nRF9161 Cloud Auto-Provisioning / Onboarding

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

Monkeytronics — Sat, 28 Mar 2026 03:41:45 GMT

I would like to have a go at enabling auto onboarding for my nrf9151 based product. What are the chances that the documentation you promised above is ready. It's been over a year - presumably long enough to document this process as a step by step fool-proof process?

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

Charlie — Fri, 10 Jan 2025 08:49:32 GMT

Hi Neil,

I checked with our nRF Cloud team to confirm whether there could be any differences between the FREE and Pro Plans, but the answer is no. To verify further, I created a new Free Plan account and repeated the steps in https://devzone.nordicsemi.com/support-private/support/336139#permalink=1017931. I did not encounter any errors in the logs.

I suspect there might be an issue with your account. Could you try creating a new account and testing again to confirm?

Best regards,

Charlie

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

nrao32 — Thu, 09 Jan 2025 04:58:23 GMT

Hi Charlie. The nRF Cloud validator says that my JWT is valid and it's also able to give me the device ID from the JWT, but the nRF Cloud does not allow my device to execute any location APIs. The service eval token works however but I'm already 1/3 of the way through that trial and as you said is not recommended. I will try upgrading to the Pro plan and see if that resolves the issue with the nRF Cloud, but I was hoping to stay on the free tier during development. Let me see if the Pro plan fixes it. Thanks.

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

Charlie — Wed, 08 Jan 2025 09:24:14 GMT

Hi Neil,

The Service Evaluation Token is only valid for 30 days. It is not recommended to use it for your product, even for development purposes.

The JWT is automatically set up if you follow the steps provided in this discussion: https://devzone.nordicsemi.com/support-private/support/336139#permalink=1017931, but this feature requires a Pro plan.

I apologize for the lack of proper documentation on this matter. I will inform our nRF Cloud team to improve this section of the documentation.

Best regards,

Charlie

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

nrao32 — Mon, 30 Dec 2024 20:17:56 GMT

Update - I found this nRF Location Services evaluation thing in the Teams page: https://nrfcloud.com/#/teams

Using that token worked! However, this is not ideal, since obviously I don't want to use the same token for every device, and would rather have the device authenticate itself instead. However the device's JWT still returns error 40100 which on the docs says "Access denied error. The user making the request does not have access to the requested resource (device, SIM, invitation, etc.). Confirm your authorization is correct."

So, at least I'm unblocked for development, but not a viable option for production. Is this just because I'm on the developer plan? Do I need to upgrade to the pro plan to be able to authorize the devices themselves?

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

nrao32 — Mon, 30 Dec 2024 19:58:31 GMT

Hi Charlie, I was able to get my device provisioned:

I was also able to claim it:

However, I still get errors when trying to use nRF Cloud services like the location API:

[00:00:18.741,577] <err> nrf_cloud_codec_internal: REST error msg: Invalid JWT
[00:00:18.751,831] <err> nrf_cloud_rest: nRF Cloud REST error code: 40100
[00:00:18.761,627] <err> dev: Failed to send P-GPS request, error: -77

I looked up error code 40100:

nRF Cloud REST API Documentation

Looks to be an authorization issue, not an authentication issue (I validated that the JWT token is valid now):

I might be missing some kind of auth permission. How do I allow my device to access nRF cloud services?

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

Charlie — Wed, 27 Nov 2024 10:50:42 GMT

Could you try recording a modem trace from the device? The instructions for enabling and capturing modem traces can be found here: Modem Trace Guide.

This trace will help us better understand what might be causing the issues. Please also share the logs captured simultaneously, as they will provide additional context for the analysis.

Let me know if you have any questions or run into any difficulties while capturing the trace and logs. I’m happy to assist further.

Best regards,

Charlie

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

nrao32 — Sat, 23 Nov 2024 21:51:18 GMT

Hi Charlie, I am using a developer account. However, I should be well within the free tier limits since I am merely trying to provision a device. This is the original, unmodified sample.

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

Charlie — Thu, 21 Nov 2024 13:50:47 GMT

Hi,

I mean to test with the unmodified sample located in v2.8.0/nrf/samples/cellular/nrf_cloud_multi_service. If you confirm it is original sample, then we can exclude this cause.

Are you using an free developer account with nRF Cloud? Pay attention that there are limitations for device and service usage.

Best regards,

Charlie

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

nrao32 — Wed, 20 Nov 2024 14:32:07 GMT

Can you please elaborate what you mean by original NCS 2.8.0 cellular multi service sample? I'm running an unmodified sample.

