MQTT GUIDE
3 min readMQTT Authentication
MQTT authentication is how the broker verifies a client’s identity when it connects. Common methods are username/password, signed tokens such as JWT, and challenge-response schemes like SCRAM; client certificates (mutual TLS) are a separate option. The broker checks the credential on CONNECT and refuses the connection if it fails.
Encryption with TLS hides the connection, but the broker still needs to know who is connecting. Authentication is the step where a client proves its identity on CONNECT, and the broker accepts or refuses it.
How authentication works
The client presents a credential — a username and password, or a token carried in the password field — and the broker validates it before the session opens. A broker typically supports several methods and picks one per client. If validation fails, the broker replies with a failure reason code and closes the connection.
Common authentication methods
| Method | How the client proves identity |
|---|---|
| Basic | Client ID, username and password in the CONNECT packet |
| JWT | A signed JSON Web Token carried in the password field |
| SCRAM | A salted challenge-response — the password never crosses the wire (MQTT 5.0) |
| X.509 | A client certificate presented during the TLS handshake (mutual TLS) |
| HTTP | Credentials validated by an external HTTP service you control |
Authentication in TBMQ
TBMQ ships pluggable authentication providers you can enable, disable, and order from the UI without restarting (SCRAM is the exception — the broker handles it automatically per the MQTT 5.0 spec): Basic, JWT, SCRAM (SCRAM-SHA-256/512 over the MQTT 5.0 AUTH packet), X.509 client certificates, and an HTTP provider that defers to your own service. To use an OAuth 2.0 identity provider, have it issue a JWT the client presents. Once a client is authenticated, TBMQ then applies authorization rules.
Frequently asked questions
How does MQTT authentication work?
The client includes a credential in its CONNECT packet — a username and password, or a token in the password field — and the broker validates it before accepting the connection. If it fails, the broker returns a CONNACK failure reason code and closes the connection.
What authentication methods does MQTT support?
The protocol carries a username and password field, which brokers use for password auth or to carry tokens like JWT. MQTT 5.0 adds enhanced authentication (the AUTH packet) for challenge-response schemes such as SCRAM. X.509 client certificates authenticate during the TLS handshake instead.
What is SCRAM authentication?
SCRAM (Salted Challenge Response Authentication Mechanism) is a challenge-response scheme where the client proves it knows the password without ever sending the password itself. In MQTT it runs over the MQTT 5.0 enhanced-authentication AUTH packet.
Does MQTT support OAuth 2.0?
Not directly as a client auth method. The usual pattern is to have your OAuth 2.0 / OpenID Connect identity provider issue a JWT, and the MQTT client presents that JWT to the broker in the CONNECT password field.
What is the difference between authentication and authorization?
Authentication proves who the client is at connect time. Authorization decides what that authenticated client may do — which topics it can publish to or subscribe from. They are separate steps.
Run it yourself
TBMQ is a free, open-source MQTT broker built to scale. Spin it up in minutes or try the live demo — no install required.