AUTH
Fixed header flags: 0000 – all flags reserved
AUTH is an MQTT 5.0-only packet that enables enhanced authentication – multi-step challenge-response authentication (e.g., SCRAM, Kerberos, custom challenge). AUTH packets flow between client and broker after CONNECT but before CONNACK, enabling an arbitrary number of authentication exchanges before the session is established.
Details
AUTH is new in MQTT 5.0. It does not exist in MQTT 3.1.1. It enables enhanced authentication flows that require multiple round trips – beyond the single username/password exchange in CONNECT.
The authentication flow: 1. Client sends CONNECT with Authentication Method property (e.g., "SCRAM-SHA-256") 2. Broker sends AUTH with reason code 0x18 (Continue Authentication) and Authentication Data (challenge) 3. Client sends AUTH with reason code 0x18 and Authentication Data (response) 4. Broker sends CONNACK 0x00 (success) or AUTH 0x18 for further rounds
Reason codes: 0x00 = Success (authentication is complete, sent by server in CONNACK) 0x18 = Continue Authentication (more rounds required) 0x19 = Re-Authenticate (client requests re-authentication during an active session)
Re-authentication (0x19): a client may send AUTH with 0x19 at any point during an established session to update credentials without disconnecting. The broker responds with AUTH (0x18 or 0x00).
Security: AUTH packets allow brokers to implement any authentication protocol that can be expressed as a sequence of binary data exchanges, including token refresh, certificate-based auth, and custom enterprise SSO.
Fixed Header
| Field | Value |
|---|---|
| Packet type (bits 7–4) | 15 (1111₂) |
| First byte (hex) | 0xF0 |
| Flags (bits 3–0) | 0000 – all flags reserved |
| QoS bits apply | No |
| Direction | both |
| Added in | MQTT 5.0 |