uint8_t BLESecurity::m_authReq = 0;
...
void BLESecurity::setAuthenticationMode(uint8_t auth_req) {
 log_d("setAuthenticationMode: auth_req=%d", auth_req);
 m_authReq = auth_req;
#if defined(CONFIG_BLUEDROID_ENABLED)
 esp_ble_gap_set_security_param(ESP_BLE_SM_AUTHEN_REQ_MODE, &m_authReq, sizeof(uint8_t));
#elif defined(CONFIG_NIMBLE_ENABLED)
 BLESecurity::setAuthenticationMode(
 (auth_req & BLE_SM_PAIR_AUTHREQ_BOND) != 0, (auth_req & BLE_SM_PAIR_AUTHREQ_MITM) != 0, (auth_req & BLE_SM_PAIR_AUTHREQ_SC) != 0
 );
#endif
}

void loop() {
 while (Serial.available()) {
 char c=Serial.read();
 if (c>=32) Serial.write(c);
 else Serial.println();
 if (c=='d') show_bonded_devices();
 if (c=='e') remove_all_bonded_devices();
 }
 delay(100);
}
char bda_str[18];
char *bda2str(const uint8_t *bda) {
 sprintf(bda_str, "%02x:%02x:%02x:%02x:%02x:%02x", bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
 return bda_str;
}
void show_bonded_devices() { 
 int dev_num = esp_ble_get_bond_device_num();
 esp_ble_bond_dev_t *dev_list = (esp_ble_bond_dev_t *)malloc(sizeof(esp_ble_bond_dev_t) * dev_num);
 esp_ble_get_bond_device_list(&dev_num, dev_list);
 Serial.printf("\nBonded devices number: %d\n", dev_num);
 for (int i = 0; i < dev_num; i++) {Serial.printf("Found bonded device #%d = %s\n", i+1, bda2str(dev_list[i].bd_addr));}
 free(dev_list);
}
void remove_all_bonded_devices() { // static void __attribute__((unused)) remove_all_bonded_devices(void) {
 Serial.println("\nRemoving all bonded devices...");
 int dev_num = esp_ble_get_bond_device_num();
 esp_ble_bond_dev_t *dev_list = (esp_ble_bond_dev_t *)malloc(sizeof(esp_ble_bond_dev_t) * dev_num);
 esp_ble_get_bond_device_list(&dev_num, dev_list);
 for (int i = 0; i < dev_num; i++) esp_ble_remove_bond_device(dev_list[i].bd_addr);
 free(dev_list);
}

/*
 Secure server with static passkey using Bluedroid (used on the ESP32) 
 This example demonstrates how to create a secure BLE server using a static passkey on the ESP32 (Bluedroid).
 Note that ESP32 uses Bluedroid by default and the other SoCs use NimBLE.
 Bluedroid initiates security on-connect, while NimBLE initiates security on-demand.
 This means that in NimBLE you can read the unsecure characteristic without entering
 the passkey. This is not possible in Bluedroid.
 Also, the SoC stores the authentication info in the NVS memory. After a successful
 connection it is possible that a passkey change will be ineffective.
 To avoid this, clear the memory of the SoC's between security tests.
 Based on examples from Neil Kolban and h2zero and lucasssvaz 
 Created by Rob58329
*/
#if !defined(CONFIG_BLUEDROID_ENABLED)
 #error "This will only compile on Bluedroid based devices such as the ESP32 (ie. not the ESP32S3 etc)"
#endif
#include <BLEDevice.h>
#include <BLEServer.h>
BLEServer *pServer=nullptr;
uint32_t BLE_PASSKEY=123456; // for BLE must be exactly 6 digits long! // once bonded passkey is n/a (can be changed without effecting bonded devices) 
volatile boolean BLE_connected=false;
volatile boolean BLE_security=false;
class MySecurityCallbacks : public BLESecurityCallbacks {
 //bool onConfirmPIN(uint32_t pin) {Serial.printf("onConfirmPIN=%u\n",pin); return (pin==BLE_PASSKEY);}
 //uint32_t onPassKeyRequest() {Serial.println("onPassKeyRequest"); return BLE_PASSKEY;}
 void onPassKeyNotify(uint32_t pass_key) {Serial.printf("onPassKeyNotify=%u\n", pass_key);}
 bool onSecurityRequest() {Serial.println("onSecurityRequest"); return true;}
 void onAuthenticationComplete(esp_ble_auth_cmpl_t cmpl) {Serial.printf("Auth %s\n",cmpl.success ? "OK" : "FAIL"); BLE_security=(cmpl.success);}
};
class MyServerCallbacks : public BLEServerCallbacks {
 void onConnect(BLEServer *pServer) {BLE_connected=true; Serial.printf("Device connected (ID=%u)\n",pServer->getConnId());}
 void onDisconnect(BLEServer *pServer) {BLE_connected=false; BLE_security=false; Serial.println("Device Disconnected");}
};
// After BLE_connected allow 1s for BLE_security to change/succeed, and if it doesn't disconnect the BLE-client.
// If you want to allow PAIRING all the time, set change the above to "DISCONNECT_TIMER 15000".
// But note that I beleive that there is a bug in the "Bluedroid" software that after reboot it will only give you the
// prompt to enter a PIN the 1st time you try to connect, and if you fail to enter the correct PIN the 1st time, it
// will disconnect you, but subsequently will allow you to connect but not go through any securuty-authentication.
// This means if you fail to enter the correct PIN the 1st time, you have to reboot the ESP32 or do
// a BLEDevice::de/reinit before you can try again.
// It also means that a few seconds after any connection you need to check to see if BLE_security has succeeded
// and if not disconnect the Client - see the below example. 
#define DISCONNECT_TIMER 1000 // 1s // increase this to 2s if necessary
#define DISCONNECT_TIMER_PAIRING 15000 // 15s
uint32_t disconnect_timer=DISCONNECT_TIMER;
boolean BLE_secured_connection() {
 static uint32_t millis_disconnect=0;
 if (BLE_security or !BLE_connected) millis_disconnect=0;
 else if (millis_disconnect) {if (millis_disconnect<=millis() and (pServer)) pServer->disconnect(pServer->getConnId());}
 else {millis_disconnect=millis()+disconnect_timer; Serial.println("Start connect timer (1 or 15s)"); disconnect_timer=DISCONNECT_TIMER;} 
 return BLE_security;
}
 
