[{"data":1,"prerenderedAt":816},["ShallowReactive",2],{"docs:/docs/concepts/acl":3},{"id":4,"title":5,"body":6,"description":809,"extension":810,"meta":811,"navigation":261,"path":812,"seo":813,"stem":814,"__hash__":815},"docs/docs/concepts/acl.md","Access Control",{"type":7,"value":8,"toc":797},"minimark",[9,13,17,22,25,29,32,83,87,96,107,121,143,147,150,156,162,374,399,405,719,723,728,731,743,747,750,757,761,764,775,779,793],[10,11,5],"h1",{"id":12},"access-control",[14,15,16],"p",{},"Control who can publish and subscribe to topics with fine-grained access control lists (ACLs).",[18,19,21],"h2",{"id":20},"acl-basics","ACL Basics",[14,23,24],{},"Each topic can have separate permissions for publishing and subscribing. This allows you to create read-only channels, write-only endpoints, or fully open topics.",[18,26,28],{"id":27},"permission-levels","Permission Levels",[14,30,31],{},"Each actor's access to a topic is defined by one of these permission levels:",[33,34,35,48],"table",{},[36,37,38],"thead",{},[39,40,41,45],"tr",{},[42,43,44],"th",{},"Permission",[42,46,47],{},"Description",[49,50,51,63,73],"tbody",{},[39,52,53,60],{},[54,55,56],"td",{},[57,58,59],"code",{},"subscribe",[54,61,62],{},"Can only subscribe to the topic (read-only)",[39,64,65,70],{},[54,66,67],{},[57,68,69],{},"publish",[54,71,72],{},"Can only publish to the topic (write-only)",[39,74,75,80],{},[54,76,77],{},[57,78,79],{},"pubSub",[54,81,82],{},"Can both publish and subscribe (full access)",[18,84,86],{"id":85},"the-default-is-open","The Default Is Open",[14,88,89,90,95],{},"Access resolves in two layers, and both start permissive. This is why the\n",[91,92,94],"a",{"href":93},"/docs/getting-started","quickstart"," connects successfully without any\naccess-control step.",[14,97,98,102,103,106],{},[99,100,101],"strong",{},"App level."," A new app is created in ",[57,104,105],{},"open"," mode, which gives every actor in the\nproject publish and subscribe rights on all of that app's topics.",[14,108,109,112,113,116,117,120],{},[99,110,111],{},"Room level."," A room with no grants inherits the app-level permission. Creating the\nfirst grant on a room flips it to private: from then on the broker admits only\nactors holding an explicit, unexpired grant. A grant naming a specific\n",[57,114,115],{},"actorTokenId"," takes precedence over a broader ",[57,118,119],{},"actorType"," grant.",[122,123,125,128],"callout",{"type":124},"warning",[14,126,127],{},"Two consequences worth planning for:",[129,130,131,140],"ul",{},[132,133,134,135,139],"li",{},"Until you add grants, any actor token in the project can read and write every\ntopic in the app. The project is your outermost boundary, so keep unrelated\nworkloads in separate projects and see ",[91,136,138],{"href":137},"/docs/scopes","Access Scopes"," for\ntenant isolation within one.",[132,141,142],{},"Because the first grant is what closes a room, granting access to one actor\nremoves it from every other actor. Add grants for everything that needs the room,\nincluding your own backend services, in the same change.",[18,144,146],{"id":145},"configuring-acls","Configuring ACLs",[14,148,149],{},"There are two ways to manage grants.",[14,151,152,155],{},[99,153,154],{},"In the dashboard."," Open your app, select a room, and manage its actor grants there.",[14,157,158,161],{},[99,159,160],{},"Over the REST API."," Room grants are a first-class resource, so a setup script or\nan agent can provision access without opening the dashboard:",[163,164,170],"pre",{"className":165,"code":166,"filename":167,"language":168,"meta":169,"style":169},"language-bash shiki shiki-themes github-light github-dark","# Grant one actor pub/sub on