Initialize a server SDK with a secret key
A server-side PubNub instance initialized with a secretKey is required to grant and revoke Access Manager tokens. Only a server holding the secretKey can request permission grants. Never initialize a client device with the secretKey.
Before you start
Confirm you have:
- Access Manager enabled on your keyset. See Configure access control.
- Your keyset's publish key, subscribe key, and secret key from Admin Portal.
- A server environment where the
secretKeyis never exposed to end users.
Secret key security
Use the secretKey only on a secure server. Never expose it to client devices. If it is compromised, regenerate it in the Admin Portal.
Initialize the server SDK
- JavaScript
- Python
- Java
- Kotlin
- Go
- C#
- Dart
- PHP
- Ruby
1const pubnub = new PubNub({
2 subscribeKey: "mySubscribeKey",
3 publishKey: "myPublishKey",
4 secretKey: "mySecretKey",
5 userId: "myUniqueUserId"
6});
1pn_config = PNConfiguration()
2pn_config.subscribe_key = "my_subscribe_key"
3pn_config.publish_key = "my_publish_key"
4pn_config.secret_key = "my_secret_key"
5pn_config.user_id = "my_unique_user_id"
6pubnub = PubNub(pn_config)
1PNConfiguration.Builder configBuilder = PNConfiguration.builder(new UserId("yourUserId"), "yourSubscribeKey");
2// publishKey from Admin Portal (only required if publishing)
3configBuilder.publishKey("PublishKey");
4configBuilder.secretKey("mySecretKey");
5PubNub pubNub = PubNub.create(configBuilder.build());
1val pnConfiguration = PNConfiguration(UserId("myUserId")).apply {
2 subscribeKey = "my_subkey"
3 publishKey = "my_pubkey"
4 secretKey = "my_secretkey"
5 secure = true
6}
1pnconfig := pubnub.NewConfig()
2pnconfig.SubscribeKey = "MySubscribeKey"
3pnconfig.PublishKey = "MyPublishKey"
4pnconfig.SecretKey = "MySecretKey"
5pnconfig.SetUserId(UserId("myUniqueUserId"))
6pn := pubnub.NewPubNub(pnconfig)
1PNConfiguration pnconfig = new PNConfiguration();
2pnconfig.SubscribeKey = "mySubscribeKey";
3pnconfig.PublishKey = "myPublishKey";
4pnconfig.SecretKey = "mySecretKey";
5pnconfig.UserId = "MyUniqueUserId";
6Pubnub pubnub = new Pubnub(pnconfig);
1final myKeyset = Keyset(
2 subscribeKey: 'mySubscribeKey',
3 publishKey: 'myPublishKey',
4 secretKey: 'mySecretKey',
5 userId: UserId('yourUniqueUserId')
6);
1use PubNub\PNConfiguration;
2$pnConfiguration = new PNConfiguration();
3$pnConfiguration->setSubscribeKey("MySubscribeKey");
4$pnConfiguration->setPublishKey("MyPublishKey");
5$pnConfiguration->setSecretKey("MySecretKey");
6$pnConfiguration->setUserId("MyUniqueUserId");
1pubnub = Pubnub.new(
2 subscribe_key: 'my_subscribe_key',
3 publish_key: 'my_publish_key',
4 secret_key: 'my_secret_key',
5 user_id: 'myUniqueUserId'
6);
When initialized with a secretKey, the server instance has root permissions for Access Manager. It can read and write to all resources on the keyset without a token grant.
Secret key rotation
Paid plans support secret key rotation. The Admin Portal manages up to five secret keys, including the current key. Rotation records are written to the Audit Log.
Rotation lets you replace a compromised or aging key without reusing it. You can stage replacement keys with future expiry dates, so your servers can switch to the new key before the old one expires.
To rotate the secret key of a keyset:
-
In the Admin Portal, open Apps & Keysets and select the keyset.
-
Under the current secret key, review the active and expired keys.
-
Select Rotate and use the date picker to choose when the current key expires.
-
Update your servers to initialize the SDK with the new secret key before the expiry time.
Related pages
- Grant, change, and revoke permissions. Issue tokens from the initialized server SDK.
- Configure access control. Enable Access Manager on a keyset.