Check available permissions

Showing JavaScript examples.

Parse a token to inspect the permissions it carries. This works on any client or server without a secretKey.

Use parseToken to:

• Diagnose a 403 error by confirming which resources and permission flags the token includes.
• Verify that a newly granted token contains the expected permissions before sending it to a client.

Before you start

Confirm you have:

• A token issued by your server via grantToken. See Grant, change, and revoke permissions.

Parse the token

• JavaScript
• Python
• Java
• Kotlin
• Swift
• Objective-C
• Go
• C-Core (legacy)
• Unity
• C#
• Dart
• PHP
• Ruby

1pubnub.parseToken("yourToken")

Sample response

1{
2   "version": 2,
3   "timestamp": 1629394579,
4   "ttl": 15,
5   "authorized_uuid": "user1",
6   "resources": {
7      "uuids": {
8         "user1": {
9            "read": false, "write": false, "manage": false, "delete": false,
10            "get": true, "update": true, "join": false
11         }
12      },
13      "channels": {
14         "channel1": {
15            "read": true, "write": true, "manage": false, "delete": false,
16            "get": false, "update": false, "join": false
17         }
18      },
19      "groups": {
20         "group1": {
21            "read": true, "write": false, "manage": false, "delete": false,
22            "get": false, "update": false, "join": false
23         }
24      }
25   },
26   "patterns": {
27      "uuids": {
28         ".*": {
29            "read": false, "write": false, "manage": false, "delete": false,
30            "get": true, "update": false, "join": false
31         }
32      },
33      "channels": {
34         ".*": {
35            "read": true, "write": true, "manage": false, "delete": false,
36            "get": false, "update": false, "join": false
37         }
38      },
39      "groups": {
40         ".*": {
41            "read": true, "write": false, "manage": false, "delete": false,
42            "get": false, "update": false, "join": false
43         }
44      }
45   }
46}

show all 46 lines

The response contains:

• version: token format version.
• timestamp: time the token was issued, in Unix seconds.
• ttl: token lifetime in minutes, counted from timestamp. The token expires at (timestamp + ttl * 60) * 1000 in Unix milliseconds. To schedule a refresh from these fields, see Change or extend access.
• authorized_uuid: the User ID bound to this token, if set.
• resources: exact-name permissions granted per channel, channel group, and UUID.
• patterns: RE2 pattern-based permissions.

Each resource entry shows all permission flags as true or false. A flag set to false means the operation it gates is not permitted.

Debug Console

To parse a token without writing code, use the Access Manager tab of the Debug Console in the Admin Portal.

Related pages

• Permission model. What each permission flag permits.
• Grant, change, and revoke permissions. Issue tokens from your server.
• Update an expired token. Handle a token that has already expired.