two topics in a room\ncurl -X POST https://api.nolag.app/v1/apps/{appId}/rooms/{roomId}/actors \\\n  -H \"Authorization: Bearer nlg_live_xxx.secret\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n        \"actorTokenId\": \"01939f83-8b57-7c3e-a456-426614174000\",\n        \"permission\": \"pubSub\",\n        \"topics\": [\"messages\", \"typing\"]\n      }'\n\n# Or grant by actor type, covering every actor of that type\ncurl -X POST https://api.nolag.app/v1/apps/{appId}/rooms/{roomId}/actors \\\n  -H \"Authorization: Bearer nlg_live_xxx.secret\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"actorType\":\"agent\",\"permission\":\"subscribe\"}'\n\n# List the room's grants\ncurl https://api.nolag.app/v1/apps/{appId}/rooms/{roomId}/actors \\\n  -H \"Authorization: Bearer nlg_live_xxx.secret\"\n\n# Revoke a grant\ncurl -X DELETE \\\n  https://api.nolag.app/v1/apps/{appId}/rooms/{roomId}/actors/{roomActorAccessId} \\\n  -H \"Authorization: Bearer nlg_live_xxx.secret\"\n","Terminal","bash","",[57,171,172,181,202,213,223,232,238,244,250,256,263,269,282,291,300,308,313,319,328,336,341,347,359,367],{"__ignoreMap":169},[173,174,177],"span",{"class":175,"line":176},"line",1,[173,178,180],{"class":179},"sJ8bj","# Grant one actor pub/sub on two topics in a room\n",[173,182,184,188,192,196,199],{"class":175,"line":183},2,[173,185,187],{"class":186},"sScJk","curl",[173,189,191],{"class":190},"sj4cs"," -X",[173,193,195],{"class":194},"sZZnC"," POST",[173,197,198],{"class":194}," https://api.nolag.app/v1/apps/{appId}/rooms/{roomId}/actors",[173,200,201],{"class":190}," \\\n",[173,203,205,208,211],{"class":175,"line":204},3,[173,206,207],{"class":190},"  -H",[173,209,210],{"class":194}," \"Authorization: Bearer nlg_live_xxx.secret\"",[173,212,201],{"class":190},[173,214,216,218,221],{"class":175,"line":215},4,[173,217,207],{"class":190},[173,219,220],{"class":194}," \"Content-Type: application/json\"",[173,222,201],{"class":190},[173,224,226,229],{"class":175,"line":225},5,[173,227,228],{"class":190},"  -d",[173,230,231],{"class":194}," '{\n",[173,233,235],{"class":175,"line":234},6,[173,236,237],{"class":194},"        \"actorTokenId\": \"01939f83-8b57-7c3e-a456-426614174000\",\n",[173,239,241],{"class":175,"line":240},7,[173,242,243],{"class":194},"        \"permission\": \"pubSub\",\n",[173,245,247],{"class":175,"line":246},8,[173,248,249],{"class":194},"        \"topics\": [\"messages\", \"typing\"]\n",[173,251,253],{"class":175,"line":252},9,[173,254,255],{"class":194},"      }'\n",[173,257,259],{"class":175,"line":258},10,[173,260,262],{"emptyLinePlaceholder":261},true,"\n",[173,264,266],{"class":175,"line":265},11,[173,267,268],{"class":179},"# Or grant by actor type, covering every actor of that type\n",[173,270,272,274,276,278,280],{"class":175,"line":271},12,[173,273,187],{"class":186},[173,275,191],{"class":190},[173,277,195],{"class":194},[173,279,198],{"class":194},[173,281,201],{"class":190},[173,283,285,287,289],{"class":175,"line":284},13,[173,286,207],{"class":190},[173,288,210],{"class":194},[173,290,201],{"class":190},[173,292,294,296,298],{"class":175,"line":293},14,[173,295,207],{"class":190},[173,297,220],{"class":194},[173,299,201],{"class":190},[173,301,303,305],{"class":175,"line":302},15,[173,304,228],{"class":190},[173,306,307],{"class":194}," '{\"actorType\":\"agent\",\"permission\":\"subscribe\"}'\n",[173,309,311],{"class":175,"line":310},16,[173,312,262],{"emptyLinePlaceholder":261},[173,314,316],{"class":175,"line":315},17,[173,317,318],{"class":179},"# List the room's grants\n",[173,320,322,324,326],{"class":175,"line":321},18,[173,323,187],{"class":186},[173,325,198],{"class":194},[173,327,201],{"class":190},[173,329,331,333],{"class":175,"line":330},19,[173,332,207],{"class":190},[173,334,335],{"class":194}," \"Authorization: