RabbitMQ: ACCESS_REFUSED - Login was refused using authentication mechanism

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

# The broker log says which user and why
sudo journalctl -u rabbitmq-server | grep -i "access_refused\|invalid credentials" | tail

# List users and what each may do on each vhost
sudo rabbitmqctl list_users
sudo rabbitmqctl list_permissions -p /

# Create a real user instead of relying on guest
sudo rabbitmqctl add_user app "$(openssl rand -hex 16)"
sudo rabbitmqctl set_permissions -p / app ".*" ".*" ".*"

# The default vhost "/" must be URL-encoded in connection strings
# amqp://app:secret@rabbit:5672/%2F

# Check the credentials directly
sudo rabbitmqctl authenticate_user app "secret"

How to diagnose MessageQueue errors

Queue errors are usually about the balance between producers and consumers. Growing lag means consumers cannot keep up. Endless rebalancing usually means consumers are being evicted for exceeding a poll or heartbeat interval, not that the cluster is unhealthy. A poison message, one that always fails processing, will block an ordered partition forever unless there is a dead-letter path, which is why a DLQ is not optional in production.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

1. Measure lag over time, not once: kafka-consumer-groups --describe --group <g>. The trend distinguishes a throughput problem from a stuck consumer.
2. For repeated rebalancing, compare processing time per batch against max.poll.interval.ms. Slow processing looks exactly like a dead consumer to the coordinator.
3. Always configure a dead-letter queue with a bounded retry count. Without one, a single malformed message stops the partition indefinitely.
4. Check message size against the broker limit before assuming a network failure: SQS caps at 256 KB, Kafka at message.max.bytes.
5. Verify consumer ACLs and topic authorisation separately from connectivity; an authorisation failure often surfaces as a metadata error.

Tools worth reaching for

• kafka-consumer-groups
• rabbitmqctl list_queues
• aws sqs get-queue-attributes
• kafkacat / kcat
• flower (Celery)

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

📖 rabbitmq.com 📖 rabbitmq.com

Related MessageQueue errors

• AWS SQS: Message too large (256KB limit)The SQS message body exceeds the 256KB maximum size limit.
• AWS SQS: The specified queue does not exist or you do not have access to itSQS gives the same answer whether the queue is missing or you lack permission, so you cannot…
• Celery: Received unregistered task of type 'myapp.tasks.send_email'The worker took a message off the queue but has never imported the module that defines the…
• Celery: WorkerLostErrorA Celery worker process died unexpectedly during task execution, often due to OOM kill…
• Connection to node -1 could not be established. Broker may not be available.Node -1 is the bootstrap server, so the client could not even make its first connection. If…
• Kafka: LEADER_NOT_AVAILABLEPartition has no elected leader. Broker down, ISR empty, or topic just created and metadata…
• Kafka: Offset out of rangeConsumer trying to read from offset that doesn't exist. Data retention deleted old messages.
• Kafka: RecordTooLargeExceptionA message exceeded a size limit. Three separate limits must agree: the producer's…

See all 20 MessageQueue errors →

Browse other categories

• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.