My DK came with an Onomondo SIM. I've also tried to use an IoT DataWorks SIM which uses AT&T. I was able to confirm Internet connectivity on it.

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

Charlie — Wed, 20 Nov 2024 08:03:31 GMT

No, I have only used the original nRF9161DK, specifically version v0.9.1. However, every version of the nRF9161DK released within the past year should work, as there have not been any significant changes.

Did you also encounter the message "<err> spi_nor: Device id 00 00 00 does not match config c8 65 19" when testing with the original NCS 2.8.0 Cellular: nRF Cloud multi-service? I believe this should not impact the auto-provisioning process.

Which network operator are you using? Please ensure that you have sufficient data available for your subscription. You can simply verify network connectivity and data access using the Serial LTE modem ping command.

Best regards,

Charlie

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

nrao32 — Wed, 20 Nov 2024 02:29:13 GMT

Hi Charlie, I imagine I need to set up external flash in order for this to work, based on the first few logs I see. Can you elaborate on what component you had to buy and how you wired it to the nRF9161 DK?

*** Booting My Application v2.1.0-dev-4594a8693738 ***
*** Using nRF Connect SDK v2.8.0-a2386bfc8401 ***
*** Using Zephyr OS v3.7.99-0bc3393fb112 ***
I: Starting bootloader
I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Boot source: none
I: Image index: 0, Swap type: none
I: Bootloader chainload address offset: 0x18000
I: Jumping to the first image slot
[00:00:00.255,065] <err> spi_nor: Device id 00 00 00 does not match config c8 65 19
*** Booting nRF Connect SDK v2.8.0-a2386bfc8401 ***
*** Using Zephyr OS v3.7.99-0bc3393fb112 ***
[00:00:00.259,857] <inf> main: nRF Cloud multi-service sample has started, version: 1.0.0, protocol: MQTT
[00:00:00.259,887] <inf> application: Reset reason: 0x10001
[00:00:00.260,162] <inf> cloud_connection: Enabling connectivity...
[00:00:00.547,851] <inf> cloud_connection: Setting up nRF Cloud library...
[00:00:00.636,047] <inf> nrf_cloud_info: Device ID: 5033475<HIDDEN>917c
[00:00:00.636,596] <inf> nrf_cloud_info: IMEI:      35<HIDDEN>48
[00:00:00.722,473] <inf> nrf_cloud_info: UUID:      503<HIDDEN>17c
[00:00:00.722,961] <inf> nrf_cloud_info: Modem FW:  mfw_nrf91x1_2.0.1
[00:00:00.722,991] <inf> nrf_cloud_info: Protocol:          MQTT
[00:00:00.723,052] <inf> nrf_cloud_info: Download protocol: HTTPS
[00:00:00.723,052] <inf> nrf_cloud_info: Sec tag:           16842753
[00:00:00.723,083] <inf> nrf_cloud_info: Host name:         mqtt.nrfcloud.com
[00:00:00.823,089] <inf> nrf_cloud_credentials: Sec Tag: 16842753; CA: Yes, Client Cert: Yes, Private Key: Yes
[00:00:00.823,150] <inf> nrf_cloud_credentials: CA Size: 1188, AWS: Likely, CoAP: Unlikely
[00:00:00.823,181] <inf> cloud_connection: Waiting for network ready...
[00:00:11.632,110] <inf> cloud_connection: Network connectivity gained!
[00:00:12.632,385] <inf> cloud_provisioning: Initializing the nRF Provisioning library...
[00:00:12.632,568] <inf> cloud_connection: Network is ready
[00:00:12.671,844] <inf> nrf_provisioning: Checking for provisioning commands in 4s seconds
[00:00:16.671,966] <inf> cloud_provisioning: Provisioning is active.
[00:00:16.773,895] <inf> nrf_provisioning_http: Requesting commands
[00:00:19.105,072] <inf> nrf_provisioning_http: Connected
[00:00:19.105,102] <inf> nrf_provisioning_http: No more commands to process on server side
[00:00:19.105,194] <inf> nrf_provisioning: Checking for provisioning commands in 62s seconds
[00:00:24.105,224] <inf> cloud_provisioning: Provisioning is idle.
[00:00:24.105,285] <inf> cloud_connection: Connecting to nRF Cloud
[00:00:28.411,865] <err> nrf_cloud_transport: MQTT input error: -128
[00:00:28.411,926] <err> nrf_cloud_transport: Error disconnecting from cloud: -128
[00:00:28.411,956] <inf> cloud_connection: Disconnecting from nRF Cloud
[00:00:28.411,987] <err> cloud_connection: Could not connect to nRF Cloud
[00:00:28.412,017] <inf> cloud_connection: Retrying in 30 seconds...
[00:00:58.412,139] <inf> cloud_connection: Waiting for network ready...
[00:00:58.412,170] <inf> cloud_connection: Network is ready
[00:00:58.412,170] <inf> cloud_connection: Connecting to nRF Cloud
[00:01:03.047,119] <err> nrf_cloud_transport: MQTT input error: -128
[00:01:03.047,210] <err> nrf_cloud_transport: Error disconnecting from cloud: -128
[00:01:03.047,241] <inf> cloud_connection: Disconnecting from nRF Cloud
[00:01:03.047,271] <err> cloud_connection: Could not connect to nRF Cloud
[00:01:03.047,302] <inf> cloud_connection: Retrying in 30 seconds...
[00:01:21.105,316] <inf> cloud_provisioning: Provisioning is active.
[00:01:21.207,336] <inf> nrf_provisioning_http: Requesting commands
[00:01:23.649,322] <inf> nrf_provisioning_http: Connected
[00:01:23.649,353] <inf> nrf_provisioning_http: No more commands to process on server side
[00:01:23.649,444] <inf> nrf_provisioning: Checking for provisioning commands in 60s seconds
[00:01:28.649,475] <inf> cloud_provisioning: Provisioning is idle.
[00:01:33.047,393] <inf> cloud_connection: Waiting for network ready...
[00:01:33.047,424] <inf> cloud_connection: Network is ready
[00:01:33.047,424] <inf> cloud_connection: Connecting to nRF Cloud
[00:01:37.150,390] <err> nrf_cloud_transport: MQTT input error: -128
[00:01:37.150,451] <err> nrf_cloud_transport: Error disconnecting from cloud: -128
[00:01:37.150,512] <inf> cloud_connection: Disconnecting from nRF Cloud
[00:01:37.150,543] <err> cloud_connection: Could not connect to nRF Cloud
[00:01:37.150,543] <inf> cloud_connection: Retrying in 30 seconds...

