diff --git a/lib/types/tunnelbroker/messages.js b/lib/types/tunnelbroker/messages.js
--- a/lib/types/tunnelbroker/messages.js
+++ b/lib/types/tunnelbroker/messages.js
@@ -43,6 +43,7 @@
 export const tunnelbrokerMessageTypes = Object.freeze({
   CONNECTION_INITIALIZATION_MESSAGE: 'ConnectionInitializationMessage',
   CONNECTION_INITIALIZATION_RESPONSE: 'ConnectionInitializationResponse',
+  ANONYMOUS_INITIALIZATION_MESSAGE: 'AnonymousInitializationMessage',
   MESSAGE_TO_DEVICE_REQUEST_STATUS: 'MessageToDeviceRequestStatus',
   MESSAGE_TO_DEVICE_REQUEST: 'MessageToDeviceRequest',
   MESSAGE_TO_DEVICE: 'MessageToDevice',
diff --git a/shared/tunnelbroker_messages/src/messages/message_to_device_request_status.rs b/shared/tunnelbroker_messages/src/messages/message_to_device_request_status.rs
--- a/shared/tunnelbroker_messages/src/messages/message_to_device_request_status.rs
+++ b/shared/tunnelbroker_messages/src/messages/message_to_device_request_status.rs
@@ -21,6 +21,8 @@
   /// The request was invalid (e.g., Bytes instead of Text).
   /// In this case, the ID cannot be retrieved.
   InvalidRequest,
+  /// Unauthenticated client tried to send a message.
+  Unauthenticated,
   /// The JSON could not be serialized, which is why the entire message is
   /// returned back.
   /// It becomes impossible to retrieve the message ID in such circumstances.
diff --git a/shared/tunnelbroker_messages/src/messages/mod.rs b/shared/tunnelbroker_messages/src/messages/mod.rs
--- a/shared/tunnelbroker_messages/src/messages/mod.rs
+++ b/shared/tunnelbroker_messages/src/messages/mod.rs
@@ -33,6 +33,7 @@
 pub enum Messages {
   ConnectionInitializationMessage(ConnectionInitializationMessage),
   ConnectionInitializationResponse(ConnectionInitializationResponse),
+  AnonymousInitializationMessage(AnonymousInitializationMessage),
   // MessageToDeviceRequestStatus must be placed before MessageToDeviceRequest.
   // This is due to serde's pattern matching behavior where it prioritizes
   // the first matching pattern it encounters.
diff --git a/shared/tunnelbroker_messages/src/messages/session.rs b/shared/tunnelbroker_messages/src/messages/session.rs
--- a/shared/tunnelbroker_messages/src/messages/session.rs
+++ b/shared/tunnelbroker_messages/src/messages/session.rs
@@ -43,6 +43,20 @@
   pub device_os: Option<String>,
 }
 
+/// Message sent by a client to Tunnelbroker to initiate unauthenticated
+/// websocket session. In contrast to [`ConnectionInitializationMessage`],
+/// Tunnelbroker won't validate access token, but session capabilities
+/// will be limited.
+#[derive(Serialize, Deserialize, Debug)]
+#[serde(tag = "type", rename_all = "camelCase")]
+pub struct AnonymousInitializationMessage {
+  #[serde(rename = "deviceID")]
+  pub device_id: String,
+  pub device_type: DeviceTypes,
+  pub device_app_version: Option<String>,
+  pub device_os: Option<String>,
+}
+
 #[cfg(test)]
 mod session_tests {
   use super::*;