Bearer nlg_live_xxx.secret\"\n",[173,337,339],{"class":175,"line":338},20,[173,340,262],{"emptyLinePlaceholder":261},[173,342,344],{"class":175,"line":343},21,[173,345,346],{"class":179},"# Revoke a grant\n",[173,348,350,352,354,357],{"class":175,"line":349},22,[173,351,187],{"class":186},[173,353,191],{"class":190},[173,355,356],{"class":194}," DELETE",[173,358,201],{"class":190},[173,360,362,365],{"class":175,"line":361},23,[173,363,364],{"class":194},"  https://api.nolag.app/v1/apps/{appId}/rooms/{roomId}/actors/{roomActorAccessId}",[173,366,201],{"class":190},[173,368,370,372],{"class":175,"line":369},24,[173,371,207],{"class":190},[173,373,335],{"class":194},[14,375,376,377,379,380,382,383,386,387,390,391,394,395,398],{},"Supply either ",[57,378,115],{}," or ",[57,381,119],{},", plus a ",[57,384,385],{},"permission",". Optionally scope\nthe grant with ",[57,388,389],{},"topics",", time-limit it with ",[57,392,393],{},"expiresAt",", or disable it with\n",[57,396,397],{},"isActive: false",".",[14,400,401,404],{},[99,402,403],{},"Not through the client SDKs."," The JavaScript, Python, and Go SDKs are data-plane\nclients. They do not expose an ACL management API. Permission is enforced\nserver-side when you subscribe or publish:",[406,407,408,572,646],"code-tabs",{},[163,409,414],{"className":410,"code":411,"filename":412,"language":413,"meta":169,"style":169},"language-typescript shiki shiki-themes github-light github-dark","// Grants are managed in the dashboard or over the REST API, not from the SDK.\n// When connecting via the SDK, permission is enforced automatically:\nimport { NoLag } from '@nolag/js-sdk'\n\nconst client = NoLag('your_access_token')\nawait client.connect()\n\nconst room = client.setApp('my-app').setRoom('general')\n\n// This will only succeed if the actor has 'subscribe' or 'pubSub' permission\nroom.subscribe('announcements')\n\n// This will only succeed if the actor has 'publish' or 'pubSub' permission\nroom.emit('chat', { text: 'Hello!' })\n","TypeScript","typescript",[57,415,416,421,426,442,446,469,483,487,519,523,528,542,546,551],{"__ignoreMap":169},[173,417,418],{"class":175,"line":176},[173,419,420],{"class":179},"// Grants are managed in the dashboard or over the REST API, not from the SDK.\n",[173,422,423],{"class":175,"line":183},[173,424,425],{"class":179},"// When connecting via the SDK, permission is enforced automatically:\n",[173,427,428,432,436,439],{"class":175,"line":204},[173,429,431],{"class":430},"szBVR","import",[173,433,435],{"class":434},"sVt8B"," { NoLag } ",[173,437,438],{"class":430},"from",[173,440,441],{"class":194}," '@nolag/js-sdk'\n",[173,443,444],{"class":175,"line":215},[173,445,262],{"emptyLinePlaceholder":261},[173,447,448,451,454,457,460,463,466],{"class":175,"line":225},[173,449,450],{"class":430},"const",[173,452,453],{"class":190}," client",[173,455,456],{"class":430}," =",[173,458,459],{"class":186}," NoLag",[173,461,462],{"class":434},"(",[173,464,465],{"class":194},"'your_access_token'",[173,467,468],{"class":434},")\n",[173,470,471,474,477,480],{"class":175,"line":234},[173,472,473],{"class":430},"await",[173,475,476],{"class":434}," client.",[173,478,479],{"class":186},"connect",[173,481,482],{"class":434},"()\n",[173,484,485],{"class":175,"line":240},[173,486,262],{"emptyLinePlaceholder":261},[173,488,489,491,494,496,498,501,503,506,509,512,514,517],{"class":175,"line":246},[173,490,450],{"class":430},[173,492,493],{"class":190}," room",[173,495,456],{"class":430},[173,497,476],{"class":434},[173,499,500],{"class":186},"setApp",[173,502,462],{"class":434},[173,504,505],{"class":194},"'my-app'",[173,507,508],{"class":434},").",[173,510,511],{"class":186},"setRoom",[173,513,462],{"class":434},[173,515,516],{"class":194},"'general'",[173,518,468],{"class":434},[173,520,521],{"class":175,"line":252},[173,522,262],{"emptyLinePlaceholder":261},[173,524,525],{"class":175,"line":258},[173,526,527],{"class":179},"// This