diff --git a/src/pages/docs/auth/capabilities.mdx b/src/pages/docs/auth/capabilities.mdx index fd25089dc0..ab156d0976 100644 --- a/src/pages/docs/auth/capabilities.mdx +++ b/src/pages/docs/auth/capabilities.mdx @@ -49,6 +49,18 @@ The following capability operations are available for API keys and issued tokens Although most capabilities need to be enabled for the resource you're using them with, there are exceptions. The `stats` permission only does something when attached to the wildcard resource `'*'`, or a resource that contains that as a subset, such as `'[*]*'`, since stats are app-wide. +## Channel access control + +Ably does not provide numeric limits on channel access. Control channel access using token authentication and capabilities. + +Channel access is controlled through: + +* [Token authentication](/docs/auth/token) to restrict access by issuing tokens with specific capabilities to authorized users +* Specific `clientId` values in tokens to ensure only certain users can access particular channels +* Granting or restricting specific operations (`subscribe`, `publish`, `presence`) on channels through capability configurations + +For private messaging or group chats, design channel naming strategies and use token authentication to ensure users receive tokens with access only to relevant channels. + The `channel-metadata` permission works both ways. When associated with a specific channel or set of channels it allows you to [query the metadata of a channel](/docs/metadata-stats/metadata/rest) to request its status. When associated with the wildcard resource `'*'` it takes on an additional meaning: as well as allowing channel status requests for all channels, it also allows you to [enumerate all active channels](/docs/metadata-stats/metadata/rest#enumerate).