MQTT

MQTT credentials give integrations pub/sub access within your organisation's topic namespace. You create credentials in Tillor under Account > Developers (per organisation). Access to topics is limited to tillor/{env}/{orgId}/integration and its sub-topics ({env} = prod, staging or local), unless a static credential has topicPrefix: null.

For the same realtime events as webhooks and SSE, use those channels, not MQTT.

ManagementCopy link to this section

Authentication: x-api-key, with the organisation ID in the path (same as the HTTP API). See the OpenAPI specification for the full request and response schemas.

CredentialsCopy link to this section

There are two variants:

JWT (temporary)Copy link to this section

• Use: Short sessions, temporary access
• Expiry: 1 hour by default; configurable from 1 minute to 24 hours via expiresInSeconds
• Ideal for: Testing, temporary connections, or when you fetch tokens dynamically
• Creating: In Tillor under Account > Developers, or via POST /api/orgs/:orgId/mqtt/credentials with optionally { "clientId": "...", "expiresInSeconds": 3600 }
• Response: token (use as MQTT password), clientId, brokerUrl, topicPrefix, expiresAt
• Username: Leave empty when connecting; JWT authentication only uses the token as password.
• Client ID: Use exactly the clientId from the response when connecting (including the environment prefix, e.g. prod-).

A connection to the broker via mqtts verifies the server certificate. If you use a private CA certificate (not the standard public chain), put the PEM of that CA in your client environment.

Static credentialsCopy link to this section

• Use: Long-running integrations, always-on connections
• Form: Fixed userName, clientId and password
• Ideal for: Production integrations that stay connected continuously
• Creating: In Tillor under Account > Developers, or via POST /api/orgs/:orgId/mqtt/static-credentials with optionally { "name": "mijn-integratie", "topicPrefix": null }
• Response: userName, clientId, password (once only), topicPrefix (null = no prefix, ACL #), optionally brokerUrl
• Note: The password is shown once in the response and cannot be retrieved afterwards

---

Topic accessCopy link to this section

Topic subscriptions are strictly limited, unless topicPrefix is null (ACL #). By default you can only publish and subscribe on tillor/{env}/{orgId}/integration and tillor/{env}/{orgId}/integration/#.

• Allowed topics - Only tillor/{env}/{orgId}/integration and sub-topics (e.g. tillor/{env}/{orgId}/integration/connector/access-point-operation)
• No wildcard bypass - Even with # or + you only get access to your organisation namespace
• Per organisation - Credentials are per organisation; you have no access to topics of other organisations

---

RelatedCopy link to this section

• OpenAPI - Full API specification
• HTTP API - REST API and API keys
• Webhooks - Same events via HTTP POST
• SSE - Stream events via Server-Sent Events