A station, typically the end-of-line test PC, creates the machine on Things5, obtains its certificate and loads it onto the device over USB, serial or Bluetooth. The manufacturer builds the loading channel.

Use this flow when volumes make manual entry impractical or the device has no user interface; otherwise prefer the pairing code. Even when you provision from a station, also supporting the pairing code in the firmware lets you restore a device in the field without sending it back to the factory.

One-time setup

1. The organization creates a machine group called Testing (see Groups).
2. An organization administrator creates an API integration for the station (Administration → API integrations), one per station, and copies the client_id and secret to the station. The secret is shown only once.
3. The administrator assigns the integration the Provisioning role (create machines and generate certificates) on the Testing group only.

For each machine

1. The station gets an access token from the Things5 authentication service with the client_credentials grant. The token is valid for 5 minutes and has no refresh token: when it expires, request a new one.

   HTTP

   POST https://auth.things5.digital/auth/realms/{realm-id}/protocol/openid-connect/token
   Content-Type: application/x-www-form-urlencoded
   
   grant_type=client_credentials&client_id={client_id}&client_secret={secret}
   

   Send the access_token as Authorization: Bearer <access_token>. See General parameters for your realm-id.

2. Create the machine in the Testing group with Device create (POST /v1/devices with machines_group_id).

3. Generate the certificate with Device provisioning V2 (PUT /v1/devices/{id}/regenerate_certs_v2) and load it onto the device.

4. Once testing is complete, a user moves the machine to its destination group.

Why it is secure

• The station's secret only allows API access, and only to machines still in testing: it gives no access to the user interface or to other machines' data.
• It is not tied to a person: it does not stop working when someone changes their password or leaves the company, and it is compatible with mandatory 2FA for users.
• It can be revoked or rotated per station, with immediate effect.
• In the activity history, operations are attributed to the station, not to a person.

Watch out

❗️

Do not let the station move machines into destination groups

It could move an already delivered machine back to Testing and regenerate its certificate, disconnecting it.

❗️

The integration secret stays on the station

Load only the machine's certificate, private key and CA certificate onto the device. Never the integration's client_id and secret, and never an access token, not even temporarily.

🚧

Protect the station

Restrict access to it, never share a secret between stations, and delete the certificate files as soon as they have been loaded onto the device.

The Provisioning role is a regular role and you can modify it. If you use a person's credentials on the station instead of an API integration, you are responsible for that choice.