Content Protection

Content Protection controls which parts of a document users can edit or read. Define permissions for Nodes, Marks, attributes and content with a policy.

Install

First, contact our team for access to the Content Protection pilot program.

After gaining access, follow the private registry setup guide, then install the package:

npm install @tiptap/core @tiptap/starter-kit @tiptap/y-tiptap yjs @tiptap-pro/extension-content-protection

Add the extension to your editor.

import { Editor } from '@tiptap/core'
import StarterKit from '@tiptap/starter-kit'
import {
  ContentProtection,
  type ContentProtectionPolicy,
} from '@tiptap-pro/extension-content-protection'

const policy: ContentProtectionPolicy = {
  version: 1,
  rules: [
    {
      selector: { target: 'node', node: { types: ['heading'] } },
      permissions: { edit: false },
    },
  ],
}

const editor = new Editor({
  extensions: [StarterKit, ContentProtection.configure({ policy })],
})

Provide a policy that defines what can be edited.

You can also update the content protection rules while the editor is running:

editor.commands.setContentProtectionPolicy({ policy })

See the API reference and policy language.

Collaboration

Content Protection supports Tiptap Collaboration. Each collaborator can have a different local policy. Local edits are checked against that policy; updates from the collaboration binding are accepted so all editors stay synchronized with the shared document. This includes initial synchronization and collaborative undo/redo, even if the current local policy would reject the corresponding edit. Read permissions still control what each collaborator sees and copies.

import Collaboration from '@tiptap/extension-collaboration'

const editor = new Editor({
  extensions: [
    StarterKit.configure({ undoRedo: false }),
    Collaboration.configure({ document: ydoc }),
    ContentProtection.configure({ policy: localPolicy }),
  ],
})

Here, ydoc is the shared Y.Doc connected to your collaboration provider, and localPolicy is the policy your application assigns to this user. Install @tiptap/extension-collaboration to use this setup. Policies remain local and are not stored in the shared document. These client-side permissions do not authorize incoming collaboration updates; enforce access to the shared document in your application and collaboration service.