MQTT "Connection Refused: not authorised" from Mosquitto in CI

Mosquitto accepted the TCP connection but rejected the MQTT CONNECT with return code "not authorised". The broker has anonymous access disabled and the client sent no credentials, or the username/password did not match the password file.

What this error means

The client connect callback reports "Connection Refused: not authorised" (CONNACK return code 5) even though the port is reachable.

Terminal

Error: Connection refused: Not authorized.

Common causes

Anonymous access is disabled

With allow_anonymous false, a client that sends no username/password is refused as not authorised.

Wrong credentials for the password file

The username/password do not match an entry created in the Mosquitto password file.

How to fix it

Provide matching credentials

Create a password file entry and connect with the same username/password.

Terminal

mosquitto_passwd -b /mosquitto/config/passwd app app_pw
# client connects with username 'app' and password 'app_pw'

Allow anonymous for an isolated test broker

If the test broker does not need auth, allow anonymous access so the client connects without credentials.

mosquitto.conf

# mosquitto.conf
listener 1883
allow_anonymous true

How to prevent it

Keep the password file entries and client credentials in sync.
Inject MQTT credentials from CI secrets, not committed config.
Use allow_anonymous only for isolated test brokers.