I am building a small IoT platform. I have a webapp reading data from MongoDB. There is a worker that reads from MQTT and stores the data to mongo.
Until here, all good.
I want to be able to ship an agent to whatever device, be it a RaspberryPi or an Arduino Yún etc. The agent should read/send data from and to the MQTT broker.
Users need to register and add their device on my app before being able to do so. How do I handle authentication correctly? Do I allow anyone to add stuff to mqtt? Do I force devices to authenticate via HTTP on the app first, and then they can use the agent?
Do I go for public key or maybe token authentication? I don't understand therefore I am asking you.