Token Auth

Overview

Token authentication proves a client's identity to a KubeMQ broker that has authentication enabled, without embedding a username/password or issuing per-client TLS certs. It's the mechanism you reach for in shared clusters, multi-tenant deployments, or any environment where you need to control and audit which clients are allowed to connect — the token is issued and revoked by your identity provider, not baked into the binary.

The token travels as gRPC authorization metadata attached to every outgoing request, set once via .auth_token(...) on KubemqClient::builder(). The broker validates it before honoring any call, including the initial handshake — a failure returns KubemqError::Authentication. Because a static token eventually expires, source it from configuration or a secrets manager at startup rather than a literal, so rotation only requires restarting the process with a new value.

Gotchas: an invalid or expired token isn't rejected until the first real call — call ping() right after .build() so failures surface immediately instead of on your first business request; never hardcode a real token in source; and the builder's auth_token is static for the life of the client, so long-running processes holding short-lived JWTs need to reconnect on a schedule rather than expecting in-place refresh.

Prerequisites

• KubeMQ server running on localhost:50000 with authentication enabled
• Rust SDK installed (cargo add kubemq)

Code

use kubemq::prelude::*;

#[tokio::main]
async fn main() -> kubemq::Result<()> {
    let client = KubemqClient::builder()
        .host("localhost")
        .port(50000)
        .auth_token("your-auth-token-here")
        .build()
        .await?;

    let info = client.ping().await?;
    println!(
        "Connected with auth token. Server version: {}",
        info.version
    );

    client.close().await?;
    Ok(())
}

How It Works

• The auth_token is included as gRPC metadata in every request to the broker.
• If authentication fails, the SDK returns KubemqError::Authentication.
• Review timeouts, channel names, and client IDs before running against shared environments.
• Run the program while the server from the prerequisites is available.

Related

• Getting Started
• Rust SDK Reference
• TLS Setup