nRF9161 Cloud Auto-Provisioning / Onboarding

[nrao32]

Hello,

I'm trying to set up auto-provisioning and onboarding in my project as described in this sample:
https://github.com/nrfconnect/sdk-nrf/blob/066ac6f61fe19ad91d805fd788d782e245f09a2e/samples/cellular/nrf_cloud_rest_device_message/README.rst#provisioning-and-onboarding-your-device-to-nrf-cloud

From what I can see in the device logs, it looks like it was able to nab credentials from the nRF cloud:

[00:00:00.761,505] <inf> iotr: Reset reason: 0x10001
[00:00:00.927,551] <inf> iotr: Waiting for modem to acquire network time...
[00:00:09.125,366] <inf> iotr: Connected to LTE network
[00:00:09.938,842] <inf> iotr: Network time obtained
[00:00:09.939,056] <wrn> nrf_cloud_log: Unable to filter logs for module 0: nrf_cloud_rest
[00:00:09.939,117] <wrn> nrf_cloud_log: Unable to filter logs for module 1: nrf_cloud_jwt
[00:00:09.939,178] <wrn> nrf_cloud_log: Unable to filter logs for module 2: rest_client
[00:00:09.939,483] <wrn> nrf_cloud_log: Unable to filter logs for module 8: nrf_cloud_log
[00:00:09.939,544] <wrn> nrf_cloud_log: Unable to filter logs for module 9: nrf_cloud_codec
[00:00:09.939,605] <wrn> nrf_cloud_log: Unable to filter logs for module 10: nrf_cloud_codec_internal
[00:00:09.939,605] <inf> iotr: Initializing the nRF Provisioning library...
[00:00:09.940,277] <inf> nrf_cloud_log: Sent lines:0, bytes:0
[00:00:10.103,607] <inf> iotr: nRF Cloud credentials detected
[00:00:10.103,637] <inf> iotr: Sent device alert to the nRF cloud
[00:00:10.129,852] <inf> iotr: Injected time (GPS day 16385, GPS time of day 25955)
[00:00:10.137,878] <inf> iotr: Injected location for MCC <hidden>
[00:00:10.137,908] <inf> iotr: Reset reason: 0x0
[00:00:10.138,397] <inf> nrf_cloud_log: Sent lines:0, bytes:0
[00:00:10.229,919] <inf> iotr: Got device ID: <hidden>
[00:00:10.229,949] <inf> iotr: Waiting for modem to acquire network time...
[00:00:10.990,325] <inf> iotr: Provisioning started
[00:00:11.100,952] <inf> nrf_provisioning_http: Requesting commands
[00:00:11.101,409] <inf> nrf_cloud_log: Sent lines:0, bytes:0
[00:00:13.230,987] <inf> iotr: Network time obtained
[00:00:13.231,018] <inf> iotr: Initializing the nRF Provisioning library...
[00:00:13.359,161] <inf> iotr: nRF Cloud credentials detected
[00:00:15.038,940] <inf> nrf_provisioning_http: Connected
[00:00:15.039,001] <inf> nrf_provisioning_http: No more commands to process on server side
[00:00:15.039,001] <inf> iotr: Provisioning stopped
[00:00:15.039,611] <inf> nrf_cloud_log: Sent lines:0, bytes:0

However, when I go into nRF Cloud to "Add LTE device", I get an error that it hasn't been provisioned:

When I first got the device, I claimed it already (its device GUID shows up under my claimed devices section in the nRF Cloud portal with status "Ready").

However, none of my alerts are actually showing up in the Alerts section, despite the device logs showing no errors. Any ideas?

[Charlie]

Could you try recording a modem trace from the device? The instructions for enabling and capturing modem traces can be found here: Modem Trace Guide.

This trace will help us better understand what might be causing the issues. Please also share the logs captured simultaneously, as they will provide additional context for the analysis.

Let me know if you have any questions or run into any difficulties while capturing the trace and logs. I’m happy to assist further.

Best regards,

Charlie

[nrao32]

Hi Charlie, I was able to get my device provisioned:



I was also able to claim it:

However, I still get errors when trying to use nRF Cloud services like the location API:

[00:00:18.741,577] <err> nrf_cloud_codec_internal: REST error msg: Invalid JWT
[00:00:18.751,831] <err> nrf_cloud_rest: nRF Cloud REST error code: 40100
[00:00:18.761,627] <err> dev: Failed to send P-GPS request, error: -77

I looked up error code 40100:

nRF Cloud REST API Documentation

Looks to be an authorization issue, not an authentication issue (I validated that the JWT token is valid now):

I might be missing some kind of auth permission. How do I allow my device to access nRF cloud services?

[nrao32]

Update - I found this nRF Location Services evaluation thing in the Teams page: https://nrfcloud.com/#/teams

Using that token worked! However, this is not ideal, since obviously I don't want to use the same token for every device, and would rather have the device authenticate itself instead. However the device's JWT still returns error 40100 which on the docs says "Access denied error. The user making the request does not have access to the requested resource (device, SIM, invitation, etc.). Confirm your authorization is correct."

So, at least I'm unblocked for development, but not a viable option for production. Is this just because I'm on the developer plan? Do I need to upgrade to the pro plan to be able to authorize the devices themselves?

[Charlie]

Hi Neil,

The Service Evaluation Token is only valid for 30 days. It is not recommended to use it for your product, even for development purposes.

The JWT is automatically set up if you follow the steps provided in this discussion: https://devzone.nordicsemi.com/support-private/support/336139#permalink=1017931, but this feature requires a Pro plan.

I apologize for the lack of proper documentation on this matter. I will inform our nRF Cloud team to improve this section of the documentation.

Best regards,

Charlie

[nrao32]

Hi Charlie. The nRF Cloud validator says that my JWT is valid and it's also able to give me the device ID from the JWT, but the nRF Cloud does not allow my device to execute any location APIs. The service eval token works however but I'm already 1/3 of the way through that trial and as you said is not recommended. I will try upgrading to the Pro plan and see if that resolves the issue with the nRF Cloud, but I was hoping to stay on the free tier during development. Let me see if the Pro plan fixes it. Thanks.