Skip to content
Dialova

IRC Documentation · Advanced

AUTHENTICATE Command: Exchanging SASL Data

AUTHENTICATE carries a SASL exchange after the sasl capability is activated. This is not a command to type with a secret in a channel. The chosen mechanism defines the data, its meaning, and the prerequisites.

Dialova Team · Verified on

Syntax and Parameters #

Protocol syntax, without the client's '/'
AUTHENTICATE <mécanisme | données-base64 | + | *>
ParameterMeaning
MechanismFor example, PLAIN or EXTERNAL, if the server offers it.
base64-encoded dataMechanism response, split according to SASL IRC rules.
+ / *+ represents an empty response; * requests abandonment of the exchange.

Commented Example #

IRC Exchange: C = client, S = server
C: CAP REQ :sasl
S: :irc.example CAP Alice ACK :sasl
C: AUTHENTICATE EXTERNAL
S: AUTHENTICATE +
C: AUTHENTICATE +
S: :irc.example 903 Alice :SASL authentication successful
C: CAP END

Nicknames, hosts, and text in this exchange are fictional. The client may display responses in a more readable format than the presented frames.

Possible Responses and Errors #

ResponseUnderstanding
900 / 903Account connection information and successful SASL authentication according to the responses issued.
908List of mechanisms available in the usages defined by the specification.
ErrorTypical Cause
904SASL failure.
905Response too long.
906Exchange abandoned.
907Account already authenticated for an unauthorized use.

Rights, Compatibility, and Precautions #

This EXTERNAL example assumes a client certificate is accepted and associated with the account. It won't work simply because TLS is enabled: TLS first authenticates the server, and a client certificate is an additional configuration.

With PLAIN, the response contains authorization identity, authentication identity, and password separated by NUL bytes, then Base64 encoded. Base64 doesn't encrypt anything: use a validated TLS transport.

Encoded data chunks are limited to 400 bytes. If the total encoded length is an exact multiple of 400, an AUTHENTICATE+ indicates the end. Don’t send CAP END until consistent with the result or abandonment.

Frequently Asked Questions #

Does SASL always ask for my website password? No. Identifiers depend on the service. For Dialova, a dedicated IRC key is used.

Can I send an AUTHENTICATE in the middle of a conversation? Reauthentication depends on the server and SASL 3.2; it's not a universal way to hot-swap accounts.

Sources & Verification

Examples use pseudonyms and fictional domains, except for explicitly documented connection points. Network-specific extensions and settings are noted in the text.