The Users & Permissions Plugin

The Users & Permissions plugin is installed by default in every Strapi project. It provides:

• User registration and login
• JWT-based authentication
• Role management (Public, Authenticated, custom)
• Permission configuration per role
• Provider integration (Google, GitHub, Facebook)

The plugin creates a "User" content type with default fields: username, email, password, confirmed, blocked, and role. You can add custom fields to the User type just like any other content type.

Public Role

The Public role represents unauthenticated visitors — anyone who accesses your API without a JWT token.

By default, the Public role has no permissions. You must explicitly enable each endpoint for public access.

// Common public permissions
// Settings > Users & Permissions > Roles > Public
// Enable:
//   - Article: find, findOne  (read published articles)
//   - Category: find, findOne (read categories)
//   - Auth: login            (log in)
//   - Auth: register         (register new account)

// Never enable for Public:
//   - Article: create, update, delete
//   - User: find, findOne (user data is private)
//   - Any admin-level operations

The Public role should have the minimum permissions needed for your application to function. Users should authenticate to access protected resources.

Authenticated Role

The Authenticated role represents logged-in users. When a user registers and logs in, they receive this role by default.

// Common authenticated permissions
// Enable for Authenticated:
//   - Article: find, findOne  (read articles)
//   - Article: create         (create their own articles)
//   - Article: update         (update their own articles — requires custom logic)
//   - User: findOne           (read their own profile)
//   - User: update            (update their own profile)
//   - Auth: logout

// Typically restricted:
//   - Article: delete          (depending on application)
//   - User: find               (list all users — usually admin only)
//   - User: create             (self-registration is handled through auth endpoints)

The Authenticated role can be customized per application. A social network might give authenticated users full CRUD on their own posts. A corporate intranet might limit authenticated users to read-only access.

Creating Custom Roles

Custom roles let you define user types beyond the built-in Public and Authenticated.

// Creating a custom role via admin panel:
// Settings > Users & Permissions > Roles > Add New Role

// Example custom roles:
// 1. Editor — Can create and edit articles, manage categories
// 2. Moderator — Can moderate comments, flag content
// 3. Premium — Can access premium content endpoints
// 4. API Consumer — Can access API via tokens (not user-based)

// Custom role configuration
{
  "name": "Editor",
  "description": "Content editors who can manage articles and categories",
  "permissions": {
    "api::article.article": {
      "controllers": {
        "article": {
          "find": { "enabled": true },
          "findOne": { "enabled": true },
          "create": { "enabled": true },
          "update": { "enabled": true },
          "delete": { "enabled": false }
        }
      }
    },
    "api::category.category": {
      "controllers": {
        "category": {
          "find": { "enabled": true },
          "findOne": { "enabled": true },
          "create": { "enabled": true }
        }
      }
    }
  }
}

After creating the role, you assign it to users by editing the user's profile in the admin panel or through the API.

User Profile Fields

The default User content type has limited fields. You can extend it with custom fields:

// Adding custom fields to User via Content-Type Builder
// Edit the User collection type and add:
// - full_name (string)
// - avatar (media, single image)
// - bio (text)
// - website (string)
// - phone (string)
// - preferences (JSON)

// These fields become available in the API:
GET /api/users/me
// Response includes your custom fields

Be careful about adding sensitive fields. User data is accessible through the API based on role permissions. Mark private fields (like internal_notes) with private: true in the schema to exclude them from API responses.

User Management API

Strapi provides endpoints for user management:

// Get current user profile
GET /api/users/me
// Requires: JWT token
// Returns: Current user data with all fields

// Get specific user (by ID)
GET /api/users/5
// Requires: Admin or appropriate permissions
// Returns: User data

// List all users
GET /api/users
// Requires: Admin role with user:find permission
// Returns: Array of user objects

// Create user (admin only)
POST /api/users
{
  "data": {
    "username": "newuser",
    "email": "new@example.com",
    "password": "securepassword",
    "role": 2  // Role ID
  }
}

// Update user
PUT /api/users/5
{
  "data": {
    "full_name": "Updated Name",
    "bio": "Updated bio"
  }
}

// Delete user
DELETE /api/users/5

User passwords are hashed and cannot be retrieved through the API. When updating a user, omit the password field unless you intend to change it.

Managing Users in the Admin Panel

The admin panel provides a user management interface:

Settings > Users & Permissions > Users
-- User list with search and filters
-- Create new user button
-- Edit user: profile fields, role assignment, confirmation status
-- Block/unblock users
-- Delete users

From the user edit page, you can:

• Change the user's role
• Mark email as confirmed
• Block the user (prevents login)
• View the user's created content
• Reset the user's password

Common Mistakes

1. Giving Public role too many permissions. Public users should only read published content. Do not enable create, update, or delete for public access unless absolutely necessary.

2. Not creating custom roles when needed. Using the Authenticated role for all logged-in users means you cannot differentiate between regular users and moderators. Create custom roles for different user types.

3. Exposing sensitive user fields. The User content type API can expose sensitive data. Review which user fields are accessible through the API and mark private fields with private: true.

4. Forgetting to confirm new users. User accounts can be set to require email confirmation. If enabled, unconfirmed users cannot log in. Check the Users & Permissions advanced settings for your confirmation policy.

5. Not managing the default Authenticated role carefully. Every new user gets the Authenticated role. If you change the default role, all new users will get the new role. Test role configurations thoroughly.

Practice Questions

1. What are the two built-in roles in Strapi? Answer: Public (unauthenticated visitors) and Authenticated (logged-in users). Public has no permissions by default. Authenticated is the default role for registered users.

2. How do you create a custom role for moderators? Answer: Go to Settings > Users & Permissions > Roles > Add New Role, name it "Moderator", configure its permissions per content type and action, then assign it to users through their profile.

3. What is the API endpoint to get the current user's profile? Answer: GET /api/users/me with a valid JWT token in the Authorization header.

4. Challenge: Design a role system for a multi-user blog platform: (1) Create roles for Subscriber (read only), Author (create and edit own articles), Editor (edit all articles, manage categories), and Admin (full access). (2) Configure permissions for each role. (3) Create test users for each role. (4) Write API requests that demonstrate what each user can and cannot do based on their role.

FAQ

Mini Project

Your task: Implement a complete role system for a content platform.

1. Create custom roles: Free Member (public + read articles), Premium Member (read + save favorites), Contributor (create articles), Editor (manage all content), Admin (full access).
2. Configure permissions for each role appropriately.
3. Create at least one test user per role.
4. Write a test script that logs in as each user and attempts various API operations.
5. Verify that each role can only perform allowed actions and receives 403 Forbidden for disallowed actions.
6. Document the permission matrix showing which roles can do which operations on each content type.

What's Next

Now that you understand roles, proceed to Permissions to learn about granular per-endpoint and per-field permissions, including CRUD granularity and custom permission logic. After that, dive into Authentication for JWT, login/register flows, and token management.

Related lessons:

• WordPress User Roles — Compare with Strapi roles
• REST API Security — Access control in APIs
• Node.js — How Strapi stores and verifies roles