# Token Auth (/sdks/rust/how-to/connection/token-auth)



## Overview [#overview]

**Token authentication** proves a client's identity to a KubeMQ broker that has authentication enabled, without embedding a username/password or issuing per-client TLS certs. It's the mechanism you reach for in shared clusters, multi-tenant deployments, or any environment where you need to control and audit which clients are allowed to connect — the token is issued and revoked by your identity provider, not baked into the binary.

The token travels as gRPC `authorization` metadata attached to every outgoing request, set once via `.auth_token(...)` on `KubemqClient::builder()`. The broker validates it before honoring any call, including the initial handshake — a failure returns `KubemqError::Authentication`. Because a static token eventually expires, source it from configuration or a secrets manager at startup rather than a literal, so rotation only requires restarting the process with a new value.

**Gotchas:** an invalid or expired token isn't rejected until the first real call — call `ping()` right after `.build()` so failures surface immediately instead of on your first business request; never hardcode a real token in source; and the builder's `auth_token` is static for the life of the client, so long-running processes holding short-lived JWTs need to reconnect on a schedule rather than expecting in-place refresh.

## Prerequisites [#prerequisites]

* KubeMQ server running on `localhost:50000` with authentication enabled
* Rust SDK installed (`cargo add kubemq`)

## Code [#code]

```rust title="main.rs"
use kubemq::prelude::*;

#[tokio::main]
async fn main() -> kubemq::Result<()> {
    let client = KubemqClient::builder()
        .host("localhost")
        .port(50000)
        .auth_token("your-auth-token-here")
        .build()
        .await?;

    let info = client.ping().await?;
    println!(
        "Connected with auth token. Server version: {}",
        info.version
    );

    client.close().await?;
    Ok(())
}
```

## How It Works [#how-it-works]

* The `auth_token` is included as gRPC metadata in every request to the broker.
* If authentication fails, the SDK returns `KubemqError::Authentication`.
* Review timeouts, channel names, and client IDs before running against shared environments.
* Run the program while the server from the prerequisites is available.

## Related [#related]

* [Getting Started](/deploy)
* [Rust SDK Reference](/sdks/rust/reference/client)
* [TLS Setup](/sdks/rust/how-to/tls/tls-setup)