Less setup for customers
Provision an individual device identity, then let customers approve access at a supported site without entering a Wi-Fi password.
- DEVICE / PROTECTED STATION
Generate the local key
Create a UUID-bound CSR. Retain the private key in protected storage.
CSR only → Enroll through the API - TRUSTED BACKEND
Enroll through the API
Use scoped credentials and retain the stable registry identifier.
Enroll scope → Issue the certificate - CERTIFICATE SERVICE
Issue the certificate
Sign the CSR and return the certificate, trust and reporting bundle.
Issued bundle → Install the profile - PER-UNIT INSTALLATION
Install the profile
Install certificate, CA, server identity checks and device reporting token.
Factory install → Power on and request - CUSTOMER SITE
Power on and request
Authenticate with the installed identity. Wait for business approval.
Read the diagram description
- DEVICE / PROTECTED STATION — Generate the local key. Create a UUID-bound CSR. Retain the private key in protected storage.CSR only → Enroll through the API.
- TRUSTED BACKEND — Enroll through the API. Use scoped credentials and retain the stable registry identifier.Enroll scope → Issue the certificate.
- CERTIFICATE SERVICE — Issue the certificate. Sign the CSR and return the certificate, trust and reporting bundle.Issued bundle → Install the profile.
- PER-UNIT INSTALLATION — Install the profile. Install certificate, CA, server identity checks and device reporting token.Factory install → Power on and request.
- CUSTOMER SITE — Power on and request. Authenticate with the installed identity. Wait for business approval.
From a development board to a repeatable deployment
Begin with a Linux/OpenWrt reference platform. Create a product, enroll a test device, install its credentials securely, and verify the first connection in the sandbox.
The dashboard groups products, batches, and devices. Your backend can use the same versioned API for enrollment, status, credential lifecycle, and explicit read-only provider delegation. Customer ownership transfer is outside the initial API.
Support with evidence
See whether a device is waiting for the business to approve it, has been denied, has authenticated successfully, or has stopped reporting. Connection state and application health are distinct.
A customer granting network permission does not give the manufacturer unrestricted visibility into that customer’s network or other devices.
What you integrate
Your device needs a supported Wi-Fi stack, EAP-TLS capability, secure private-key storage, reliable time handling, and the HotSpotVU connectivity adapter. Your manufacturing process must protect enrollment credentials and produce an identity for each unit.
The initial integration kit targets Python and Linux/OpenWrt. Embedded platforms need separate qualification. Device application firmware distribution is outside the initial service.
Evaluate before production
The sandbox allows ten devices and one explicitly authorized test site. Production review confirms supported hardware, expected behavior, service limits, and support arrangements.
Automatic connectivity applies to compatible, enrolled devices on explicitly enabled, supported sites with working Internet service. Local business permission is required.
Software implementation candidate. Physical router and device qualification is pending. IoT network features are disabled by default, and production activation is reviewed by HotSpotVU. Authorized sandbox trials use a bounded service-admin test window; this does not establish production qualification.