---
title: "Setup Access Control for Data Streams"
url: https://docs.catalyst.zoho.com/en/cloud-scale/help/data-streams/implementation/setup-access-control/
description: "Configure User Roles or Custom Logic authentication to control subscriber access to Data Streams channels."
last_updated: 2026-10-08T06:34:32Z
service: Cloud Scale
type: general
related_links:
  - name: "Create a Channel"
    url: /en/cloud-scale/help/data-streams/implementation/create-channel/
  - name: "Manage Channels"
    url: /en/cloud-scale/help/data-streams/implementation/manage-channels/
  - name: "User Roles - Catalyst Authentication"
    url: /en/cloud-scale/help/authentication/user-management/roles/introduction/
  - name: "Advanced I/O Functions"
    url: /en/serverless/help/functions/advanced-io/
---

# Setup Access Control

To configure access control for your channel:

> **Note:** You should have a [channel created](https://docs.catalyst.zoho.com/en/cloud-scale/help/data-streams/implementation/create-channel/) before configuring access control. Access control applies only to subscribers. Publishers are authenticated through the Catalyst SDK or the REST API and do not require access control configuration.

1. Select an access control type during channel creation or from the *Access Control* section.

**User Roles**

Use this when subscribers are authenticated users in Catalyst Authentication with predefined roles.

2. Select **User Roles**.
3. Select one or more roles from the dropdown menu.
  ![Select user roles for channel access control](https://catalyst-docs-development.zohostratus.in/images/help/data-streams/user-roles-selection.webp)

4. Click **Create** or **Update**.

Only users belonging to the selected roles can subscribe to the channel. When a role is removed, subscribers with that role lose access immediately. When a role is granted, users with that role can subscribe immediately.

> **Note:** To create new roles, refer to the [Catalyst Authentication User Roles documentation](https://docs.catalyst.zoho.com/en/cloud-scale/help/authentication/user-management/roles/introduction/).

**Custom Logic**

Use this when you need custom authentication logic beyond role-based access (SSO, session-based connections, anonymous users, or custom criteria).

2. Create an Advanced I/O function that handles subscriber authentication:

```javascript

module.exports = async (req, res) => {
    const { userId, connectionName } = req.body;
    
    // Your custom validation logic
    const isAuthorized = await yourCustomValidationLogic(userId);
    
    if (isAuthorized) {
        res.status(200).json({ approved: true });
    } else {
        res.status(403).json({ approved: false, reason: "Unauthorized" });
    }
};

```

The function must accept connection requests, perform validation logic, and return approval or rejection.

3. Select **Custom Logic**.
4. Select your Advanced I/O function from the dropdown. If the function doesn't exist, click **Create new Advanced I/O function** to create one first.
  ![Select custom logic function for access control](https://catalyst-docs-development.zohostratus.in/images/help/data-streams/custom-logic-function-selection.webp)

5. Click **Create** or **Update**.

> **Note:** Only Advanced I/O functions are supported. Ensure the function is deployed and available in your project before configuring it.

### Manage Subscriber Connections

After access control is configured, navigate to the *Manage Connections* section in the *Access Control* tab to view all subscribers.

![List of subscriber connections in Manage Connections](https://catalyst-docs-development.zohostratus.in/images/help/data-streams/manage-connections-list.webp)

Each connection displays:

<table class="content-table">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>**Connection Name**</td>
<td>Unique identifier for the subscriber connection (generated during token pair creation)</td>
</tr>
<tr>
<td>**User Type**</td>
<td>Type of user (App User or Custom User) based on access control configuration</td>
</tr>
<tr>
<td>**Status**</td>
<td>Current connection state: Active, Inactive, or Blocked</td>
</tr>
</tbody>
</table>

**To block a subscriber:**

1. Locate the subscriber connection.
2. Click the **three-dot menu** icon.
3. Select **Block**.
  ![Block subscriber from three-dot menu](https://catalyst-docs-development.zohostratus.in/images/help/data-streams/manage-connections-block-menu.webp)

Blocking terminates the active connection immediately.

**To delete a subscriber connection:**

1. Locate the subscriber connection.
2. Click the **three-dot menu** icon.
3. Select **Delete**.
4. Confirm deletion in the dialog.