---
source_url: https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/permissions
title: Permissions
updated_at: 2026-06-17T11:36:38.076Z
---

> Documentation Index
> For a curated overview of PubNub documentation, see: https://www.pubnub.com/docs/llms.txt
> For the full list of all documentation pages, see: https://www.pubnub.com/docs/llms-full.txt


# Permissions

Control who can access channels and user metadata in your chat app. Define permission schemas to protect against [unauthorized access](https://www.pubnub.com/docs/chat/chat-sdk/learn/access-control).

**Examples:**

* Restrict channel/profile modifications to specific users
* Allow only admins to remove users from channels

**Chat SDK limitations** (client-side only):

* Channel membership restrictions (direct, group, public)
* Feature availability errors in public chats (typing indicator, invites, read receipts)

Use [Access Manager](https://www.pubnub.com/docs/general/security/access-control) for strict server-enforced access rules. Chat SDK exposes all [JavaScript SDK](https://www.pubnub.com/docs/sdks/javascript/api-reference/access-manager) methods including Access Manager.

## Required configuration

1. Enable Access Manager in the [Admin Portal](https://admin.pubnub.com/).
2. [Initialize Chat SDK](https://www.pubnub.com/docs/chat/chat-sdk/build/configuration#initialize-pubnub): Server: with secretKey to administer permissions, Client: with authKey to authenticate users

See [Moderation](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/moderation#server-side-restrictions) for examples.

:::warning Secret key security
Never expose `secretKey` to clients. If compromised, generate a new one in the Admin Portal.
:::

## Use Access Manager

Available methods:

* [chat.sdk.grantToken()](https://www.pubnub.com/docs/sdks/javascript/api-reference/access-manager#grant-token) - Generate time-limited token with access control list
* [chat.sdk.revokeToken()](https://www.pubnub.com/docs/sdks/javascript/api-reference/access-manager#revoke-token) - Disable token and revoke permissions
* [chat.sdk.parseToken()](https://www.pubnub.com/docs/sdks/javascript/api-reference/access-manager#parse-token) - Decode token to view permissions
* [chat.sdk.setToken()](https://www.pubnub.com/docs/sdks/javascript/api-reference/access-manager#set-token) - Update authentication token

:::note Channel group limitation
Chat SDK doesn't support channel groups. Use a [core SDK](https://www.pubnub.com/docs/sdks) for [channel groups](https://www.pubnub.com/docs/general/channels/subscribe#channel-groups).
:::

### Resource permissions

Define operations users can perform on PubNub resources:

| Resource type | Permissions |
| --- | --- |
| `channels` | `read`, `write`, `get`, `manage`, `update`, `join`, `delete` |
| `uuids` | `get`, `update`, `delete` |

See [Moderation](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/moderation#secure-moderation) for muting/banning with Access Manager.

#### Example

Grant `support-agent` the `read` type of access to a group channel called `priority-tickets` and `write` type of access to all public channels. Granted access must expire after 15 minutes.

```ts
try {
    const token = await chat.sdk.grantToken({
        ttl: 15,
        authorized_uuid: "support-agent",
        resources: {
            channels: {
                "priority-tickets": {
                    read: true
                },
            },
        },
        patterns: {
            channels: {
                // wildcard pattern that refers to all channels whose IDs start with the "public" prefix
                "public.*": {
                    write: true
                }
            }
        }
    });
} catch (status) {
    console.log(status);
}
```

### Operations-to-permissions mapping

Access levels determine user operations. Example: `write` on `channels` allows sending messages via `sendText()`.

The tables below map permissions to Chat SDK operations.

#### Pub/Sub

| PubNub operation | Resource type(s) | Permission | Chat SDK method(s) |
| --- | --- | --- | --- |
| Publish on channels | `channels` | `write` | Send text messages ([sendText()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/send-receive)) Send messages with referenced channels and user mentions ([send()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/references#send-message-with-channel-references)) Forward messages ([forward(), forwardMessage()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/forward)) Create and send events ([emitEvent()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/custom-events#create-and-send-events)) Report messages ([report()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/moderation#flagreport-messages)) |
| Send signals to channels | `channels` | `write` | [Typing indicator methods](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/typing-indicator) Create and send events ([emitEvent()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/custom-events#create-and-send-events)) |
| Subscribe to channels | `channels` | `read` | [Typing indicator methods](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/typing-indicator) Receive events ([channel.onCustomEvent()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/custom-events#receive-current-events)) Receive messages ([onMessageReceived()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/watch)) Membership updates ([onUpdated(), onDeleted()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/membership#get-updates)) Channel updates ([onUpdated(), onDeleted()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/updates#get-channel-updates)) Messages updates ([onUpdated()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/updates#get-message-updates)) User updates ([onUpdated(), onDeleted()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/updates#get-user-updates)) |
| Subscribe to presence channels | Presence channels ([<channel-name>-pnpres](https://www.pubnub.com/docs/general/presence/presence-events)) | `read` | n/a |
| Unsubscribe from channels | `channels` | None required | Stop receiving typing signals, events, messages, updates on membership, channels, messages, and users |

#### Presence

| PubNub operation | Resource type(s) | Permission | Chat SDK method(s) |
| --- | --- | --- | --- |
| Here Now | `channels` | `read` | Channel presence ([whoIsPresent()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/presence#return-all-users-present-on-channel)) |
| Where Now | `channels` | None required | Channel presence ([wherePresent()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/presence#return-channels-where-user-is-present), [isPresentOn(), isPresent()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/presence#check-users-channel-presence)) |