will only succeed if the actor has 'subscribe' or 'pubSub' permission\n",[173,529,530,533,535,537,540],{"class":175,"line":265},[173,531,532],{"class":434},"room.",[173,534,59],{"class":186},[173,536,462],{"class":434},[173,538,539],{"class":194},"'announcements'",[173,541,468],{"class":434},[173,543,544],{"class":175,"line":271},[173,545,262],{"emptyLinePlaceholder":261},[173,547,548],{"class":175,"line":284},[173,549,550],{"class":179},"// This will only succeed if the actor has 'publish' or 'pubSub' permission\n",[173,552,553,555,558,560,563,566,569],{"class":175,"line":293},[173,554,532],{"class":434},[173,556,557],{"class":186},"emit",[173,559,462],{"class":434},[173,561,562],{"class":194},"'chat'",[173,564,565],{"class":434},", { text: ",[173,567,568],{"class":194},"'Hello!'",[173,570,571],{"class":434}," })\n",[163,573,578],{"className":574,"code":575,"filename":576,"language":577,"meta":169,"style":169},"language-python shiki shiki-themes github-light github-dark","# Grants are managed in the dashboard or over the REST API, not from the SDK.\n# When connecting via the SDK, permission is enforced automatically:\nfrom nolag import NoLag\n\nclient = NoLag('your_access_token')\nawait client.connect()\n\nroom = client.set_app('my-app').set_room('general')\n\n# This will only succeed if the actor has 'subscribe' or 'pubSub' permission\nawait room.subscribe('announcements')\n\n# This will only succeed if the actor has 'publish' or 'pubSub' permission\nawait room.emit('chat', {'text': 'Hello!'})\n","Python","python",[57,579,580,585,590,595,599,604,609,613,618,622,627,632,636,641],{"__ignoreMap":169},[173,581,582],{"class":175,"line":176},[173,583,584],{},"# Grants are managed in the dashboard or over the REST API, not from the SDK.\n",[173,586,587],{"class":175,"line":183},[173,588,589],{},"# When connecting via the SDK, permission is enforced automatically:\n",[173,591,592],{"class":175,"line":204},[173,593,594],{},"from nolag import NoLag\n",[173,596,597],{"class":175,"line":215},[173,598,262],{"emptyLinePlaceholder":261},[173,600,601],{"class":175,"line":225},[173,602,603],{},"client = NoLag('your_access_token')\n",[173,605,606],{"class":175,"line":234},[173,607,608],{},"await client.connect()\n",[173,610,611],{"class":175,"line":240},[173,612,262],{"emptyLinePlaceholder":261},[173,614,615],{"class":175,"line":246},[173,616,617],{},"room = client.set_app('my-app').set_room('general')\n",[173,619,620],{"class":175,"line":252},[173,621,262],{"emptyLinePlaceholder":261},[173,623,624],{"class":175,"line":258},[173,625,626],{},"# This will only succeed if the actor has 'subscribe' or 'pubSub' permission\n",[173,628,629],{"class":175,"line":265},[173,630,631],{},"await room.subscribe('announcements')\n",[173,633,634],{"class":175,"line":271},[173,635,262],{"emptyLinePlaceholder":261},[173,637,638],{"class":175,"line":284},[173,639,640],{},"# This will only succeed if the actor has 'publish' or 'pubSub' permission\n",[173,642,643],{"class":175,"line":293},[173,644,645],{},"await room.emit('chat', {'text': 'Hello!'})\n",[163,647,652],{"className":648,"code":649,"filename":650,"language":651,"meta":169,"style":169},"language-go shiki shiki-themes github-light github-dark","// Grants are managed in the dashboard or over the REST API, not from the SDK.