---
source_url: https://www.pubnub.com/docs/security/access-control/configure-access-control
title: Configure access control
updated_at: 2026-09-30T07:20:08.000Z
---

# Configure access control

> For AI agents: documentation index at https://www.pubnub.com/llms-full.txt

Enable Access Manager on a keyset to restrict which clients can read from or write to your PubNub channels and user metadata. Without it, any client with your keys has unrestricted access.

## Before you start

Confirm you have:

* An **Account Owner**, **Account Admin**, or **Key Admin** role in the organization.
* The keyset you want to configure. Find it in [Admin Portal](https://admin.pubnub.com/) under your app.

## Enable Access Manager

1. Log in to [Admin Portal](https://admin.pubnub.com/).
2. Select your app.
3. Select the keyset you want to configure.
4. Scroll to the **ACCESS MANAGER** section.
5. Toggle Access Manager on.
6. Select **Save changes**.

Access Manager is now active for this keyset. Any client using this keyset must present a valid token with the required permissions on each request.

:::warning Existing clients
Enabling Access Manager on a keyset that is already in production will reject requests from clients that do not present a valid token. Update your server and clients to use Access Manager before enabling it on a production keyset.
:::

## Enable token revocation

Token revocation lets you invalidate a token before it expires. Token revocation is disabled by default.

1. On the same keyset settings page, scroll to the **ACCESS MANAGER** section.
2. Select the **Revoke v3 Token** checkbox.
3. Select **Save changes**.

Constraints that apply once token revocation is enabled:

* Token revocation is available only when the keyset's token TTL is 43,200 minutes (30 days) or less.
* Once PubNub support raises a keyset's token TTL past the revocation ceiling, you can disable token revocation but can't re-enable it from the Admin Portal. Contact [support](mailto:support@pubnub.com) to re-enable it.

## Related pages

* [Access Manager](https://www.pubnub.com/docs/security/access-control/overview.md). How the authorization flow works.
* [Initialize a server SDK with a secret key](https://www.pubnub.com/docs/security/access-control/initialize-server-sdk.md). Set up the server-side PubNub instance after enabling Access Manager.
* [Grant, change, and revoke permissions](https://www.pubnub.com/docs/security/access-control/manage-permissions.md). Issue and manage tokens from your server.

Last updated at: 2026-09-30T07:20:08.000Z