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

Charlie — Tue, 19 Nov 2024 13:25:34 GMT

Hi,

I played with NCS 2.8.0 Cellular: nRF Cloud multi-service to verfiy the Auto-Provisioning / Onboarding today. Below is my process:

I build the firmware with extra config overlay-http_nrf_provisioning.conf and also set CONFIG_TEMP_ALERT_LIMIT=5 to triger Alert easily.

Following Managing claimed devices using the nRF Cloud portal after programing above firmware.

I can see my device change from READY->PROVISIONED, also the log from nRF9161DK says "cloud_provisioning: Provisiong completed"

[00:00:19.702,301] <inf> cloud_connection: Network connectivity gained!
[00:00:20.702,789] <inf> nrf_provisioning_http: Sending response to server
[00:00:21.540,985] <inf> cloud_provisioning: Provisioning completed.
[00:00:21.541,015] <inf> sample_reboot: Rebooting in 10s...
[00:00:26.541,046] <inf> cloud_provisioning: Provisioning is idle.
[00:00:26.550,506] <inf> cloud_connection: Connecting to nRF Cloud
[00:00:28.194,549] <inf> cloud_connection: Connected to nRF Cloud
[00:00:28.655,029] <inf> shadow_config: Sending reported configuration
[00:00:29.340,179] <inf> application: Waiting for modem to determine current date and time
[00:00:29.351,654] <inf> application: Current date and time determined
[00:00:29.361,450] <inf> nrf_cloud_log: Changing cloud logging enabled to:1
[00:00:29.372,802] <inf> cloud_connection: Reducing provisioning check interval to 30 minutes
[00:00:29.390,014] <inf> application: Temperature is 24 degrees C

The nRF Cloud->Device Management-> Device-> 50363953-3234-4ab4-8025-0e085exxxx management apge shows one alert for "Temperature over limit!".

Then I start to run Cellular: nRF Cloud REST Device Message sample, since the nRF9161DK has already been provisioned to nRF Cloud. I do not need to claim it again, but I sitll need to add extra config overlay-http_nrf_provisioning.conf since it has other configuration the device going to use for connection, like JWT support.

After program the firmware and run, I can find the REST Messages appear on the device terminal on nRF Cloud.

