# Provisioning

> Register devices, derive provisioning keys, and issue connectivity credentials.

Provisioning connects a physical or logical device to Infuse-IoT Cloud so it can authenticate and communicate with the platform.

Production provisioning is still usually API-led. Your backend, manufacturing system, gateway, or commissioning tool should own device creation, key derivation, credential handling, and persistence of returned identifiers.

The console helps with adjacent setup and operations: create boards, create networks, inspect devices after they exist, generate MQTT tokens, dispatch test commands, and review state. Do not use the console as the primary system of record for high-volume provisioning.

<note>

Authenticate provisioning backends with a personal or service-account API key exchanged for an `infuse-iot` token. See [Token Exchange](/docs/iam-and-access/token-exchange#call-the-infuse-iot-cloud-api). Legacy Infuse IoT admin keys are deprecated and being retired. Never expose API keys or tokens in browsers, mobile apps, firmware repositories, or customer-visible examples.

</note>

## Console-Assisted Setup

Before automating device registration, you can use the console to prepare or verify shared resources:

1. Open **Infuse IoT** > **API Access** and confirm the linked Infuse IoT organisation ID. It is the same value as your Infuse Platform organisation ID.
2. Open **Boards** and create the board profile if it does not already exist.
3. Open **Networks** and create the network if your deployment model requires one.
4. Use the API-led provisioning flow to create devices and derive key material.
5. Return to **Devices** to confirm the device appears and starts reporting state.

## Provisioning Flow

1. Use the organisation ID of the linked organisation that owns the API key. Read it with `GET /organisation/id/{id}` if you need to confirm it. Creating an organisation in the Infuse Portal also creates its linked Infuse-IoT Cloud organisation, so you do not create IoT organisations with the API.
2. Resolve or create the board profile with `GET /board` or `POST /board`.
3. Resolve or create a network with `GET /network` or `POST /network` if your deployment model uses networks.
4. Create the device with `POST /device`, including `mcuId`, `boardId`, `organisationId`, and any metadata you need for reconciliation.
5. Fetch the cloud public key with `GET /key/publicKey`.
6. Generate shared or derived device key material with `/key/sharedSecret` and `/key/derived/device`.
7. Generate an organisation-scoped MQTT token with `POST /mqtt/token` when your device or broker integration needs MQTT access.
8. Confirm the device can communicate by reading state or last-route data.

## Key Workflows

Infuse-IoT Cloud exposes key endpoints for secure provisioning and device communication:

<table>
<thead>
  <tr>
    <th>
      Task
    </th>
    
    <th>
      Endpoint
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Fetch current cloud public key
    </td>
    
    <td>
      <code>
        GET /key/publicKey
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Generate a shared secret from a device public key
    </td>
    
    <td>
      <code>
        POST /key/sharedSecret
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Derive a device encryption key
    </td>
    
    <td>
      <code>
        POST /key/derived/device
      </code>
    </td>
  </tr>
</tbody>
</table>

Keep key derivation and secret handling inside trusted backend or manufacturing systems. Device-specific credentials should be rotated if a device is replaced, reassigned, or exposed.

## Connectivity Credentials

Use `POST /mqtt/token` or **Infuse IoT** > **API Access** to issue a short-lived MQTT token scoped to the linked Infuse IoT organisation. The response includes the token, issue time, and expiry time.

MQTT tokens are not a replacement for long-term credential management. Issue them from a trusted backend for production integrations and respect the expiry time in device or gateway code.

## Related Endpoints

<table>
<thead>
  <tr>
    <th>
      Group
    </th>
    
    <th>
      Endpoint
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Organisations
    </td>
    
    <td>
      <code>
        GET /organisation
      </code>
      
      , <code>
        POST /organisation
      </code>
      
      , <code>
        GET /organisation/id/{id}
      </code>
      
      , <code>
        GET /organisation/name/{name}
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Boards
    </td>
    
    <td>
      <code>
        GET /board
      </code>
      
      , <code>
        POST /board
      </code>
      
      , <code>
        GET /board/id/{id}
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Networks
    </td>
    
    <td>
      <code>
        GET /network
      </code>
      
      , <code>
        POST /network
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Devices
    </td>
    
    <td>
      <code>
        POST /device
      </code>
      
      , <code>
        GET /device/deviceId/{deviceId}
      </code>
      
      , <code>
        GET /device/id/{id}
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Keys
    </td>
    
    <td>
      <code>
        GET /key/publicKey
      </code>
      
      , <code>
        POST /key/sharedSecret
      </code>
      
      , <code>
        POST /key/derived/device
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      MQTT
    </td>
    
    <td>
      <code>
        POST /mqtt/token
      </code>
    </td>
  </tr>
</tbody>
</table>

For a full sequence, see [Connect an IoT Device](/guides/iot/connect-a-device).