Documentation Release Notes - July 2026

July brought a new Core Concepts page, expanded HTTP/2 documentation to six more SDKs, and added a new manage_functions tool to the MCP Server.

We published a new Core Concepts page — a single-page reference for the seven platform primitives every PubNub application is built on: Message, Channel, User ID, Channel Group, Timetoken, Token, and Membership. We also documented HTTP/2 configuration for the Dart, Java, JavaScript, Kotlin, PHP, and Ruby SDKs, continuing the work from June.

On the AI side, we documented the new manage_functions MCP Server tool, which lets AI assistants manage PubNub Functions v2 resources — packages, revisions, deployments, KV store, secrets, and catalog blueprints — using natural language. The MCP Server now exposes 17 tools across six categories.

We also added a Reuse the client instance best practice section to the Connection Management page and all 13 SDK configuration pages, and added security warnings across all SDK logging pages about sensitive data exposure at DEBUG and TRACE levels.

On the platform side, we documented the new Account Viewer Admin Portal role, clarified Events & Actions Events Ingested billing, and added Publish Timetoken as a fifth default pre-mapped field in Illuminate Business Objects.

General 🛠️

Core concepts

Type: New feature

We published a new Core Concepts page — a single-page reference for the seven primitives every PubNub application is built on.

Primitive	What it is
Message	The unit of data published to a channel and delivered to subscribers
Channel	The named pathway messages flow through
User ID	The unique identity of a connected client
Channel Group	A server-managed list of channels subscribed to as one unit
Timetoken	The server-assigned timestamp that orders every event
Token	The cryptographic credential that controls access to resources
Membership	The persistent record of which user belongs to which channel

Each section explains the primitive's role across the platform — how it appears in SDK methods, REST endpoints, billing, Access Manager, and other features.

Events & Actions billing

Type: Update

We added a note to the Events & Actions overview clarifying how Events Ingested billing is calculated.

Billable Events Ingested are calculated by multiplying the total number of publishes (excluding PubNub Debug messages) by the number of configured event listeners, because each listener evaluates every message independently. Charges apply per million events processed, regardless of whether those events trigger any downstream action.

For example: 1,000,000 published messages with 3 configured listeners = 3,000,000 billable events.

Account Viewer role

Type: Enhancement

We added the Account Viewer role to the Admin Portal roles documentation.

Role	Capabilities
Account Viewer	View all apps and keysets in the account (secret keys excluded); observe account-wide usage. Cannot modify apps, keysets, or any account settings.

Account Viewer cannot be combined with Account Admin, App Admin, App Viewer, Keyset Admin, or Keyset Viewer.

SDKs 📦

HTTP/2 SDK configuration

Type: Enhancement

We documented HTTP/2 support and configuration for six more SDKs — Dart, Java, JavaScript (Node.js), Kotlin, PHP, and Ruby — continuing the work started in May and extended in June.

SDK	HTTP/2 behavior	Since
Dart	NetworkingModule negotiates HTTP/2 via TLS ALPN on native (dart:io) platforms. Controlled by enableHttp2 (default: true). No effect on the web platform.	8.0.0
Java	OkHttp negotiates HTTP/2 automatically over TLS/ALPN; falls back to HTTP/1.1. Not supported over cleartext.	—
JavaScript	undici (Node.js transport) auto-enables HTTP/2 on keep-alive connections. Node.js only — browsers and React Native are unaffected.	12.0.0
Kotlin	OkHttp negotiates HTTP/2 automatically over TLS/ALPN; falls back to HTTP/1.1. Not supported over cleartext.	—
PHP	Requests HTTP/2 on every call and falls back transparently. Requires an HTTPS connection (ssl: true, which is the default).	8.0.0
Ruby	Negotiates HTTP/2 automatically over TLS/ALPN; falls back to HTTP/1.1.	6.1.0

HTTP/2 requires a compatible origin

The default PubNub origin (ps.pndsn.com) serves HTTP/1.1 only. For the Java, Kotlin, and JavaScript SDKs, you must set origin to an HTTP/2-capable endpoint provisioned for your keyset to actually negotiate HTTP/2. PHP, Ruby, and Dart negotiate HTTP/2 against any origin that advertises h2 via ALPN. For a list of HTTP/2-capable origins, see Data Transport.

