---
source_url: https://www.pubnub.com/docs/security/access-control/check-permissions
title: Check available permissions
updated_at: 2026-10-13T08:57:28.000Z
---

# Check available permissions

> For AI agents: documentation index at https://www.pubnub.com/llms-full.txt

Parse a token to inspect the permissions it carries. This works on any client or server without a `secretKey`.

Use `parseToken` to:

* Diagnose a `403` error by confirming which resources and permission flags the token includes.
* Verify that a newly granted token contains the expected permissions before sending it to a client.

## Before you start

Confirm you have:

* A token issued by your server via `grantToken`. See [Grant, change, and revoke permissions](https://www.pubnub.com/docs/security/access-control/manage-permissions.md).

## Parse the token

### JavaScript

```javascript
pubnub.parseToken("yourToken")
```

### Python

```python
pubnub.parse_token("your_token")
```

### Java

```java
pubnub.parseToken("yourToken")
```

### Kotlin

```kotlin
pubnub.parseToken("yourToken")
```

### Swift

```swift
pubnub.parse(token: "yourToken")
```

### Objective-C

```objectivec
PNPAMToken *token = [self.client parseAuthToken:@"yourToken"];
NSLog(@"Token permissions: %@", token);
```

### Go

```go
pubnub.ParseToken("YourToken") // Given the "pubnub" package is imported: import (pubnub "github.com/pubnub/go/v5")
```

### C-Core (legacy)

:::note New SDK available
C-Core (legacy) is still supported. If you are starting a new project, use the new [C SDK](https://www.pubnub.com/docs/sdks/c.md).
:::

```c
char* cbor_data = pubnub_parse_token(<pubnub_context>, "yourToken");
```

### Unity

```csharp
pubnub.ParseToken("yourToken")
```

### C#

```csharp
pubnub.ParseToken("yourToken")
```

### Dart

```dart
pubnub.parseToken("yourToken")
```

### PHP

```php
$pubnub->parseToken("yourToken");
```

### Ruby

```ruby
pubnub.parse_token("yourToken")
```

## Sample response

```json
{
   "version": 2,
   "timestamp": 1629394579,
   "ttl": 15,
   "authorized_uuid": "user1",
   "resources": {
      "uuids": {
         "user1": {
            "read": false, "write": false, "manage": false, "delete": false,
            "get": true, "update": true, "join": false
         }
      },
      "channels": {
         "channel1": {
            "read": true, "write": true, "manage": false, "delete": false,
            "get": false, "update": false, "join": false
         }
      },
      "groups": {
         "group1": {
            "read": true, "write": false, "manage": false, "delete": false,
            "get": false, "update": false, "join": false
         }
      }
   },
   "patterns": {
      "uuids": {
         ".*": {
            "read": false, "write": false, "manage": false, "delete": false,
            "get": true, "update": false, "join": false
         }
      },
      "channels": {
         ".*": {
            "read": true, "write": true, "manage": false, "delete": false,
            "get": false, "update": false, "join": false
         }
      },
      "groups": {
         ".*": {
            "read": true, "write": false, "manage": false, "delete": false,
            "get": false, "update": false, "join": false
         }
      }
   }
}
```

The response contains:

* `version`: token format version.
* `timestamp`: time the token was issued, in Unix seconds.
* `ttl`: token lifetime in minutes, counted from `timestamp`. The token expires at `(timestamp + ttl * 60) * 1000` in Unix milliseconds. To schedule a refresh from these fields, see [Change or extend access](https://www.pubnub.com/docs/security/access-control/change-or-extend-access.md#strategy-2-client-side-ttl-timer).
* `authorized_uuid`: the authorized user ID bound to this token, if set.
* `resources`: exact-name permissions granted per channel, channel group, and UUID.
* `patterns`: RE2 pattern-based permissions.

Each resource entry shows all permission flags as `true` or `false`. A flag set to `false` means the operation it gates is not permitted.

:::tip Debug Console
To parse a token without writing code, use the **Access Manager** tab of the Debug Console in the [Admin Portal](https://admin.pubnub.com/).
:::

## Related pages

* [Permission model](https://www.pubnub.com/docs/security/access-control/permission-model.md). What each permission flag permits.
* [Grant, change, and revoke permissions](https://www.pubnub.com/docs/security/access-control/manage-permissions.md). Issue tokens from your server.
* [Update an expired token](https://www.pubnub.com/docs/security/access-control/update-expired-token.md). Handle a token that has already expired.

Last updated at: 2026-10-13T08:57:28.000Z