Docly Developers
Function API only Updated 23 Oct 2026

denyAccess()

Sets the response of the current API request to HTTP 401 Login Required. It does NOT stop your code: the function returns, and everything after the call still runs. Always use it as return docly.denyAccess();. Use it in #/API/ endpoints to block requests that are missing a valid request.Jwt or that lack the required role. Because hash templates are static and cached, denyAccess() belongs in API/JS files — never in .hash templates.

See also writeJwt deleteJwt logOut flagActivity getProfilePictureUrl Custom JWT login example Example: Create custom JWT login Example: Fix unique ROWID values in a site Example: Import data to Docly from Excel (XLSX)

Parameters

This function takes no parameters.

Returns

null. The response gets HTTP code 401 when the request finishes. Return straight away — code after the call still runs and can still write data.

Example

Normal JavaScript, running in the browser or on the Docly™ server.
// #/API/secret-data.js — a protected API endpoint
export default () => {

    // Block users who are not logged in
    if (!request.Jwt) {
        return docly.denyAccess();
    }

    // Block users who don't have the required role
    if (request.Jwt.access !== "admin") {
        return docly.denyAccess();
    }

    // Authorized — return the protected payload
    return {
        secret: "Only admins see this"
    };
}

// denyAccess() sets HTTP 401 but does not stop the function — always "return" it.
// See writeJwt() for issuing the JWT cookie that populates request.Jwt.