Secure fleet provisioning and credentials

Registration is not physical provisioning

Each new device receives cryptographically random, independent root and bootstrap secrets, encrypted with the existing server credential key. Registration does not prove the device has been flashed or claimed. Inventory distinguishes Registered, Manifest exported and current credentials verified by committed telemetry. Rotating credentials clears this verification until the new credential epoch sends a valid packet; historical device activity remains.

Use the existing per-device Setup / SDK guide to generate a complete starter. Manufacturing jobs also offer an explicitly confirmed private JSON manifest for at most 100 completed devices from the current result page. The requesting job owner/admin can retrieve each credential epoch once through this bulk workflow. Ordinary inventory and CSV reports contain no secrets.

Protect the private manifest

The private manifest contains rootSecret and bootstrapToken. Download over your authenticated session, store offline securely, restrict factory access and remove temporary plaintext copies after provisioning. Never commit it to Git, put it in a URL or log it.

A consumed bootstrap token cannot be exported through the manufacturing manifest. If the download is lost, use the separately authorized per-device SDK workflow or deliberately reprovision; the UI does not promise recoverable one-time downloads. A manifest export is not evidence that a physical device applied it.

Manual reprovisioning and offline devices

Reprovisioning keeps the database device UUID, allocates a new wire ID/credential epoch and immediately revokes all old credentials with zero grace. The device must be manually updated with the new SDK configuration, root and bootstrap token before it can transmit again. Existing immutable schema slots remain.

There is no seamless remote credential-rotation command in Secure V2. An offline device remains offline until updated. Old keys do not remain as an indefinite fallback; sequence counters belong to the new wire epoch, and replay protection is preserved. Revoked/archived records cannot be reprovisioned.

Previously committed telemetry and downstream queue entries are not removed by disable, revoke or reprovisioning. A commit receipt still means durable ingestion, not downstream webhook success.