#### Message Persistence

| PubNub operation | Resource type(s) | Permission | Chat SDK method(s) |
| --- | --- | --- | --- |
| Fetch historical messages | `channels` | `read` | [getHistory()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/history) |
| Message counts | `channels` | `read` | Unread messages ([getUnreadMessagesCount()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/unread#get-unread-messages-count-one-channel), [fetchUnreadMessagesCounts()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/unread#get-unread-messages-count-all-channels)) |
| Delete messages | `channels` | `delete` | [delete()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/delete) |

#### File sharing

| PubNub operation | Resource type(s) | Permission | Chat SDK method(s) |
| --- | --- | --- | --- |
| Send files on channels | `channels` | `write` | [sendText()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/files#send-files) |
| List files | `channels` | `read` | [getFiles()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/files#get-all-channel-files) |
| Delete files | `channels` | `delete` | [deleteFile()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/files#delete-files) |

#### App Context

| PubNub operation | Resource type(s) | Permission | Chat SDK method(s) |
| --- | --- | --- | --- |
| Set user metadata | `uuids` | `update` | Create users ([createUser()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/create)) Update user metadata ([update(), updateUser()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/updates#update-user-details)) |
| Delete user metadata | `uuids` | `delete` | [deleteUser(), delete()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/delete) |
| Get user metadata | `uuids` | `get` | Get user data ([getUser()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/details)) Track mentions ([onChange()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/mentions#track-mentions)) |
| Get all user metadata | `uuids` | You don't need to specify permissions to enable it if you uncheck the `Disallow Get All User Metadata` option in the [App Context configuration](https://www.pubnub.com/docs/general/metadata/basics#configuration) in the Admin Portal. | [chat.getUsers()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/list) |
| Set channel metadata | `channels` When working with threads, also grant permissions to [PUBNUB_INTERNAL_THREAD](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/threads) channels. | `update`, `get` | Create channels ([createDirectConversation()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/create#create-direct-channel), [createGroupConversation()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/create#create-group-channel), [createPublicConversation()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/create#create-public-channel)) Update channels ([update(), updateChannel()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/updates#update-channel-details)) Pin messages ([pin(), pinMessage()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/pinned)) Threads ([createThread()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/threads#create-thread), [pinMessage()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/threads#pin-thread-message-to-thread-channel), [pinMessageToParentChannel(), pinToParentChannel()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/threads#pin-thread-message-to-parent-channel), [unpinMessage()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/threads#unpin-thread-message-from-thread-channel), [unpinMessageFromParentChannel(), unpinFromParentChannel()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/threads#unpin-thread-message-from-parent-channel)) |
| Delete channel metadata | `channels` | `delete` | [delete(), deleteChannel()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/delete) |
| Get channel metadata | `channels` | `get` | Get channel details ([getChannel()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/details)) Get pinned messages ([getPinnedMessage()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/pinned#get)) Get thread ([getThread()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/threads#get-thread)) |
| Get all channel metadata | `channels` | You don't need to specify permissions to enable it if you uncheck the `Disallow Get All Channel Metadata` option in the [App Context configuration](https://www.pubnub.com/docs/general/metadata/basics#configuration) in the Admin Portal. | [chat.getChannels()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/list) |
| Set channel members | `channels` | `manage` | Invite multiple users to channels ([inviteMultiple()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/invite#invite-multiple-users)) Mute/Ban users ([setRestrictions()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/moderation#mute-or-ban-users)) |
| Remove channel members | `channels` | `manage` | Unmute/Unban users ([setRestrictions()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/moderation#mute-or-ban-users)) |
| Get channel members | `channels` | `get` | Get members ([getMembers()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/membership#get-members)) Check restrictions ([getUserRestrictions(), getUsersRestrictions(), getChannelsRestrictions(), getChannelRestrictions()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/users/moderation#check-restrictions)) |
| Set channel memberships | `channels`, `uuids` | `join` on `channels` `update` on `uuids` | Create channels ([createDirectConversation()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/create#create-direct-channel), [createGroupConversation()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/create#create-group-channel)) Invite a user to a channel ([invite()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/invite)) Join channels ([join()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/join)) Update membership ([update()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/membership#update)) Unread messages ([setLastReadMessage()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/unread#mark-messages-as-read-one-channel), [markAllMessagesAsRead()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/unread#mark-messages-as-read-all-channels)) |
| Remove channel memberships | `channels`, `uuids` | `join` on `channels` `update` on `uuids` | Leave channels ([leave()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/leave)) |
| Get channel memberships | `uuids` | `get` | List channels ([getChannels()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/list)), [getMemberships()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/channels/membership#get-membership) |

#### Mobile Push Notifications

| PubNub operation | Resource type(s) | Permission | Chat SDK method(s) |
| --- | --- | --- | --- |
| Register channel for push | `channels` | `read` | [registerForPush(), registerPushChannels()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/push-notifications#register-selected-push-channels) |
| Remove channel's push registration | `channels` | `read` | [unregisterFromPush(), unregisterPushChannels()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/push-notifications#unregister-selected-push-channels) |

#### Message Reactions

| PubNub operation | Resource type(s) | Permission | Chat SDK method(s) |
| --- | --- | --- | --- |
| Add message reaction | `channels` | `write` | [toggleReaction()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/reactions#add--delete) |
| Remove message reaction | `channels` | `delete` | [toggleReaction()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/reactions#add--delete) |
| Get history with reactions | `channels` | `read` | [getHistory()](https://www.pubnub.com/docs/chat/chat-sdk/build/features/messages/history) |