Client instance reuse

Type: Enhancement

We added a Reuse the client instance section to the Connection Management page and a linking note to all 13 SDK configuration reference pages.

The section explains that the PubNub client should be created once and reused for the lifetime of the user or session. Creating a new client per request or operation:

• Wastes TCP and TLS connections — each new client bypasses the keep-alive connection pool and pays full connection setup on every call.
• Leaks background resources — subscribe loops, thread pools, reconnection timers, and heartbeat timers accumulate if clients are not explicitly torn down.
• Resets internal state — timetoken, publish sequence numbers, and telemetry reset on each new instance, breaking message ordering continuity.

If your application handles multiple user identities (for example, a server acting on behalf of many users), cache or pool one client per userId rather than constructing a new client per request.

Sensitive data exposure

Type: Enhancement

We added a security warning to the general Logging page and all SDK-specific logging pages. At DEBUG and TRACE levels, PubNub SDKs may log:

• API keys and User ID values
• Full message content
• Complete request URLs, including Access Manager signature and auth token query parameters
• The full token string returned by grantToken calls

Masking behavior varies by SDK. Some SDKs hide the configured secret key in the one-time initialization log, but none currently hide signatures or tokens that appear in per-request network logs. Use DEBUG and TRACE only in development environments. Do not enable these levels in production where sensitive data is present.

Python file upload memory usage

Type: Enhancement

We added a warning to the Python SDK and Asyncio SDK file upload documentation about memory usage.

send_file() reads the entire file into memory to encrypt and upload it, so memory usage scales with file size. The SDK does not cap upload size because your keyset's file size limit (5 MB by default, configurable) may be set differently. Enforce your keyset's configured limit in your own upload path before calling send_file().

maximumConnections clarification

Type: Update

We improved the description of the maximumConnections configuration parameter in the Java SDK and Kotlin SDK references.

maximumConnections caps the number of concurrent in-flight asynchronous requests per host (.async() calls only). It is a concurrency cap on async requests, not the size of the HTTP connection pool — that is controlled separately by connectionPoolMaxIdleConnections. If you fan out .sync() calls and see requests backing up under load, raise concurrency in your own thread pool or switch those calls to .async().

AI 🤖

manage_functions tool

Type: New feature

We documented the new manage_functions tool in Available MCP Tools. The tool lets AI assistants manage PubNub Functions v2 resources using natural language. The MCP Server now exposes 17 tools across six categories.

manage_functions operates on eight resource types:

Resource	Operations
package	Create, read, update, delete packages; list revisions
revision	Create and manage revisions; list functions; manage test inputs
deployment	Deploy to keysets; start, stop, rolling-update, delete deployments
kv-store	Get, set, delete, increment, decrement KV store entries (string, JSON, counter)
secret	Create, update, delete runtime secrets
scheduled-event	Manage scheduled function events
catalog	Browse package and function blueprints; import from blueprints
limit	Read per-package execution limits

Admin API access required

manage_functions requires a Service Integration API key with specific permission scopes: functions.package:read|write at the account level for packages, revisions, catalog, and limits; functions.package-deployment:read|write at the keyset level for deployments and scheduled events; keyset:read|write for KV store and secrets. Not available with email/password authentication.

PubNub Skills update

Type: Enhancement

We updated the PubNub Skills page with revised install commands and reorganized the 22 skills into four categories.

The updated Vercel Skills CLI install command installs all skills without prompts:

npx skills add pubnub/skills --all

The skills are now organized into four categories:

• Core Platform (foundational real-time capabilities)
• Platform Services (serverless compute, data storage, integrations)
• Operations (reliability, observability, platform management)
• Vertical (domain-specific guidance for common application types).

Illuminate 💡

Publish Timetoken field

Type: Enhancement

Publish Timetoken is now the fifth default pre-mapped field in new Illuminate Business Objects, alongside Channel, User ID, Message Type, and Message.

Publish Timetoken uses the top-level $.timetoken JSONPath and the Timestamp field type. Unlike the other pre-mapped fields, it does not require a subcategory selection. It is available automatically in new Business Objects — no manual field configuration is required.

This field enables time-based queries and derivations in the Query Builder, including TIME_DIFF calculations using PUBLISH_TIMETOKEN as the derivation start or end source.