Uses grantToken()

Secret Key server-only

Environment variables for keys

Server userId set

Returns token via setToken pattern

Short TTL for sensitive channels

Least privilege permissions

authorizedUUID set

Expiration in response

Error handling

Server-client separation

Uses setToken()

No secretKey on client

PNAccessDeniedCategory handler

Re-auth on access denied

Proactive token refresh

Refresh buffer time

TLS not disabled

userId in config

Token update on refresh

Cleanup on destroy

Server-client separation

Uses CryptoModule

crypto.randomBytes for key gen

32-byte key length

Separate keys per context

No encryption on public client

Channel names not encrypted

Message payload encrypted

Publisher UUID not encrypted

No secretKey in clients

TLS not disabled

userId set on all clients

Keys from env vars

Uses grantToken()

Pattern-based grants

Channel naming with prefixes

Tenant isolation in channels

Least privilege - guest

Least privilege - escalation

Uses revokeToken()

Server secretKey from env

Server userId identifier

authorizedUUID in grant

TTL specified

Fine-grained permissions

Pre-send file encryption

Client-side decryption

Uses revokeToken()

Revocation delay noted

Uses parseToken()

Uses grantToken()

Server-client separation

Short TTL for sensitive data

No secretKey on client

TLS not disabled

Error handling

Env vars for keys