# MQTT clientid question **URL:** \ **Category:** Help\ **Tags:** mqtt\ **Created:** [April 15, 2022, 7:48am UTC](https://forums.losant.com/t/mqtt-clientid-question/4466 "2022-04-15T07:48:34Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Paolo\_Proxy](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@Paolo\_Proxy](https://forums.losant.com/u/Paolo_Proxy)\ **Post date:** [April 15, 2022, 7:48am UTC](https://forums.losant.com/t/mqtt-clientid-question/4466/1 "2022-04-15T07:48:34Z")
Hello, so I was reading the MQTT documentation and if I get this right I can also use it to publish generic payloads from devices outside Losant. Now I am having trouble publishing generic payloads (it cannot even connect with a standard MQTT library) so I am wondering … does the client\_id is still validated? e.g. do I have to create a bogus device and the use that client\_id in the MQTT authentication even for generic payloads? Cheers. ---
**Author:** ![Paolo\_Proxy](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@Paolo\_Proxy](https://forums.losant.com/u/Paolo_Proxy)\ **Post date:** [April 15, 2022, 11:29am UTC](https://forums.losant.com/t/mqtt-clientid-question/4466/2 "2022-04-15T11:29:26Z")
I can actually confirm this is the case because when I change the clientid to a a custom string the connection is refused. This should be at least described in the documentation. ---
**Author:** ![Dylan\_Schuster](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/dylan_schuster/32/2850_2.png) [@Dylan\_Schuster](https://forums.losant.com/u/Dylan_Schuster)\ **Post date:** [April 15, 2022, 1:15pm UTC](https://forums.losant.com/t/mqtt-clientid-question/4466/3 "2022-04-15T13:15:02Z")
We do mention [here](https://docs.losant.com/mqtt/overview/#broker-authentication) that authenticating against the broker requires providing a device ID as the client ID. Where were you looking so that I can get that noted in the same spot? And to answer your question, yes, you’ll need to create a device in Losant to serve as the client. We have talked about allowing for arbitrary connections using the application as the client (or setting your own client ID) but we do not have any timelines for when that would be implemented. ---
**Author:** ![Dylan\_Schuster](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/dylan_schuster/32/2850_2.png) [@Dylan\_Schuster](https://forums.losant.com/u/Dylan_Schuster)\ **Post date:** [April 15, 2022, 1:19pm UTC](https://forums.losant.com/t/mqtt-clientid-question/4466/5 "2022-04-15T13:19:54Z")
You can also use our REST API to [subscribe to an MQTT topic as an SSE stream](https://docs.losant.com/rest-api/application/#mqtt-subscription-stream) or [publish a message on a topic](https://docs.losant.com/rest-api/application/#mqtt-publish-message) if that works for your use case. ---
**Author:** ![Paolo\_Proxy](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@Paolo\_Proxy](https://forums.losant.com/u/Paolo_Proxy)\ **Post date:** [April 16, 2022, 7:06am UTC](https://forums.losant.com/t/mqtt-clientid-question/4466/6 "2022-04-16T07:06:35Z")
Yes I know that but I assumed that since the device doesn’t exist because is external, the client\_id wouldn’t apply in that case. Maybe you can reference that in the paragraph called Custom Topics like “you do still need to create a device for this to work etc etc”. ---
**Author:** ![Paolo\_Proxy](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@Paolo\_Proxy](https://forums.losant.com/u/Paolo_Proxy)\ **Post date:** [April 16, 2022, 7:08am UTC](https://forums.losant.com/t/mqtt-clientid-question/4466/7 "2022-04-16T07:08:20Z")
Oh nice, I guess this will be useful if I want to transform and display those messages in real time in a UI component (experiences)? ---
**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\ **Post date:** [April 18, 2022, 2:25pm UTC](https://forums.losant.com/t/mqtt-clientid-question/4466/8 "2022-04-18T14:25:33Z")
For security reasons, I wouldn’t recommend accessing the Losant REST API directly through client-side JavaScript on an experience page. This is because you’d have to expose an API token client-side, which means anyone viewing the page can obtain the token. To do this securely, the client-side JavaScript can make requests to an Experience Endpoint, which in turn can access the Losant REST API. This extra layer gives you an opportunity to verify the user has access to do whatever they’re about to do. We’ve also added [Streaming Endpoints](https://docs.losant.com/experiences/streaming-endpoints/), which are specifically designed to securely allow experience pages to subscribe to MQTT topics through SSE streams. The client-side JavaScript can make an SSE connection to an Experience Endpoint, which in turn [replies with an SSE stream](https://docs.losant.com/workflows/outputs/endpoint-reply/#sse-stream-sources). Just like before, this gives you an opportunity to verify the request before replying.