Stand with Ukraine flag

MQTT GUIDE

2 min read

MQTT Authorization and ACLs

Quick answer

Authorization decides what an authenticated MQTT client is allowed to do — which topics it may publish to and which it may subscribe to. Brokers enforce this with access-control rules (ACLs) attached to each client’s credentials, so being connected doesn’t mean a client can touch every topic.

Authenticating a client answers who are you. Authorization answers what are you allowed to do — which topics a client may publish to or subscribe from. It’s the third layer of MQTT security, and the one that contains the blast radius if a device is compromised.

How authorization works

Each client (or credential) has a set of access-control rules — an ACL. When the client tries to publish or subscribe, the broker checks the topic against those rules and allows or refuses the operation. Publish and subscribe are usually controlled separately, and rules are commonly written as topic patterns so one rule can cover a whole subtree.

this client's publish rule: sensors/+/data Client Broker PUBLISH sensors/floor1/data PUBACK 0x00 ✓ allowed — matches sensors/+/data PUBLISH commands/reboot PUBACK 0x87 Not authorized ✗ denied — no matching rule
Authorization checks each publish against the client’s topic rules — allow or refuse

Authorization in TBMQ

TBMQ authorizes publish and subscribe separately, per client credentials, using regular-expression topic patterns. The default rule allows all topics (.*), so hardening a deployment means tightening those patterns to scope each client to exactly the topics it needs — for example letting a device publish only under its own branch of the topic tree. See Authorization in the security overview for the rule model, and MQTT client credentials for where you configure the publish/subscribe patterns per client.

Frequently asked questions

What is MQTT authorization?

The broker’s enforcement of what an authenticated client may do — specifically which topics it may publish to and which it may subscribe from. It runs after authentication: being connected does not mean a client can use every topic.

What is an ACL in MQTT?

An access-control list: the set of rules that say which topics a client (or credential) is allowed to publish to or subscribe from. Brokers usually let you define publish rules and subscribe rules separately, often as topic patterns.

What is the difference between authentication and authorization?

Authentication verifies identity at connect. Authorization limits what that identity may do afterward, per topic. A client can authenticate successfully and still be denied a specific publish or subscribe.

What happens when a client violates an authorization rule?

The broker refuses that specific operation. A disallowed subscribe is rejected in the SUBACK; a disallowed publish is dropped and, in MQTT 5.0, acknowledged with a Not authorized reason code. The connection itself can stay open.

Can I use wildcards in authorization rules?

Yes. Rules are usually expressed as topic patterns, so one rule can cover a whole subtree — for example allowing a device to publish only under its own branch of the topic tree.

Run it yourself

TBMQ is a free, open-source MQTT broker built to scale. Spin it up in minutes or try the live demo — no install required.