Security

A short list of what is safe to share and what must stay secret.

Safe to share

• deviceId — public. It only lets someone call a service (and pay for paid ones). It cannot reach the device transport.
• serviceId — public. Returned by discovery.

Keep private

• connectorId — the MQTT transport identity. All device topics are keyed by it. Never returned by any public/agent route; returned only to the authenticated owner. Treat it like a secret and never paste it into agent prompts, logs, or client-side code.
• API key — shown once at creation. The device uses it to authenticate its replies. Only the SHA-256 hash is stored; rotate if leaked.
• Access password — for password-protected services. Only a hash is stored; it is never returned by any endpoint.
• Payout wallet — the recipient address is configuration, not returned by public discovery.

Why the public/private split matters

Separating the public deviceId from the private connectorId means the identifier agents see (and that appears in URLs, logs, and discovery) is decoupled from the one that can talk to the hardware. A leaked deviceId lets someone call your services — which is the whole point — but never lets them impersonate the device, publish to its command topic, or eavesdrop on its replies. The server is the only party that maps public id → private connectorId.