One-Type-One-Secret Access

Flash one product secret for the whole type. Devices check in over HTTP, get their own MQTT account, then open the long session. Less factory work; aim for first-pass.

Lingdian splits “prove the product” (HTTP activate) from “join the broker” (per-device mqttAccount). That split is what makes remote triage possible.

You care about	How the platform holds it
Fast production	Shared ProductKey / ProductSecret per type
Traceable sessions	Each unit gets its own mqttAccount on gmqtt
Keys stay in lane	ProductSecret is activate-only, never MQTT login

1. Steps

1. Create product model (device_auth), copy product cert
2. Create device (or pre-register → activate); confirm system_identifier
3. Burn ProductKey / ProductSecret / model into same-type firmware
4. Call activate (one_type_one_key)
5. Store mqttAccount, connect gmqtt, report by Topic
6. Verify online + dual-track logs

2. Flow

3. Operations

Platform

Product / gateway model → device auth → product cert for ProductKey / ProductSecret. Create the device first (or pre-register). No system_identifier on file → activate fails.

Factory

Burn shared secrets into firmware. Do not print ProductSecret on public QR labels.

Device activate

POST …/register/auth/authenticate

Request:

{
  "system_identifier": "<system_identifier>",
  "auth_type": "one_type_one_key",
  "auth_data": {
    "product_key": "<ProductKey>",
    "product_secret": "<ProductSecret>",
    "model_number": "<model_number>"
  },
  "timestamp": 1710000000000
}

Success response:

{
  "system_identifier": "<system_identifier>",
  "timestamp": 1710000000000,
  "mqttAccount": {
    "username": "<mqttUsername>",
    "password": "<mqttPassword>",
    "clientId": "<clientId>",
    "mqttHostUrl": "<broker-host>",
    "port": "<mqtt-port>",
    "ssl": true,
    "useSsl": true
  }
}

Field	Meaning
system_identifier	Device id; same as request
timestamp	Server response time
mqttAccount.username	MQTT username (not ProductSecret)
mqttAccount.password	MQTT password
mqttAccount.clientId	MQTT ClientId (usually device id)
mqttAccount.mqttHostUrl	Public broker host
mqttAccount.port	Public entry port (TLS on/off often same port)
mqttAccount.ssl / useSsl	Connect with TLS; synonyms — treat true as TLS

Keep only mqttAccount locally; honor ssl / useSsl, then talk to gmqtt.

4. Pitfalls

Symptom	Think first
Activate fails	Gateway ledger missing on platform, or no pre-registered device; system_identifier mismatch; wrong secret / model
MQTT rejected	Using ProductSecret as MQTT password; ssl / useSsl vs actual client mode
Whole type at risk	ProductSecret leaked — rotate + reflash

Next

One-Device-One-Code · MQTT Gateway · Architecture