AlexxIT/go2rtc · error

wrong login

Error message

wrong login

What it means

After the MQTT client sends CONNECT, the broker must reply with a CONNACK packet of exactly the 4 bytes {CONNACK, 2, 0, 0}, meaning session-present=0 and return-code=0 (connection accepted). Any other CONNACK payload — typically a non-zero return code like 2/3/4/5 — or a different packet indicates rejected credentials, so Connect fails with "wrong login".

Solutions

1. Verify username and password are correct — test them with a CLI client: `mosquitto_pub -h host -u user -P pass -t test -m hi`.
2. Ensure the URL embeds credentials in the expected form: mqtt://user:pass@host:1883.
3. Confirm the port/encryption matches the broker (1883 plaintext vs 8883 TLS) — a TLS listener receiving plaintext can yield garbage instead of CONNACK.
4. Check broker ACL/config: anonymous access disabled while no credentials given, or user not authorized for the clientID.

Example fix

// before
client, err := mqtt.Dial("tcp", "broker:1883", nil)
// after: supply credentials
client, err := mqtt.Dial("tcp", "mqtt://user:pass@broker:1883", nil)

// Validate credentials non-empty when broker requires auth
if brokerRequiresAuth && (username == "" || password == "") {
    return errors.New("mqtt credentials required")
}

client, err := mqtt.Dial(scheme, url, nil)
if err != nil {
    if strings.Contains(err.Error(), "wrong login") {
        return fmt.Errorf("mqtt credentials rejected by broker; check username/password/port: %w", err)
    }
    return err
}

When it happens

Trigger: Calling mqtt Client.Connect (via Dial) when the broker's CONNACK return code is non-zero: bad username/password, unauthorized clientID, broker not accepting anonymous connections, or the server responding with a non-CONNACK packet.

Common situations: Wrong username/password in the MQTT URL or config; broker requires credentials but none supplied; ACL denies the user; broker only allows TLS on the chosen port while the client connected in plaintext; stale credentials after a password rotation.

Related errors

• loginResp.ErrorMsg
• tuya:
• milesone: authentication failed:
• wrong auth response
• hap: VerifyServerAuthenticator

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/ae3e0008de655cbc. Report an issue: GitHub.

Appendix: source

Thrown at pkg/mqtt/client.go:39

}

func (c *Client) Connect(clientID, username, password string) (err error) {
	if err = c.conn.SetDeadline(time.Now().Add(Timeout)); err != nil {
		return
	}

	msg := NewConnect(clientID, username, password)
	if _, err = c.conn.Write(msg.b); err != nil {
		return
	}

	b := make([]byte, 4)
	if _, err = io.ReadFull(c.conn, b); err != nil {
		return
	}

	if !bytes.Equal(b, []byte{CONNACK, 2, 0, 0}) {
		return errors.New("wrong login")
	}

	return
}

func (c *Client) Subscribe(topic string) (err error) {
	if err = c.conn.SetDeadline(time.Now().Add(Timeout)); err != nil {
		return
	}

	c.mid++
	msg := NewSubscribe(c.mid, topic, 1)
	_, err = c.conn.Write(msg.b)
	return
}

func (c *Client) Publish(topic string, payload []byte) (err error) {
	if err = c.conn.SetDeadline(time.Now().Add(Timeout)); err != nil {

View on GitHub (pinned to c245815e75)