\n// When connecting via the SDK, permission is enforced automatically:\nclient := nolag.New(\"your_access_token\")\nclient.Connect()\n\nroom := client.SetApp(\"my-app\").SetRoom(\"general\")\n\n// This will only succeed if the actor has \"subscribe\" or \"pubSub\" permission\nroom.Subscribe(\"announcements\", func(data any, meta nolag.MessageMeta) {\n    fmt.Println(\"Announcement:\", data)\n})\n\n// This will only succeed if the actor has \"publish\" or \"pubSub\" permission\nroom.Emit(\"chat\", map[string]string{\"text\": \"Hello!\"})\n","Go","go",[57,653,654,658,662,667,672,676,681,685,690,695,700,705,709,714],{"__ignoreMap":169},[173,655,656],{"class":175,"line":176},[173,657,420],{},[173,659,660],{"class":175,"line":183},[173,661,425],{},[173,663,664],{"class":175,"line":204},[173,665,666],{},"client := nolag.New(\"your_access_token\")\n",[173,668,669],{"class":175,"line":215},[173,670,671],{},"client.Connect()\n",[173,673,674],{"class":175,"line":225},[173,675,262],{"emptyLinePlaceholder":261},[173,677,678],{"class":175,"line":234},[173,679,680],{},"room := client.SetApp(\"my-app\").SetRoom(\"general\")\n",[173,682,683],{"class":175,"line":240},[173,684,262],{"emptyLinePlaceholder":261},[173,686,687],{"class":175,"line":246},[173,688,689],{},"// This will only succeed if the actor has \"subscribe\" or \"pubSub\" permission\n",[173,691,692],{"class":175,"line":252},[173,693,694],{},"room.Subscribe(\"announcements\", func(data any, meta nolag.MessageMeta) {\n",[173,696,697],{"class":175,"line":258},[173,698,699],{},"    fmt.Println(\"Announcement:\", data)\n",[173,701,702],{"class":175,"line":265},[173,703,704],{},"})\n",[173,706,707],{"class":175,"line":271},[173,708,262],{"emptyLinePlaceholder":261},[173,710,711],{"class":175,"line":284},[173,712,713],{},"// This will only succeed if the actor has \"publish\" or \"pubSub\" permission\n",[173,715,716],{"class":175,"line":293},[173,717,718],{},"room.Emit(\"chat\", map[string]string{\"text\": \"Hello!\"})\n",[18,720,722],{"id":721},"common-patterns","Common Patterns",[724,725,727],"h3",{"id":726},"broadcast-channel","Broadcast Channel",[14,729,730],{},"Server actors publish announcements, clients subscribe to receive them:",[129,732,733,738],{},[132,734,735,736],{},"Server actors: ",[57,737,69],{},[132,739,740,741],{},"Client actors: ",[57,742,59],{},[724,744,746],{"id":745},"chat-room","Chat Room",[14,748,749],{},"All participants can read and write messages:",[129,751,752],{},[132,753,754,755],{},"All actors: ",[57,756,79],{},[724,758,760],{"id":759},"private-notifications","Private Notifications",[14,762,763],{},"Server sends notifications, user reads them:",[129,765,766,770],{},[132,767,735,768],{},[57,769,69],{},[132,771,772,773],{},"User actor: ",[57,774,59],{},[18,776,778],{"id":777},"next-steps","Next Steps",[129,780,781,787],{},[132,782,783],{},[91,784,786],{"href":785},"/docs/authentication","Authentication Guide",[132,788,789],{},[91,790,792],{"href":791},"/docs/concepts/topics","Topics & Pub/Sub",[794,795,796],"style",{},"html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}",{"title":169,"searchDepth":183,"depth":183,"links":798},[799,800,801,802,803,808],{"id":20,"depth":183,"text":21},{"id":27,"depth":183,"text":28},{"id":85,"depth":183,"text":86},{"id":145,"depth":183,"text":146},{"id":721,"depth":183,"text":722,"children":804},[805,806,807],{"id":726,"depth":204,"text":727},{"id":745,"depth":204,"text":746},{"id":759,"depth":204,"text":760},{"id":777,"depth":183,"text":778},"Learn how to configure fine-grained access control for NoLag topics.","md",{},"/docs/concepts/acl",{"title":5,"description":809},"docs/concepts/acl","kRVBpuhBTxwOCzIow0ra5pnoJYQSX_heTCwb9cXD0Qk",1788160342768]