# SASL/OAUTHBEARER Authentication

Requires Agent Version: v745

SASL/OAUTHBEARER Authentication uses OAuth tokens based on the Java Web Token (JWT) standard to authenticate your Kafka clients. By default Kafka clients communicating with WarpStream Agents use `PLAINTEXT`, meaning that all data is sent in plain text (unencrypted), this includes the SASL credentials.

When using SASL it is recommended to [Configure TLS Encrpytion for your WarpStream Cluster.](/warpstream/kafka/manage-security/protect-data-in-motion-with-tls-encryption.md#configure-tls-encryption-for-a-warpstream-cluster)

## Configure WarpStream Agents

Set the `requireSASLAuthentication` flag or `WARPSTREAM_REQUIRE_SASL_AUTHENTICATION=true` environment variable on the Agents. If limiting SASL authentication methods via the `enabledSASLMechanisms` flag or `WARPSTREAM_ENABLED_SASL_MECHANISMS` environment variable make sure `OAUTHBEARER` is added.

\
Set the `saslOauthIssuerURL` flag or `WARPSTREAM_SASL_OAUTH_ISSUER_URL` environment variable to the URL of your OAuth provider for example `https://example.okta.com/oauth2/default`.\
\
Set the `saslOauthAudience` flag or `WARPSTREAM_SASL_OAUTH_AUDIENCE` to the OAuth provider audience for example `api://default`.

Once configured is enabled on the Agents, they will enforce that all Apache Kafka clients that connect to them authenticate themselves via SASL. Improperly authenticated clients will be unable to connect.

### Configure Kafka clients

For configuring SASL/OAUTHBEARER in your Kafka clients it is recommended to review the documentation for your Kafka client. Every Kafka client configures SASL/OAUTHBEARER differently and those configurations may change version to version.

We recommend using the [Confluent Platform documentation](https://docs.confluent.io/platform/current/security/authentication/sasl/oauthbearer/configure-clients.html) to learn how to configure Java-based clients for SASL/OAUTHBEARER.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.warpstream.com/warpstream/kafka/manage-security/sasl-oauthbearer-authentication.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.