Identify

Once the IoT device is operational the IoT device first identifies and authenticates itself to the identity provider (IdP). Upon successful validation, the IdP issues an access token to the IoT device.

Identitfy & Authenticate

For an IoT device to identify and authenticate itself, it needs to provide a so-called private key JSON Web Token (JWT). A private key JWT is a base64 encoded JSON object that is composed of three main parts, a header, a payload, and a signature.

The header and the payload contain information to identify the device and protect the JWT from replay attacks. The signature is generated using the private key that corresponds to the registered public key of the device, ensuring the integrity of the token and allowing the IdP to authenticate the device. Here is an example of what a private key JWT may look like:

eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImRlbW8uZGV2aWNlLjAxIn0.eyJzdWIiOiJkZW1vLmRldmljZS4wMSIsImp0aSI6IkY0RkFFMUY1MUE5MzYwNEI1NTExMTI5NjVBNEY1NDY5In0.dwTVJp2DZEqO2yYOWXpkUfvMVZhMoVN37SQPJzyUDWQyHpHWMFn6CUQ4t4PQqgVRuoVgsrd1RFYUPDnppXLYKw

You can use a web tool to decode the above-displayed token. For additional information on how a JWT for device authentication is generated visit our Developer Guide

Issue Token

Upon successful validation of the private key JWT provided by the IoT device, the IdP issues an access token (AT) to the device. The access token is a so-called opaque token, which is basically a ~100-byte long random string that only the IdP that has issued the AT can verify. Here is an example of what an AT may look like:

eS5-1RxQcaI0dlCncxgymxt3cN9KWNLPOLHg1Kq3ILk.A9T_cVEH7f8flhYHfLIznAantnlkEAdzRo1jP64bs3A

The access token contains several claims such as the device ID, the requested scope, the issuer of the token, and has an application-specific lifetime. The AT must be securely stored and may be used to authenticate the IoT device against any protected API.