Configure access control

Enable Access Manager on a keyset to restrict which clients can read from or write to your PubNub channels and user metadata. Without it, any client with your keys has unrestricted access.

Before you start

Confirm you have:

• An Account Owner, Account Admin, or Key Admin role in the organization.
• The keyset you want to configure. Find it in Admin Portal under your app.

Enable Access Manager

1. Log in to Admin Portal.
2. Select your app.
3. Select the keyset you want to configure.
4. Scroll to the ACCESS MANAGER section.
5. Toggle Access Manager on.
6. Select Save changes.

Access Manager is now active for this keyset. Any client using this keyset must present a valid token with the required permissions on each request.

Existing clients

Enabling Access Manager on a keyset that is already in production will reject requests from clients that do not present a valid token. Update your server and clients to use Access Manager before enabling it on a production keyset.

Enable token revocation

Token revocation lets you invalidate a token before it expires. Token revocation is disabled by default.

1. On the same keyset settings page, scroll to the ACCESS MANAGER section.
2. Select the Revoke v3 Token checkbox.
3. Select Save changes.

Constraints that apply once token revocation is enabled:

• Token revocation is available only when the keyset's token TTL is 43,200 minutes (30 days) or less.
• Once PubNub support raises a keyset's token TTL past the revocation ceiling, you can disable token revocation but can't re-enable it from the Admin Portal. Contact support to re-enable it.

Related pages

• Access Manager. How the authorization flow works.
• Initialize a server SDK with a secret key. Set up the server-side PubNub instance after enabling Access Manager.
• Grant, change, and revoke permissions. Issue and manage tokens from your server.