---
metadata:
  - name: generator
    content: Diplodoc Platform v5.52.0
alternate:
  - https://ydb.tech/docs/en/reference/kafka-api/auth.md?version=v25.3
  - https://ydb.tech/docs/ru/reference/kafka-api/auth.md?version=v25.3
  - href: en/reference/kafka-api/auth.md
    type: text/markdown
    title: Markdown version
  - href: ../../llms.txt
    type: text/markdown
    title: llms.txt
sourcePath: en/core/reference/kafka-api/auth.md
---
> **Documentation Index:** Fetch the complete configuration index at https://ydb.tech/docs/en/llms.txt

# Kafka API authentication

## Enabling authentication

When you run [a single-node local YDB cluster](https://ydb.tech/docs/en/quickstart.md?version=v25.3), [anonymous authentication](https://ydb.tech/docs/en/security/authentication.md?version=v25.3#anonymous) is used by default. It doesn't require a username and password.

To require authentication see [Authentication](https://ydb.tech/docs/en/security/authentication.md?version=v25.3#static-credentials).

Authentication is always enabled when using the [Kafka API in Yandex Cloud](https://yandex.cloud/en/docs/data-streams/kafkaapi/auth).

## How does authentication work in the Kafka API?

The Kafka API uses the `SASL_PLAINTEXT/PLAIN` or `SASL_SSL/PLAIN` authentication mechanism.

The following variables are required for authentication:

* `<user-name>` — the username. For information about user management, refer to the [Authorization](https://ydb.tech/docs/en/security/authorization.md?version=v25.3#user) section.
* `<password>` — the user's password. For information about user management, refer to the [Authorization](https://ydb.tech/docs/en/security/authorization.md?version=v25.3#user) section.
* `<database>` — [the database path](https://ydb.tech/docs/en/concepts/connect.md?version=v25.3#database).

These parameters form the following variables, which you can use in the `sasl.jaas.config` Kafka client property:

* `<sasl.username> = <user-name>@<database>`
* `<sasl.password> = <password>`

{% note info %}

The `<sasl.username>` and `<sasl.password>` parameters are formed differently. See [examples](https://ydb.tech/docs/en/reference/kafka-api/examples.md?version=v25.3#authentication-in-cloud-examples) for details.

{% endnote %}

For authentication examples, see [Kafka API usage examples](https://ydb.tech/docs/en/reference/kafka-api/examples.md?version=v25.3).