# Authoritative server storage writes

**URL:** <https://forum.heroiclabs.com/t/authoritative-server-storage-writes/636>\
**Category:** Local Setup\
**Created:** [April 14, 2020, 2:46am UTC](https://forum.heroiclabs.com/t/authoritative-server-storage-writes/636 "2020-04-14T02:46:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jonbonazza](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.heroiclabs.com/jonbonazza/32/141_2.png) [@jonbonazza](https://forum.heroiclabs.com/u/jonbonazza)\
**Post date:** [April 14, 2020, 2:46am UTC](https://forum.heroiclabs.com/t/authoritative-server-storage-writes/636/1 "2020-04-14T02:46:04Z")

</div>

Nakama’s storage engine currently only allows _Owner Write_ and _No Write_ permissions, which works fine in many cases, however for us, we have an authoritative server outside of Nakama who needs to write storage data on behalf of a connected player. For instance, updating character information like stats and equipment should be handled by the authoritative server and not the clients themselves. The clients _are_ the ones who make the initial request to create the character though, as at that point, the client isn’t connected to an authoritative server.

I don’t see a clear path to implement this. Any ideas?

One thing I thought of that _might_ work is to have a separate authoritative user that only RPCs have access to and is maintained in a background goroutine on the server. This seems overly complicated and prone to error, however, so I was wondering if there were a simpler approach here.

---

<div class="post-metadata">

**Author:** ![jonbonazza](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.heroiclabs.com/jonbonazza/32/141_2.png) [@jonbonazza](https://forum.heroiclabs.com/u/jonbonazza)\
**Post date:** [April 14, 2020, 3:00am UTC](https://forum.heroiclabs.com/t/authoritative-server-storage-writes/636/2 "2020-04-14T03:00:55Z")

</div>

Scratch that. I had forgotten that you don’t need to specify a user id when creating an object and if no user id is provided, it will be system owned, which is exactly what I want. Sorry!
