Device Provisioning

The full picture on creating devices and sensors, registering credentials, and what’s actually happening on the wire when a device connects. If you just want the fastest path from zero to a working device, see Getting Started — this guide goes deeper.

1. Create a device

From a project, go to Devices → New Device and give it a name. Then choose:

• Single sensor — the device itself acts as one sensor. You pick its sensor type and data direction right here.
• Multiple sensors — the device is just a container; sensors get added separately afterward (see below).

Sensor type and data direction are set once and can’t be changed later — this is deliberate, not a current limitation. A sensor’s identity is fixed at creation so that history and automations built against it stay meaningful.

2. Sensor types

• Telemetry — continuous numeric readings: temperature, humidity, voltage, CO₂, and similar.
• Binary — discrete on/off state: a relay, a door open/closed, a valve, motion detected.
• State — a multi-value state machine: HVAC mode (heating/cooling/idle), a machine cycle, anything with more than two meaningful values.

3. Data direction

• Send — the device sends data to the platform. Use this for read-only sensors like a temperature probe.
• Receive — the device receives commands from the platform. Use this for platform-controlled actuators.
• Exchange — the device both reports its state and can receive commands — a smart relay or valve that can also be triggered by an automation.

Telemetry sensors are always Send — a continuous reading has no meaningful “command” to receive, so Receive and Exchange aren’t offered for that type. Binary and State sensors can be any of the three.

4. Add sensors to a multi-sensor device

On a multi-sensor device’s page, Add Sensor opens the same Name / Type / Data Direction choices as above, one sensor at a time.

5. Register the device’s key

Devices authenticate with an EC (P-256) key pair. Only the public key is ever registered with Espoirnet — your private key should never leave the device.

Generate a key pair with OpenSSL:

openssl ecparam -name prime256v1 -genkey -noout -out private.pem
openssl ec -in private.pem -pubout -out public.pem

On the device’s page, open Register Key and paste in public.pem.

Or generate it in the browser: the same dialog has a Generate in Browser option, which creates the key pair for you and shows the private key once for you to save — only the public key is ever submitted.

Rotating a key: if a device’s key is compromised or you’re replacing hardware, use Rotate Key on the same card to register a new public key in place of the old one.

6. Test your credentials

Before wiring up real firmware, you can sanity-check a key pair using Test Authentication on the device’s page: paste a private key in the browser, and it mints a short-lived test JWT and validates it against the key currently registered for that device — confirming the pair actually matches before you go debug a device in the field.

7. MQTT identity and credentials

This is what a device SDK does for you automatically — useful if you’re debugging a connection or implementing a client directly against the wire protocol.

MQTT client ID / username	/{accountId}/{projectId}/{deviceId}
MQTT password	An ES256-signed JWT, described below

The JWT is signed with the device’s registered private key and carries:

Claim	Value
aud	rayon://{accountId}/{projectId}
sub	dev/{deviceId}
iat	Issued-at time
exp	Expiry — at most 24 hours after iat
jti	A random ID, unique per token

The platform verifies the signature against the public key you registered in step 5 — if it checks out, the connection is authenticated as that device.

Next steps

• Telemetry — publishing readings, batching, and querying data back out.
• Sending Commands — sending commands to a device and confirming they were applied.