# Connectivity

> Issue MQTT tokens and understand CoAP file metadata for device workflows.

Infuse-IoT Cloud connectivity workflows include MQTT access tokens and CoAP-hosted file metadata. Use the console for development and operational token generation. Use the API when a backend service needs to issue tokens or inspect file availability automatically.

## MQTT Tokens

MQTT tokens are short-lived tokens scoped to an Infuse IoT organisation. They are useful for trusted clients, gateways, and development workflows that need MQTT access without exposing long-lived API keys.

Open **Infuse IoT** > **API Access** and select **Fetch Token** to generate a token for the linked Infuse IoT organisation. The console displays the token, issue time, expiry time, and a copy action.

Use `POST /mqtt/token` when a backend needs to generate tokens automatically. Authenticate with an `infuse-iot` token from [token exchange](/docs/iam-and-access/token-exchange#call-the-infuse-iot-cloud-api); the key owner needs the `iot.mqtt_tokens.create` permission. The request includes:

<table>
<thead>
  <tr>
    <th>
      Field
    </th>
    
    <th>
      Use
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        organisationId
      </code>
    </td>
    
    <td>
      Organisation the token is scoped to.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        ttlSeconds
      </code>
    </td>
    
    <td>
      Token lifetime, from 60 seconds to 86400 seconds.
    </td>
  </tr>
</tbody>
</table>

The response includes the token, `issuedAt`, and `expiresAt`.

Issue MQTT tokens from a trusted backend for production flows. Do not place long-lived API keys in device apps, customer browsers, or public code to let clients mint their own tokens.

## CoAP Files

The CoAP file endpoints expose file listing and file statistics for workflows that rely on files hosted through the CoAP server.

Application release detail pages in the console also show release file metadata such as CoAP path, file length, CRC, and diff length. Use that view when operators need to inspect release metadata without calling the API.

<table>
<thead>
  <tr>
    <th>
      Task
    </th>
    
    <th>
      Endpoint
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      List files
    </td>
    
    <td>
      <code>
        GET /coap/files
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Read file statistics
    </td>
    
    <td>
      <code>
        GET /coap/file/{filename}/stats
      </code>
    </td>
  </tr>
</tbody>
</table>

## Legacy Admin API Key

`POST /admin/apiKey` generates a legacy Infuse-IoT Cloud admin key. Legacy admin keys are deprecated and being retired; do not use them for new integrations.

Use a personal or service-account API key exchanged for an `infuse-iot` token instead. See [API Keys](/docs/iam-and-access/api-tokens#use-a-key-with-infuse-iot) and [Token Exchange](/docs/iam-and-access/token-exchange#call-the-infuse-iot-cloud-api).