---
source_url: https://www.pubnub.com/docs/security/access-control/initialize-server-sdk
title: Initialize a server SDK with a secret key
updated_at: 2026-09-30T07:20:08.000Z
---

# Initialize a server SDK with a secret key

> For AI agents: documentation index at https://www.pubnub.com/llms-full.txt

A server-side PubNub instance initialized with a `secretKey` is required to grant and revoke Access Manager tokens. Only a server holding the `secretKey` can request permission grants. Never initialize a client device with the `secretKey`.

## Before you start

Confirm you have:

* Access Manager enabled on your keyset. See [Configure access control](https://www.pubnub.com/docs/security/access-control/configure-access-control.md).
* Your keyset's publish key, subscribe key, and secret key from [Admin Portal](https://admin.pubnub.com/).
* A server environment where the `secretKey` is never exposed to end users.

:::warning Secret key security
Use the `secretKey` only on a secure server. Never expose it to client devices. If it is compromised, regenerate it in the [Admin Portal](https://admin.pubnub.com/).
:::

## Initialize the server SDK

### JavaScript

```javascript
const pubnub = new PubNub({
    subscribeKey: "mySubscribeKey",
    publishKey: "myPublishKey",
    secretKey: "mySecretKey",
    userId: "myUniqueUserId"
});
```

### Python

```python
pn_config = PNConfiguration()
pn_config.subscribe_key = "my_subscribe_key"
pn_config.publish_key = "my_publish_key"
pn_config.secret_key = "my_secret_key"
pn_config.user_id = "my_unique_user_id"
pubnub = PubNub(pn_config)
```

### Java

```java
PNConfiguration.Builder configBuilder = PNConfiguration.builder(new UserId("yourUserId"), "yourSubscribeKey");
// publishKey from Admin Portal (only required if publishing)
configBuilder.publishKey("PublishKey");
configBuilder.secretKey("mySecretKey");
PubNub pubNub = PubNub.create(configBuilder.build());
```

### Kotlin

```kotlin
val pnConfiguration = PNConfiguration(UserId("myUserId")).apply {
    subscribeKey = "my_subkey"
    publishKey = "my_pubkey"
    secretKey = "my_secretkey"
    secure = true
}
```

### Go

```go
pnconfig := pubnub.NewConfig()
pnconfig.SubscribeKey = "MySubscribeKey"
pnconfig.PublishKey = "MyPublishKey"
pnconfig.SecretKey = "MySecretKey"
pnconfig.SetUserId(UserId("myUniqueUserId"))
pn := pubnub.NewPubNub(pnconfig)
```

### C#

```csharp
PNConfiguration pnconfig = new PNConfiguration();
pnconfig.SubscribeKey = "mySubscribeKey";
pnconfig.PublishKey = "myPublishKey";
pnconfig.SecretKey = "mySecretKey";
pnconfig.UserId = "MyUniqueUserId";
Pubnub pubnub = new Pubnub(pnconfig);
```

### Dart

```dart
final myKeyset = Keyset(
  subscribeKey: 'mySubscribeKey',
  publishKey: 'myPublishKey',
  secretKey: 'mySecretKey',
  userId: UserId('yourUniqueUserId')
);
```

### PHP

```php
use PubNub\PNConfiguration;
$pnConfiguration = new PNConfiguration();
$pnConfiguration->setSubscribeKey("MySubscribeKey");
$pnConfiguration->setPublishKey("MyPublishKey");
$pnConfiguration->setSecretKey("MySecretKey");
$pnConfiguration->setUserId("MyUniqueUserId");
```

### Ruby

```ruby
pubnub = Pubnub.new(
    subscribe_key: 'my_subscribe_key',
    publish_key: 'my_publish_key',
    secret_key: 'my_secret_key',
    user_id: 'myUniqueUserId'
);
```

When initialized with a `secretKey`, the server instance has root permissions for Access Manager. It can read and write to all resources on the keyset without a token grant.

## Secret key rotation

Paid plans support secret key rotation. The Admin Portal manages up to five secret keys, including the current key. Rotation records are written to the [Audit Log](https://www.pubnub.com/docs/security/audit-log.md).

Rotation lets you replace a compromised or aging key without reusing it. You can stage replacement keys with future expiry dates, so your servers can switch to the new key before the old one expires.

To rotate the secret key of a keyset:

1. In the [Admin Portal](https://admin.pubnub.com/), open **Apps & Keysets** and select the keyset.
2. Under the current secret key, review the active and expired keys.
3. Select **Rotate** and use the date picker to choose when the current key expires.
4. Update your servers to initialize the SDK with the new secret key before the expiry time.

## Related pages

* [Grant, change, and revoke permissions](https://www.pubnub.com/docs/security/access-control/manage-permissions.md). Issue tokens from the initialized server SDK.
* [Configure access control](https://www.pubnub.com/docs/security/access-control/configure-access-control.md). Enable Access Manager on a keyset.

Last updated at: 2026-09-30T07:20:08.000Z