> ## Documentation Index
> Fetch the complete documentation index at: https://docs.condense.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Broker types and authentication

> Each broker type asks for different details, and each way of signing in asks for different keys.

## What is the same everywhere

* Passwords, secrets, private keys and tokens are **masked**. Use the eye icon to show what you typed.
* Certificates, keys and credential files can be **pasted** or **uploaded**. Use the Paste Content and Upload File switch. A file larger than **12 MB** is refused.
* Fields marked with an asterisk are required.

![Mutual TLS. A file over the size limit is rejected, with a message under the field.](https://mintcdn.com/zeliot/GzQSA695TD-eq-Lb/images/broker-registry/broker-file-too-large.png?fit=max\&auto=format\&n=GzQSA695TD-eq-Lb\&q=85\&s=a3c14d2949a5e1a8c5851ffbb32c2e2a)

Mutual TLS. A file over the size limit is rejected, with a message under the field.

## Broker by broker

> [accordion] NATS: Embedded NATS JetStream Broker and NATS & JetStream Broker
>
> * **Server URL(s)** (required): one or more addresses, for example `nats://connect.ngs.global:4222`.
> * **Cluster Name / ID** (optional), up to 64 characters.
>
> **Authentication Method**, one of:
>
> * **User Credentials**: the NATS credentials content, which holds the JWT and the NKey seed. Paste it or upload the file.
> * **NKey**: the NATS seed.
> * **Token**: an authentication token.
> * **Username & Password**.
> * **Mutual TLS**: a client certificate and a client private key (both required), and a CA certificate (optional).

> [accordion] Condense Kafka Broker and Apache Kafka (self managed)
>
> * **Bootstrap servers** (required): `host:port`, separated by commas for several.
> * **Security protocol**: PLAINTEXT, SSL, SASL\_PLAINTEXT or SASL\_SSL.
> * **SASL mechanism** when the protocol uses SASL: PLAIN, SCRAM-SHA-256, SCRAM-SHA-512, GSSAPI (Kerberos) or OAUTHBEARER.
>
> Depending on what you choose:
>
> * **TLS**: a CA certificate, and optionally a client certificate with its key and key password. A switch skips certificate verification. Use it only for testing, because it removes a safety check.
> * **PLAIN or SCRAM**: a SASL username and password.
> * **Kerberos**: principal, realm, a keytab file, an optional `krb5.conf`, and the service name (default `kafka`).
> * **OAUTHBEARER**: token endpoint URL, client ID, client secret and an optional scope.
> * **Schema Registry** (optional): its URL, and how to sign in to it: none, basic (username and password) or a bearer token.

> [accordion] Confluent Cloud
>
> * **Bootstrap server URL** (required): for example `pkc-abcd1.us-east-2.aws.confluent.cloud:9092`.
>
> **Authentication Method**, one of:
>
> * **API Key and Secret**: the Confluent API key (16 characters) and secret (32 to 64 characters).
> * **OAuth 2.0 / OIDC**: token endpoint URL (https), client ID, client secret and an optional scope.
>
> Optionally switch on **Schema Registry** and give its endpoint (https), API key and secret.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.