void setup() {
 Serial.begin(115200); delay(2999);
 Serial.printf("ESP_ARDUINO=v%s\n",ESP_ARDUINO_VERSION_STR); // ESP_ARDUINO=v3.3.0
 Serial.println("Starting BLE work!");
 Serial.print("Using BLE stack: "); Serial.println(BLEDevice::getBLEStackString()); // Using BLE stack: Bluedroid // defined(CONFIG_BLUEDROID_ENABLED)
 Serial.println("BLEDevice::init...");
 BLEDevice::init("Secure BLE Client");
 BLEDevice::setSecurityCallbacks(new MySecurityCallbacks());
 pServer = BLEDevice::createServer(); // BLEServer * 
 pServer->advertiseOnDisconnect(true);
 pServer->setCallbacks(new MyServerCallbacks());
 BLEAdvertising *pAdvertising = pServer->getAdvertising();
 pAdvertising->start();
 BLESecurity *pSecurity = new BLESecurity();
 pSecurity->setCapability(ESP_IO_CAP_OUT); // Not sure if this is necessary?
 pSecurity->setPassKey(true,BLE_PASSKEY); 
 pSecurity->setAuthenticationMode(true,false,false);
 pSecurity->setAuthenticationMode(ESP_LE_AUTH_REQ_SC_MITM_BOND); // override the "setAuthenticationMode(true,0,0);" // Not sure if this is necessary?
 BLESecurity::setEncryptionLevel(ESP_BLE_SEC_ENCRYPT); // Not sure if this is necessary?
 uint8_t auth_option = ESP_BLE_ONLY_ACCEPT_SPECIFIED_AUTH_ENABLE; // essential to stop Clients with No-PIN connecting
 esp_ble_gap_set_security_param(ESP_BLE_SM_ONLY_ACCEPT_SPECIFIED_SEC_AUTH, &auth_option, sizeof(uint8_t));
 pSecurity->setInitEncryptionKey(ESP_BLE_ENC_KEY_MASK | ESP_BLE_ID_KEY_MASK); // Not sure if this is necessary?
 pSecurity->setRespEncryptionKey(ESP_BLE_ENC_KEY_MASK | ESP_BLE_ID_KEY_MASK); // Not sure if this is necessary?
 Serial.println("BLE Started. You can now connect from your phone");
 Serial.println("Serial Commands: b=Initiate Bonding, d=Display Bonds, e=Erase All-Bonds"); 
}
void loop() { 
 boolean secure=BLE_secured_connection();
 static boolean secure_old=false; if (secure_old!=secure) {secure_old=secure; Serial.printf("**Secure Connection=%u\n",secure);} 
 delay(100);
 while (Serial.available()) {
 char c=Serial.read();
 if (c>=32) Serial.write(c);
 else Serial.println();
 if (c=='b') {
 disconnect_timer=DISCONNECT_TIMER_PAIRING;
 Serial.println("\nSet disconnect_timer=15s (NB. you need to do this BEFORE to try to PAIR,\notherwise do a reboot or BLEDevice::de/reinit and try again)");
 }
 if (c=='d') show_bonded_devices();
 if (c=='e') remove_all_bonded_devices();
 }
}
char bda_str[18];
char *bda2str(const uint8_t *bda) {
 sprintf(bda_str, "%02x:%02x:%02x:%02x:%02x:%02x", bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
 return bda_str;
}
void show_bonded_devices() { 
 int dev_num = esp_ble_get_bond_device_num();
 esp_ble_bond_dev_t *dev_list = (esp_ble_bond_dev_t *)malloc(sizeof(esp_ble_bond_dev_t) * dev_num);
 esp_ble_get_bond_device_list(&dev_num, dev_list);
 Serial.printf("\nBonded devices number: %d\n", dev_num);
 for (int i = 0; i < dev_num; i++) {Serial.printf("Found bonded device #%d = %s\n", i+1, bda2str(dev_list[i].bd_addr));}
 free(dev_list);
}
void remove_all_bonded_devices() {
 Serial.println("\nRemoving all bonded devices");
 int dev_num = esp_ble_get_bond_device_num();
 esp_ble_bond_dev_t *dev_list = (esp_ble_bond_dev_t *)malloc(sizeof(esp_ble_bond_dev_t) * dev_num);
 esp_ble_get_bond_device_list(&dev_num, dev_list);
 for (int i = 0; i < dev_num; i++) esp_ble_remove_bond_device(dev_list[i].bd_addr);
 free(dev_list);
}