# Filter data collection on Auth user (via google sheets data source)

**URL:** <https://community.weweb.io/t/filter-data-collection-on-auth-user-via-google-sheets-data-source/3205>\
**Category:** How do I?\
**Created:** [June 26, 2023, 8:36am UTC](https://community.weweb.io/t/filter-data-collection-on-auth-user-via-google-sheets-data-source/3205 "2023-06-26T08:36:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Loick](https://avatars.discourse-cdn.com/v4/letter/l/74df32/32.png) [@Loick](https://community.weweb.io/u/Loick)\
**Post date:** [June 26, 2023, 8:36am UTC](https://community.weweb.io/t/filter-data-collection-on-auth-user-via-google-sheets-data-source/3205/1 "2023-06-26T08:36:51Z")

</div>

Hello !  
I’m looking at weweb to create an MVP for a batch of clients (50) to provide them specific data (dynamic CRM).  
For now, I’m using gsheet data sources (automatically updated) for a test where I have a table with more than 1000 rows which can be identified via client\_id (integer)  
How can I provide only data related to my client\_id when they authenticate in weweb ? Data are sensitive and I don’t want other client to download data of other client (even if it’s not directly visible)

---

<div class="post-metadata">

**Author:** ![jaredgibb](https://avatars.discourse-cdn.com/v4/letter/j/ecd19e/32.png) [@jaredgibb](https://community.weweb.io/u/jaredgibb)\
**Post date:** [June 26, 2023, 12:00pm UTC](https://community.weweb.io/t/filter-data-collection-on-auth-user-via-google-sheets-data-source/3205/2 "2023-06-26T12:00:38Z")

</div>

1. Google sheets isn’t a good database for an app. Cause it’s not a database. It’s a spreadsheet software.

2. I’d start with something like [sheetdb.io](http://sheetdb.io) or some other service that converts your sheet to a nice RESTful interface and allows you to query against the table like [this](https://docs.sheetdb.io/sheetdb-api/search) 👍

This is a shit method and doesn’t offer much security for your users, at all.

Instead you should rely on a backend that provides both authentication and database storage such as: xano, supabase, Firebase, and others.

---

<div class="post-metadata">

**Author:** ![Joyce](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/joyce/32/13232_2.png) [@Joyce](https://community.weweb.io/u/Joyce)\
**Post date:** [June 26, 2023, 2:14pm UTC](https://community.weweb.io/t/filter-data-collection-on-auth-user-via-google-sheets-data-source/3205/3 "2023-06-26T14:14:48Z")

</div>

Hi @Loick 👋

Welcome on board! 😀

> [@Loick](#):
>
> How can I provide only data related to my client\_id when they authenticate in weweb ? Data are sensitive and I don’t want other client to download data of other client (even if it’s not directly visible)

As Jared alluded too, if you want security, you’ll need a proper backend.

Even if you add authentication (using the WeWeb auth plugin for example), filtering your GSheet data based on a client\_id will not provide security because all it will take is for an authenticated user to find the API call that gets his/her own data and change the call to fetch another client\_id.

The only way to have true security is to use a backend like Xano or Supabase that allows you to protect the API endpoints (the Xano approach) or enable Row Level Security (the Supabase approach).

The level 2 course of the WeWeb Academy will cover this topic at length. It will be out in a few weeks but, in the meantime, here’s a [video on the topic of security](https://youtube.com/live/K6jfelTWo8Y) that you might find helpful.

Don’t hesitate to reach out if anything is unclear! Security can be an intimidating topic but it’s actually fairly straightforward once you get a few basics right 🙂

---

<div class="post-metadata">

**Author:** ![Loick](https://avatars.discourse-cdn.com/v4/letter/l/74df32/32.png) [@Loick](https://community.weweb.io/u/Loick)\
**Post date:** [June 26, 2023, 2:49pm UTC](https://community.weweb.io/t/filter-data-collection-on-auth-user-via-google-sheets-data-source/3205/4 "2023-06-26T14:49:00Z")

</div>

Thanks for you answers !  
I’m a bit stuck because I’m using data from our company platform which are compiled in big query (to access data as a non-dev)

- If I’m using in the ‘data sources’, integration via SQL, can this potentially solve my problem ?
- If not, can I send my data via big query (or gsheet - dirty way) to Xano in order to use it as a backend ?

---

<div class="post-metadata">

**Author:** ![Joyce](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/joyce/32/13232_2.png) [@Joyce](https://community.weweb.io/u/Joyce)\
**Post date:** [June 26, 2023, 5:13pm UTC](https://community.weweb.io/t/filter-data-collection-on-auth-user-via-google-sheets-data-source/3205/5 "2023-06-26T17:13:07Z")

</div>

Got it!

If Xano is an option, then you could ask Xano to call your sheet or big query ([you can make REST API calls to big query](https://cloud.google.com/bigquery/docs/reference/rest)).

That would be the easiest way I can think of to secure the data 🙂

Calling big query directly from a front-end is not ideal but might be ok if you’re building an internal tool.
