Appearance
CreateDeviceTokenPayload
Type: Object
Result of creating a device token
Fields
| Name | Type | Args | Description | Deprecated |
|---|---|---|---|---|
| clientCertPem | String | Device client cert (PEM) signed by the tenant CA. Only returned on creation; not persisted. | ||
| clientKeyPem | String | Device private key (PKCS#8 PEM). Cloud-generated; only returned on creation; not persisted. | ||
| deviceToken | DeviceTokenState | The created token record | ||
| errors | [FieldError!]! | Validation errors if the operation failed | ||
| mqttClientId | String | Suggested MQTT client ID (the token ID). Not a credential: under mTLS the broker does not validate it, but MQTT requires one and a stable value keeps session state coherent across reconnects. | ||
| mqttUrl | String | MQTT broker URL for device connection (only returned on creation) | ||
| mqttUsername | String | The device ID, historically the MQTT username (only returned on creation) | Unread on the mTLS path, which is the only one the broker accepts — the connecting identity comes from the certificate's URI SAN. The device ID itself is on deviceToken.deviceId. removal:2027-03-18 | |
| serverCaCertPem | String | Platform server CA cert (PEM). Trust root for verifying broker / edge listener certs. | ||
| tenantCaCertPem | String | Tenant CA cert (PEM) that signed the device's leaf. | ||
| token | String | The signed token value, historically the MQTT password (only returned on creation) | The broker is mTLS-only, so this is never read: a client that presents no certificate fails the TLS handshake, and one that does is authenticated from its certificate without the bearer path running. Use clientCertPem / clientKeyPem with serverCaCertPem instead. removal:2027-03-18 |