Best regards,

Charlie

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

nrao32 — Sat, 16 Nov 2024 15:52:48 GMT

So, one of the issues was just how I was dumping it into stdout, as it was missing some lines. When I got all the lines in properly, I now get a valid result:

However, the nrf code still errors out:

[00:00:17.306,854] <err> nrf_cloud_codec_internal: REST error msg: Invalid JWT
[00:00:17.306,945] <err> nrf_cloud_rest: nRF Cloud REST error code: 40100
[00:00:17.307,037] <err> nrf_cloud_alert: Error sending alert via REST: -77

The code I'm referring to is here:
sdk-nrf/samples/cellular/nrf_cloud_rest_device_message/src/main.c at 066ac6f61fe19ad91d805fd788d782e245f09a2e · nrfconnect/sdk-nrf

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

nrao32 — Sat, 16 Nov 2024 08:33:31 GMT

I tried generating a JWT token myself to test:

char jwt_buf[512];
	char buf[64 + 1];

	struct jwt_data jwt = { .audience = NULL,
				.sec_tag = CONFIG_NRF_PROVISIONING_JWT_SEC_TAG,
				.key = JWT_KEY_TYPE_CLIENT_PRIV,
				.alg = JWT_ALG_TYPE_ES256,
				.jwt_buf = jwt_buf,
				.jwt_sz = sizeof(jwt_buf),
				/* The UUID is present in the iss claim */
				.subject = NULL };

	/* Check if modem time is valid */
	err = nrf_provisioning_at_time_get(buf, sizeof(buf));
	if (err != 0) {
		LOG_ERR("Modem does not have valid date/time, JWT not generated");
		return -ETIME;
	}

	jwt.exp_delta_s = CONFIG_NRF_PROVISIONING_JWT_MAX_VALID_TIME_S;

	LOG_INF("Generating JWT");
	err = modem_jwt_generate(&jwt);
	if (err) {
		LOG_ERR("modem_jwt_generate failed to generate, error: %d", err);
	}

I get a token back, but something seems to be wrong with it. When I plug in the token to jwt.io for example, it says that the token has an invalid signature:

The nRF cloud's JWT validator also says it's invalid:

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

nrao32 — Sat, 16 Nov 2024 07:26:06 GMT

I've been following along the device alerts and added in the relevant config to prj.conf. Now I get a new error:

[00:00:13.953,491] <inf> iotr: Initializing the nRF Provisioning library...
[00:00:13.997,375] <err> nrf_cloud_codec_internal: REST error msg: Invalid JWT
[00:00:13.997,497] <err> nrf_cloud_rest: nRF Cloud REST error code: 40100
[00:00:13.997,589] <err> nrf_cloud_alert: Error sending alert via REST: -77
[00:00:13.997,619] <err> iotr: Error sending alert to cloud: -77
[00:00:14.177,886] <inf> iotr: nRF Cloud credentials detected
[00:00:14.794,708] <err> nrf_cloud_codec_internal: REST error msg: Invalid JWT
[00:00:14.794,799] <err> nrf_cloud_rest: nRF Cloud REST error code: 40100
[00:00:14.794,860] <err> nrf_cloud_log: Error sending message:-77
[00:00:14.794,952] <err> nrf_cloud_log: Data: [{"appId":"LOG","dom":0,"lvl":1,"src":"nrf_cloud_alert","ts":1731741735293,"seq":0,"msg":"Error sending alert via REST: -77"},{"appId":"LOG","dom":0,"lvl":1,"src":"iotr","ts":1731741735293,"seq":1,"msg":"Error sending alert to cloud: -77"}], len: 240
[00:00:14.895,111] <err> nrf_cloud_log: Error -77 ret 0 processing ring buffer
[00:00:14.895,111] <inf> nrf_cloud_log: Sent lines:0, bytes:0
[00:00:14.895,446] <inf> nrf_cloud_log: Sent lines:0, bytes:0
[00:00:15.457,275] <inf> nrf_provisioning_http: Connected
[00:00:15.457,305] <inf> nrf_provisioning_http: No more commands to process on server side
[00:00:15.457,305] <inf> iotr: Provisioning stopped

I'll keep digging in to see if it's something else I'm missing.

RE: nRF9161 Cloud Auto-Provisioning / Onboarding

Charlie — Fri, 15 Nov 2024 12:29:45 GMT

Hi,

Thanks for checking with use about this issue.

nRF9161DK deoes not support just-in-time provisioning (JITP). Please follow Cellular: nRF Cloud REST Device Message document and pay attention to HW and NCS versions.

You nRF9161DK should be avaliable on nRF Cloud now. Please check if other basic function works or not with Cellular: nRF Cloud multi-service. Learn about Using device alerts about how alert is triggered.

Best regards,

Charlie