How Does Apex Class Security Work?

You can set Apex class security via:

• The Apex class list page
• An Apex class detail page
• Permission sets
• Profiles

These permissions apply only to methods that are in top-level Apex classes or Apex transaction entry points, such as:

• Aura component controllers
• @AuraEnabled methods called from Lightning web components
• Visualforce controllers
• Apex REST services
• Asynchronous Apex classes

Note If you’ve installed a managed package in your org, you can set security only for the Apex classes in the package that are declared as global or for classes that contain methods declared as webService.

If users have the Author Apex permission, they can access all Apex classes in the associated organization, regardless of the security settings for individual classes.

Permission for an Apex class is checked only at the top level. For example, class A calls class B. User X has a profile that can access class A but not class B. User X can execute the code in class B, but only through class A; user X cannot invoke class B directly. Similarly, if a Lightning web component calls an Apex class, security is only verified for that primary class. If that class calls a secondary class the user doesn’t have explicit permission to access, the user can still execute that code in the secondary class, but only through the primary class.

You can only set security on Apex classes, not on triggers.

• Set Apex Class Access from the Class List Page
  Limit which users can execute methods in a particular top-level Apex class based on their profiles.
• Set Apex Class Access from the Class Detail Page
  Limit which users can execute methods in a particular top-level Apex class based on their profiles.
• Set Apex Class Access from Permission Sets
  You can specify which methods in a top-level Apex class are executable for a permission set.
• Set Apex Class Access from Profiles
  Specify which methods in a top-level Apex class are executable for a profile.
• Create Apex Sharing Reasons
  When creating Apex managed sharing, create Apex sharing reasons for individual custom objects to indicate why sharing was implemented.
• Recalculate Apex Managed Sharing
  Developers can write batch Apex classes that recalculate the Apex managed sharing for a specific custom object.