How can you restrict which channels a client can access?

I'm using Ably's Realtime library to implement Pub/Sub over websockets. However, is there a way to restrict the channels that my client can access?

(disclaimer: I am a developer advocate for Ably, and posting and self-answering a commonly asked support question here on Stack Overflow so our users can find this more easily)

Solution

Ably's authentication system allows a set of capabilities to be configured for the tokens that are issued to clients. Capabilities can also be set on API keys themselves, but that is rarely the right way to restrict what clients can access as tokens provide far more flexibility and are safer to distribute to clients.

In order to understand how capabilities can be used to secure your app and which channels a client can access, please see the following :

Capabilities explained which describes specifically how you can configure which channels a client can access and what operations they can perform on each channel.