MQTT

Messaging Broker and credentials Windmill docs

Subscribe to MQTT topics and run a script on every incoming message.

Set up in 3 steps

You need the broker's host and port, and the username and password if it requires them. Note whether it expects TLS — hosted brokers usually do.

Open Resources, add a resource of type mqtt, and fill broker, port, tls and credentials.

Create an MQTT trigger, point it at the resource, and list the topics it should subscribe to. Every matching message runs the script you chose.

MQTT is not only a destination. These inbound paths are supported today.

Windmill holds the subscription open and starts a run per message, with the payload and topic as inputs.

The shape of the credential every script on this page expects.

Field	Type	Required	What it is
broker	string	Yes	The hostname or IP address of the MQTT broker
port	integer	Yes	The port number for the MQTT broker connection
credentials	object	No	Authentication credentials for the MQTT broker
tls	object	No	TLS/SSL configuration for secure connections. For standard TLS, only the 'enabled' property needs to be set to true. For mutual TLS (mTLS) with client authentication, the CA certificate, client certificate, and certificate password are also required.

The connection drops or is refused

Usually the TLS setting or the port. A broker listening on 8883 expects TLS; 1883 is the plain port.

Are my credentials stored on the hub?

Never. They live only in your own Windmill workspace, encrypted at rest.