---
schema_version: "1"
id: e85cc440a7ffb0c87199176ef07b70189984dec726e14fe8803df224182a8957
title: How Does Apex Class Security Work?
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/code_package_security.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.code_package_security.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 0af9dc2f07ca447cd44e80afc4c7eb7fa0d89d59440398da3c6068f0b15f7582
description: Limit which users can execute methods in a particular top-level Apex class based on their profiles or an associated permission set. This technique lets you apply granular security to Apex operations in your org.
products:
  - Salesforce Platform
release: "264"
---
# How Does Apex Class Security Work?

Limit which users can execute methods in a particular top-level Apex class based on their profiles or an associated permission set. This technique lets you apply granular security to Apex operations in your org.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (<a href="https://help.salesforce.com/s/articleView?id=xcloud.overview_edition_lex_only.htm&amp;type=5&amp;language=en_US" target="_blank">not available in all orgs</a>) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Performance</strong>, <strong>Unlimited</strong>, <strong>Developer</strong>, <strong>Enterprise</strong>, and <strong>Database.com</strong> Editions</td></tr></tbody></table>

You can set Apex class security via:

- The Apex class list page
- An Apex class detail page
- Permission sets
- Profiles

These permissions apply only to methods that are in top-level Apex classes or Apex transaction entry points, such as:

- Aura component controllers
- `@AuraEnabled` methods called from Lightning web components
- Visualforce controllers
- Apex REST services
- Asynchronous Apex classes

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_code-264-0-0-production-enus/789bc523-706b-4ae4-8fe9-be6322e38b6b/images/icon_note.png)

Note If you’ve installed a managed package in your org, you can set security only for the Apex classes in the package that are declared as `global` or for classes that contain methods declared as `webService`.

If users have the Author Apex permission, they can access all Apex classes in the associated organization, regardless of the security settings for individual classes.

Permission for an Apex class is checked only at the top level. For example, class A calls class B. User X has a profile that can access class A but not class B. User X can execute the code in class B, but only through class A; user X cannot invoke class B directly. Similarly, if a Lightning web component calls an Apex class, security is only verified for that primary class. If that class calls a secondary class the user doesn’t have explicit permission to access, the user can still execute that code in the secondary class, but only through the primary class.

You can only set security on Apex classes, not on triggers.

- **[Set Apex Class Access from the Class List Page](https://help.salesforce.com/s/articleView?id=platform.code_apex_access_via_list.htm&release=264.0.0&type=5)**  
    Limit which users can execute methods in a particular top-level Apex class based on their profiles.
- **[Set Apex Class Access from the Class Detail Page](https://help.salesforce.com/s/articleView?id=platform.code_apex_access_via_detail.htm&release=264.0.0&type=5)**  
    Limit which users can execute methods in a particular top-level Apex class based on their profiles.
- **[Set Apex Class Access from Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_setting_apex_access.htm&release=264.0.0&type=5)**  
    You can specify which methods in a top-level Apex class are executable for a permission set.
- **[Set Apex Class Access from Profiles](https://help.salesforce.com/s/articleView?id=platform.users_profiles_apex_access.htm&release=264.0.0&type=5)**  
    Specify which methods in a top-level Apex class are executable for a profile.
- **[Create Apex Sharing Reasons](https://help.salesforce.com/s/articleView?id=platform.security_apex_sharing_reasons.htm&release=264.0.0&type=5)**  
    When creating Apex managed sharing, create Apex sharing reasons for individual custom objects to indicate why sharing was implemented.
- **[Recalculate Apex Managed Sharing](https://help.salesforce.com/s/articleView?id=platform.security_apex_sharing_recalc.htm&release=264.0.0&type=5)**  
    Developers can write batch Apex classes that recalculate the Apex managed sharing for a specific custom object.

#### See Also

- [Security Guidelines for Apex and Visualforce Development](https://help.salesforce.com/s/articleView?id=platform.review_and_certification.htm&release=264.0.0&type=5 "Understand and guard against vulnerabilities in your code as you develop custom applications.")
- [_Apex Developer Guide_](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_dev_guide.htm)