Phoenix Channels Essentials

For non-LiveView real-time features: mobile clients, SPAs, external APIs, inter-service communication.

RULES — Follow these with no exceptions

1. Always authenticate in connect/3 — channels bypass the Plug pipeline; tokens must be verified in the socket
2. Authorize in join/3 — verify the user can access the requested topic before allowing the connection
3. Use handle_in for client-to-server, push for server-to-client, broadcast for server-to-all — never confuse the direction
4. Keep channel modules thin — delegate business logic to context modules; channels are the transport layer
5. Use Presence for tracking connected users — don't roll your own presence tracking; Phoenix.Presence handles node distribution
6. Return {:reply, :ok, socket} or {:reply, {:error, reason}, socket} from handle_in — don't silently drop messages

Socket Authentication

Channels bypass the Plug pipeline, so session-based auth doesn't work. Use token-based authentication.