One-Device-One-Code Access
The code says which unit; the secret says it may enter. Enclosure QR / SN is identity only. DeviceSecret travels a secure channel. Activate once, MQTT with your own account.
Unlike one-type-one-secret, each unit has its own secret. Use when blast radius must stay per-device, or the factory prints per-unit labels.
Platform auth type: one_device_one_key. Field language often says “one device one code” — code ≠ secret; never put both on the same sticker.
| You care about | How the platform holds it |
|---|---|
| Shipping labels | Pre-register → factory print → activate |
| Small blast radius | DeviceSecret is per unit |
| Safe scanning | QR carries identity only |
1. Steps
- Product model = device auth
- Path A: admin-create device · Path B: pre-register → label → activate
- Deliver DeviceSecret securely; print only the unique code on the label
- Activate (
one_device_one_key) or finish pre-register activate - Store mqttAccount, connect gmqtt
- Check online; owned gateways may use mini-program scan
2. Flow
3. Operations
Path A — pre-register: model → pre-register ledger → factory labels → activate (device + MQTT appear only then).
Path B — already created: admin adds device with DeviceSecret; unit calls HTTP activate.
Owned-gateway scan flow: MQTT Gateway.
{
"system_identifier": "A2602280610",
"auth_type": "one_device_one_key",
"auth_data": {
"device_secret": "<DeviceSecret>"
},
"timestamp": 1710000000000
}
4. Pitfalls
| Symptom | Think first |
|---|---|
| Scan does nothing | Still pre-registered, not activated |
| Activate fails | Wrong DeviceSecret / identifier mismatch |
| Secret on the label | QR must not carry DeviceSecret |