--- source_url: https://www.pubnub.com/docs/sdks/objective-c/api-reference/access-manager title: Access Manager v3 API for Objective-C SDK updated_at: 2026-06-12T11:25:52.083Z sdk_name: PubNub Objective-C SDK sdk_version: 7.0.2 --- > Documentation Index > For a curated overview of PubNub documentation, see: https://www.pubnub.com/docs/llms.txt > For the full list of all documentation pages, see: https://www.pubnub.com/docs/llms-full.txt # Access Manager v3 API for Objective-C SDK PubNub Objective-C SDK, use the latest version: 7.0.2 Install: ```bash pod install PubNub@7.0.2 ``` :::warning Access Manager isn't enabled by default Without it, PubNub resources on this keyset have no access controls and clients can reach channels and metadata without permission checks. Enable Access Manager in [Admin Portal](https://admin.pubnub.com/) before deploying to production. ::: Access Manager allows you to enforce security controls for client access to resources within the PubNub Platform. With Access Manager v3, your servers can grant their clients tokens with embedded permissions that provide access to individual PubNub resources, such as channels, channel groups, and UUID metadata: * For a limited period of time. * Through resource lists or patterns (regular expressions). * In a single API request, even if permission levels differ (`read` to `channel1` and `write` to `channel2`). You can add the [authorized UUID](https://www.pubnub.com/docs/general/security/access-control#authorized-uuid) parameter to the grant request to restrict the token usage to only one client with a given `uuid`. Once specified, only this authorized UUID will be able to use the token to make API requests for the specified resources, according to permissions given in the grant request. For more information about Access Manager v3, refer to [Manage Permissions with Access Manager v3](https://www.pubnub.com/docs/general/security/access-control). :::note Client device support only The Objective-C SDK supports only client implementation of Access Manager functionality. This means that you cannot use it to grant permissions, but rather to parse and set tokens received from a server SDK. ::: ## Parse token The `parseAuthToken:` method decodes an existing token and returns the object containing permissions embedded in that token. The client can use this method for debugging to check the permissions to the resources or find out the token's `ttl` (time to live) details. ### Method(s) ```objectivec - (PNPAMToken *)parseAuthToken:(NSString *)token ``` | Parameter | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | token | String | Yes | | Current token with embedded permissions. | ### Sample code ```objectivec #import #import // 1. Initialize the PubNub client PNConfiguration *configuration = [PNConfiguration configurationWithPublishKey:@"demo" subscribeKey:@"demo" userID:@"testUser"]; PubNub *client = [PubNub clientWithConfiguration:configuration]; // 2. The token to parse (this is a sample token, make sure to use your own) NSString *tokenString = @"p0F2AkF0Gmf_WKNDdHRsAUNyZXOlRGNoYW6hZnB1YmxpYxjvQ2dycKBDc3BjoEN1c3KgRHV1aWShcXBhbV9jY3BfY2hhdF91c2VyGGhDcGF0pURjaGFuoENncnCgQ3NwY6BDdXNyoER1dWlkoERtZXRhoENzaWdYIGT644KqTNFo-dk773m0OtXOaiRr-ngXe0wJ3c0A-v89"; NSLog(@"Parsing token: %@", tokenString); // 3. Parse the token PNPAMToken *token = [client parseAuthToken:tokenString]; // 4. Check if parsing was successful if (!token.error) { NSLog(@"Token parsed successfully!"); // 5. Access token properties NSLog(@"Token properties:"); NSLog(@"- Version: %@", @(token.version)); NSLog(@"- TTL: %@", @(token.ttl)); NSLog(@"- Timestamp: %@", @(token.timestamp)); NSLog(@"- Authorized UUID: %@", token.authorizedUUID ?: @"None"); // 6. Access explicit resources NSLog(@"\nExplicit Resources:"); NSLog(@"Authorized channels:"); if (token.resources.channels.count > 0) { [token.resources.channels enumerateKeysAndObjectsUsingBlock:^(NSString *channel, PNPAMResourcePermission *permission, BOOL *stop) { NSLog(@" - %@: %@", channel, permission); }]; } else { NSLog(@" None"); } NSLog(@"Authorized channel groups:"); if (token.resources.groups.count > 0) { [token.resources.groups enumerateKeysAndObjectsUsingBlock:^(NSString *group, PNPAMResourcePermission *permission, BOOL *stop) { NSLog(@" - %@: %@", group, permission); }]; } else { NSLog(@" None"); } NSLog(@"Authorized UUIDs:"); if (token.resources.uuids.count > 0) { [token.resources.uuids enumerateKeysAndObjectsUsingBlock:^(NSString *uuid, PNPAMResourcePermission *permission, BOOL *stop) { NSLog(@" - %@: %@", uuid, permission); }]; } else { NSLog(@" None"); } // 7. Access pattern-based permissions NSLog(@"\nPattern-based Permissions:"); NSLog(@"Channel patterns:"); if (token.patterns.channels.count > 0) { [token.patterns.channels enumerateKeysAndObjectsUsingBlock:^(NSString *pattern, PNPAMResourcePermission *permission, BOOL *stop) { NSLog(@" - Pattern '%@': %@", pattern, permission); }]; } else { NSLog(@" None"); } NSLog(@"Channel group patterns:"); if (token.patterns.groups.count > 0) { [token.patterns.groups enumerateKeysAndObjectsUsingBlock:^(NSString *pattern, PNPAMResourcePermission *permission, BOOL *stop) { NSLog(@" - Pattern '%@': %@", pattern, permission); }]; } else { NSLog(@" None"); } NSLog(@"UUID patterns:"); if (token.patterns.uuids.count > 0) { [token.patterns.uuids enumerateKeysAndObjectsUsingBlock:^(NSString *pattern, PNPAMResourcePermission *permission, BOOL *stop) { NSLog(@" - Pattern '%@': %@", pattern, permission); }]; } else { NSLog(@" None"); } // 8. Access metadata if present if (token.meta.count > 0) { NSLog(@"\nToken metadata:"); [token.meta enumerateKeysAndObjectsUsingBlock:^(NSString *key, id value, BOOL *stop) { NSLog(@" - %@: %@", key, value); }]; } } else { NSLog(@"Failed to parse token: %@", token.error); } ``` ### Returns This method will respond with a `PNPAMToken` instance: ```objectivec @interface PNPAMToken : NSObject // Token version @property (nonatomic, readonly, assign) NSUInteger version; // Token generation date and time @property (nonatomic, readonly, assign) NSUInteger timestamp; // Maximum amount of time (in minutes) during which the token will be valid @property (nonatomic, readonly, assign) NSUInteger ttl; // The uuid that is exclusively authorized to use this token to make API requests @property (nonatomic, nullable, readonly, strong) NSString *authorizedUUID; // Permissions granted to specific resources @property (nonatomic, readonly, strong) PNPAMTokenResource *resources; // Permissions granted to resources which match a specified regular expression @property (nonatomic, readonly, strong) PNPAMTokenResource *patterns; // Additional information which has been added to the token @property (nonatomic, readonly, strong) NSDictionary *meta; // Access Manager token content signature @property (nonatomic, readonly, strong) NSData *signature; // Whether the provided Access Manager token string was valid and properly processed @property (nonatomic, readonly, assign) BOOL valid; // Contains an error with information on what went wrong, in cases when the token is not valid @property (nonatomic, nullable, readonly, strong) NSError *error; @end @interface PNPAMTokenResource : NSObject // Permissions granted to specific / regexp matching channels @property (nonatomic, readonly, strong) NSDictionary *channels; // Permissions granted to specific / regexp matching channel groups @property (nonatomic, readonly, strong) NSDictionary *groups; // Permissions granted to specific / regexp matching uuids @property (nonatomic, readonly, strong) NSDictionary *uuids; @end @interface PNPAMResourcePermission : NSObject // Bit field with a given permission value @property (nonatomic, readonly, assign) PNPAMPermission value; @end ``` ### Error Responses If you receive an error while parsing the token, it may suggest that the token is damaged. In that case, request the server to issue a new one. ## Set token The `setAuthToken:` method is used by the client devices to update the authentication token granted by the server. ### Method(s) ```objectivec - (void)setAuthToken:(NSString *)token; ``` | Parameter | Description | | --- | --- | | `token` *Type: `String`Default: n/a | Current token with embedded permissions. | ### Sample code ```objectivec [self.client setAuthToken:@"p0thisAkFl043rhDdHRsCkNyZXisRGNoYW6hanNlY3JldAFDZ3Jwsample3KgQ3NwY6BDcGF0pERjaGFuoENnctokenVzcqBDc3BjoERtZXRhoENzaWdYIGOAeTyWGJI"]; ``` ### Returns This method doesn't return any response value. ## Terms in this document * **Channel** - A pathway for sending and receiving messages between devices, created automatically when you first use it, that can handle any number of users and messages for different communication needs, like 1-1 text chats, group conversations, and other data streaming.