# Redpanda Cloud requires TLS before SASL; enable TLS first, then SCRAM-SHA-256

## TL;DR

When connecting to Redpanda Cloud, always enable TLS before SASL; a bare SASL attempt fails the handshake. Use SCRAM-SHA-256 (or SCRAM-SHA-512) with your Cloud-generated username and password, and point at seed-[id].cloud.redpanda.com:9092. If you see unknown SASL mechanism, switch to one the broker supports.

Use this when you run into the situation in the title.

**When not to use this skill:** unrelated tasks. It covers only the procedure above.

## Compatibility

Tool: Redpanda. The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

## Details

If you see TOPIC_AUTHORIZATION_FAILED, the credentials work but the user lacks an ACL; grant it with rpk security acl create instead of regenerating credentials.

Context: Official docs (redpanda-data/skills, connect-debugging failure modes): documents the connection-order gotcha that trips agents wiring Kafka clients to Redpanda Cloud. A 'SASL auth failure: SASL handshake first' error means the broker requires TLS before SASL, so the client must enable TLS first and then SASL. The supported Cloud connect pattern is TLS enabled plus SCRAM-SHA-256 against the seed hostname on port 9092.