Credential Management

The Infuse-IoT Python tools handles credentials for:

• API Key Storage (for transactions with the Infuse-IoT Cloud endpoints)
• Network keys: For ePacket decryption

The profile and credentials subcommands manages storage of secrets for the package. They are thin wrappers over the Python keyring package.

The profile subcommand manages API Key Storage and custom tools and definitions.

> infuse profile --help
usage: infuse profile [-h] <command> ...

Manage Infuse-IoT profiles

options:
  -h, --help  show this help message and exit

profile commands:
  <command>
    list      List profiles
    configure
              Create or update a profile
    set       Set active profile
    dump      Dump profile configuration

The credentials subcommand now just manages network keys. It used to manage API Keys but is now deprecated in favour of the newer profile

> infuse credentials --help
usage: infuse credentials [-h] [--api-key API_KEY] [--api-key-print]
                          [--network NETWORK]
                          [--custom-tools CUSTOM_TOOLS]
                          [--custom-definitions CUSTOM_DEFINITIONS]

Manage Infuse-IoT credentials

options:
  -h, --help            show this help message and exit
  --api-key API_KEY     Set Infuse-IoT API key
  --api-key-print       Print Infuse-IoT API key
  --network NETWORK     Load network credentials from file
  --custom-tools CUSTOM_TOOLS
                        Location of custom tools
  --custom-definitions CUSTOM_DEFINITIONS
                        Location of custom definitions

API Key Management

An API key is required to interact with the Infuse-IoT cloud services, which includes generating the shared secrets required to run authenticated commands on devices (see Embedded Security Model ).

API Keys can be obtained by signing up for an account in the Infuse Portal. There are two types of API Keys that can be used with the Infuse Python Tools:

• Personal API Keys: For the same permissions you have.
• Service Account Keys: Useful for temporary access and/or scoped permissions.

However, these are scoped to a single organisation. As a result, multiple API Keys need to be generated if you access multiple organisations.

To accommodate multiple organisations, you will need to create separate profiles for each organisation using the profile subcommand.

infuse profile configure --name <profile_name> --api-key $API_KEY

To switch between different profiles, use the infuse profile set --name <profile_name> command.

To view the current API Key, use the infuse credentials --api-key-print argument.

Network Keys

To decode network encrypted packets, the base network key must be loaded into the credential manager. This only needs to be performed once per install.

infuse credentials --network /path/to/network_key.yaml

New network key files can be generated with the infuse-sdk/scripts/network_key_gen.py helper script from the embedded SDK.

Custom Content

The Python Tools come with the included standard set of definitions (for RPCs, TDFs and KV slots), and commands. However, your project may have and require customised definitions and scripts or tooling.

To avoid the need to setup the Python Tools in a developer mode and edit the Python Tools to integrate support, the Python tools can import these instead. The --custom-tools and --custom-definitions flags can each be used to specify a directory which contains the corresponding tools and definitions.

They can be added to a given profile with:

infuse profile --name <profile_name> --custom-definitions /path/to/custom/definitions
infuse profile --name <profile_name> --custom-tools /path/to/custom/tools