Brokers

A broker is the MQTT server IoT Parrot connects to — the hub that routes every message between your hardware and your dashboards. Connect one in a couple of clicks with our managed broker, or point IoT Parrot at your own.

editWhere to set them up

Adding and editing brokers is done in the web app at app.iotparrot.com. The mobile apps are companions — they view dashboards and control widgets, but broker setup is web-only.

On this page

Choosing a broker
The managed broker
Bring your own broker
WebSocket & TLS in the browser
Credential security
Broker limits

Choosing a broker

When you add a broker, IoT Parrot shows a chooser dialog with two options. Pick whichever fits how you want to work:

IoT Parrot managed broker — no setup, we host it for you. The fastest way to get a device online, and the right pick if you're new to MQTT.
Bring your own (BYO) broker — more flexibility and higher limits. Point IoT Parrot at any MQTT broker you already run or host elsewhere.

New to MQTT and not sure what a broker even is? Start with MQTT basics, then come back here.

The managed broker

The managed broker is hosted by IoT Parrot — there's nothing to install, configure, or keep online. Choose it in the chooser dialog and you're connected. You get at most one managed broker per account, so once you've added it the managed option is disabled in the dialog.

The managed broker is reachable at:

Host: mqtt.iotparrot.com
TLS / TCP port: 8883 — for native MQTT clients such as ESP32/Arduino firmware.
Secure WebSocket port: 8084, path /mqtt — used by the web app in the browser.

lockTLS is required

The managed broker is TLS-only. There is no plain 1883 listener — your firmware must connect over TLS on port 8883. This keeps your credentials and payloads encrypted end to end.

Per-device credentials

The managed broker doesn't use one shared login. Instead, each managed device you create gets its own MQTT username and password, and its topics are namespaced per user and device:

u/{uid}/{deviceId}/<suffix>

That namespacing means one device can only publish and subscribe under its own prefix, so your devices stay isolated from each other. When you add a managed device, the app shows a copy-paste ESP32 firmware snippet preloaded with that device's TLS credentials — flash it and the device is talking to your dashboard.

devicesManaged devices are tier-capped

The number of devices you can put on the managed broker depends on your tier: Free 1, Hobby 3, Maker 5, Pro 10. (These are separate from your overall device limit — see Devices.)

groupManaged dashboards can't be shared

Because the managed broker issues per-device credentials that aren't handed out to other people, dashboards built on the managed broker cannot be shared. If you need to share a dashboard, put its devices on a bring-your-own broker instead — see Sharing.

Bring your own broker

Already run Mosquitto, EMQX, HiveMQ, or any other MQTT broker? Choose Bring your own and give IoT Parrot the connection details. This unlocks higher broker and device limits and lets you keep your existing infrastructure.

The BYO broker form has these fields:

name: A friendly label for the broker so you can tell it apart from others.
host: The broker's hostname or IP address, e.g. broker.example.com.
tcpPort: The MQTT TCP port. Default 1883; use 8883 when TLS is enabled. This is the port your firmware connects on.
webSocketPort: The WebSocket port. Default 8000. The web app connects over WebSocket, so your broker must expose a WebSocket listener on this port for the browser to reach it.
webSocketPath: The WebSocket path. Default /mqtt. Must match how your broker's WebSocket listener is configured.
username / password: Credentials for the broker. Leave them blank if your broker allows anonymous connections.
useTLS: Encrypt the connection. Defaults on for new brokers, and recommended — turn it off only for a trusted local broker with no TLS listener.

infoTwo ports, two clients

A BYO broker is reached two different ways: your firmware uses the TCP port (1883/8883), while the IoT Parrot web app uses the WebSocket port (8000 by default). Both listeners have to be enabled and reachable for everything to work end to end.

WebSocket & TLS in the browser

The single biggest gotcha with a bring-your-own broker is that the web app runs in a browser, and browsers can only speak MQTT over WebSocket — not raw TCP. A broker that only exposes the standard 1883/8883 TCP listeners will work for your firmware but won't connect from the web app.

warningBrowsers require WSS + a valid TLS cert

To connect from the web app, your BYO broker must expose a WebSocket listener (default port 8000, path /mqtt). If useTLS is on, the browser needs a secure WebSocket (WSS) backed by a valid, CA-signed TLS certificate. A self-signed certificate or a TCP-only broker will not connect from the browser. If you can't meet those requirements, use the managed broker instead.

If you're seeing a broker that connects from firmware but never comes online in the web app, this is almost always the cause — see Troubleshooting for a step-by-step check.

Credential security

Broker passwords are handled carefully. When you save a broker, its password is encrypted at rest (using Google Cloud KMS) before it's stored, and it is never sent back to the client in plaintext. The app fetches the decrypted password on demand only when it actually needs to open a connection.

keyYour passwords stay encrypted

Even you don't get to read a saved broker password back out of the app — if you forget it, re-enter it. This is deliberate: the plaintext never lives anywhere it could leak.

Broker limits

How many brokers you can connect depends on your tier:

Tier	Brokers
Free	1
Hobby	3
Maker	10
Pro	25

If you hit your cap, upgrade for more — see Account & billing. Once you've got a broker connected, the next step is to add a device on it.