Skip to content

Cookie preferences

We use cookies for our own analytics, to see how our campaigns perform and, if you allow it, to load content from other services such as the Google site search. We never sell your data. Necessary cookies keep the site working and cannot be switched off. See our Cookie Policy for details and our Privacy Policy for how we handle personal data.

Security, load balancing and remembering your cookie choice.

Show us which pages people read, how they find the site and where they get stuck, so we can improve it (Google Analytics, Microsoft Clarity).

Show us which of our ad campaigns bring visitors to the site and remember the campaign or partner link you arrived from (Google Ads, LinkedIn, Meta, partner program). We do not use these cookies to build advertising profiles.

Load the site search from Google when you use it. Google sets its own cookies and shows ads in the search results.
© 2026 The ThingsBoard Authors
22.6k Try for free Menu

ThingsBoard Cloud

Choose your data region

Your data stays in the region you choose, for residency and compliance. No credit card required.

North America Data stored in North America Europe Data stored in the European Union

Rather run it yourself? Install on your own servers

Security Overview

ThingsBoard provides multiple layers of security for platform access, user authentication, and data protection. This page summarizes the available mechanisms and links to detailed configuration guides.

User Authentication

Section titled “User Authentication”

ThingsBoard authenticates users via username and password by default. Administrators can enhance sign-in security with additional methods:

Method Description
Username and password Default sign-in method. Configure password complexity, expiration, and account lockout rules in security settings.
Two-factor authentication Adds a second verification step after entering credentials. Supports TOTP authenticator apps, email, SMS, and backup codes. See Two-factor authentication.
OAuth 2.0 / SSO Allows sign-in via external identity providers like Google, Auth0, Keycloak, Okta, and Azure AD. See OAuth 2.0 support.
Self-registration Lets tenants expose a sign-up page so customers can create their own accounts. See Self-registration.

Programmatic Access

Section titled “Programmatic Access”

Applications and scripts authenticate to the ThingsBoard REST API using one of two methods:

Method Description
JWT tokens Obtained by calling the login endpoint with username and password. Tokens expire periodically and must be refreshed. Configure token lifetime in security settings. See the REST API reference for details.
API keys Long-lived credentials that bypass the login flow. Ideal for third-party integrations, scripts, and automation. See API keys.

Infrastructure Security

Section titled “Infrastructure Security”

Web UI and REST API

Section titled “Web UI and REST API”
TopicDescription
HTTPS / SSLEncrypt traffic between clients and the ThingsBoard server using TLS certificates. See HTTPS (TLS) configuration.
Custom domainsBind custom domain names with automatic SSL certificate provisioning. See Domains.
CORS and security headersRestrict cross-origin access to the REST API and enable HTTP security headers like X-Frame-Options and Content-Security-Policy. See Web security hardening.

Device Transport Security

Section titled “Device Transport Security”

Each device connectivity protocol supports encrypted transport and one or more authentication methods:

Protocol Encryption Authentication methods Reference
MQTT TLS (port 8883) Access Token, MQTT Basic credentials, X.509 certificate MQTT getting connected
HTTP TLS / HTTPS (port 443) Access Token HTTP getting connected
CoAP DTLS (port 5684) Access Token, X.509 certificate CoAP getting connected
LwM2M DTLS (ports 5686, 5688) Pre-Shared Key (PSK), Raw Public Key (RPK), X.509 certificate LwM2M getting started
SNMP USM authentication + encryption (v3) Community string (v1/v2c), USM username with auth and privacy passphrases (v3) SNMP getting connected

All protocols support one-way TLS (client verifies the server). MQTT, CoAP, and LwM2M also support mutual TLS, where both sides authenticate using X.509 certificates. For MQTT fleet provisioning, you can use certificate chains so that devices sharing a common CA are automatically trusted.

Platform runtime

Section titled “Platform runtime”

ThingsBoard components run on one of two runtimes, Java or Node.js:

Component Runtime
ThingsBoard Node, transports, and other backend services Java (JVM), with embedded Apache Tomcat as the HTTP server. Covers the REST API, Rule Engine, and device transports. See Monolithic architecture.
Web UI Angular application that runs in the browser. A monolithic deployment serves it from ThingsBoard Node. A microservices deployment serves it from the Web UI service, which runs on Node.js with Express.js. See Microservices architecture.
JS Executor Node.js. Runs user-defined JavaScript from rule nodes in a microservices deployment. By default, a monolithic deployment runs these scripts inside ThingsBoard Node. See JavaScript Executor.

ThingsBoard Docker images include their own Java and Node.js runtimes. These runtimes and other third-party libraries are updated as part of regular maintenance releases, and the release notes of each version list the updates it includes. See Releases. When you install ThingsBoard from Linux packages, it runs on the Java runtime installed on the host, so updating Java is part of your host maintenance.

Administration and Compliance

Section titled “Administration and Compliance”
TopicDescription
Security settingsConfigure account lockout policies, password requirements, and JWT token parameters. See Security settings.
Audit logTrack user actions across the platform for compliance and troubleshooting. See Audit log.
Secrets storageEncrypted vault for storing sensitive values like API tokens, passwords, and certificates used in integrations and rule chains. See Secrets storage.