How to initiate BLE pairing manually

RE: How to initiate BLE pairing manually

Phil — Mon, 29 Jun 2026 01:03:27 GMT

I set the security level in the Central instead of in the Peripheral when the connection is established. Function bt_conn_set_security() is called from the connected() callback via a kwork item.

I've been testing this with both devices not bonded to anything. I erase the bond information each time before testing.

The two devices pair and then bond reliably when they connect.

I also set the security level of our custom characteristics in the peripheral. That way when the phone connects with nRF Connect, the phone will initiate pairing and bonding when it attempts to read that characteristic. This is also reliable.

Thanks for your advice.

RE: How to initiate BLE pairing manually

Vidar Berg — Fri, 26 Jun 2026 06:55:30 GMT

Thanks for the update. Default behaviour is that the peripheral will reject a pairing request from an already bonded peer device. You can change this by enabling the CONFIG_SMP_ALLOW_OVERWRITE setting, but as indicated in the help text, it has some security implications that should be considered.

RE: How to initiate BLE pairing manually

Phil — Fri, 26 Jun 2026 06:43:10 GMT

Thanks for your reply.

I have it working where the peripheral calls bt_conn_set_security() when the central connects to it.
The Central and Peripheral both pair and bond..... most of the time.

However, occassionally the pairing fails with an error code "Failed to set security level". The peripheral has bond information stored in NV memory, but the Central doesn't.

I'll try it with the Central setting the security level on connection.

It starts to make sense once you see things running. Thanks for your help.

RE: How to initiate BLE pairing manually

Vidar Berg — Fri, 26 Jun 2026 05:59:36 GMT

When in the GAP Peripheral role, calling bt_conn_set_security() sends a security request, it will not initiate pairing like a central would. A security request sent immediately after connection is likely to be ignored by the central because it will overlap with other important events. If you want to send a security request, it is generally good practice to wait a few seconds to see whether the central initiates pairing or encryption first. Only send the request if it does not.

The linked sample is from the SDK.

RE: How to initiate BLE pairing manually

Phil — Thu, 25 Jun 2026 23:03:47 GMT

Vidar,

Thanks for your reply. I'll try setting the security level in the Central by calling bt_conn_set_security() to trigger the pairing process.

Is that example for SDK v3.3.0?

I found in the code for the peripheral I could not call bt_conn_set_security() from the connected() call-back. I mean I could call it but it didn't do anything. I had to use a kwork and call it from the kwork handler. I presume this is because the connected() call-back is running in the BT stack, so is effectively running in an ISR.

I found that calling bt_conn_set_security() in the peripheral as soon as it connected caused pairing to start as soon as my phone connects (using nRF Connect app). A Pairing Request window pops up on my phone. However, it pops up twice. It does pair and bond Ok. This is without the phone trying to read/write any attributes. It connects, pairs and does device discovery only. Function bt_conn_set_security() is definitely called only once. Could the reason the pairing request pops up twice in the nRF Connect app be something to do with the phone (Android on Samsung Galaxy)?

RE: How to initiate BLE pairing manually

Vidar Berg — Thu, 25 Jun 2026 07:41:06 GMT

Hi,

You can initiate the pairing process from the central by calling bt_conn_set_security() like in the central_uart sample here: https://github.com/nrfconnect/sdk-nrf/blob/5aa13555aa18356ea4b47766d16aa3dfbd80b978/samples/bluetooth/central_bas/src/main.c#L152. It is also important to change the security requirement on your characteristics if you want to require the link to be encrypted before any data exchange (https://academy.nordicsemi.com/courses/bluetooth-low-energy-fundamentals/lessons/lesson-5-bluetooth-le-security-fundamentals/topic/blefund-lesson-5-exercise-1/).

RE: How to initiate BLE pairing manually

Phil — Thu, 25 Jun 2026 00:54:46 GMT

I have exactly the same issue.
I'm running nRF Connect SDK v3.3.0 on two nRF54L15-DK boards, one Peripheral and one Central.
When the Central is scanning and receives advertising from the peripheral, a button can be pressed on the Central to initiate a connection.The devices connect Ok in an unencrypted link.

I want the devices to pair and bond, or at least start the pairing process, automatically when the connection is established.
I assumed that when the Central gets a connected complete callback it could programatically initiate the pairing process by sending a pairing request. However, I can't find any documentation on how to do this.

Is it only possible to automatically start the pairing process from the peripheral?
Does the peripheral have to send a security request in order to trigger the Central to send a pairing request?

We want to use pairing process "Just Works", so there in no operator involvement during the pairing process. Our central and peripheral devices are simple and only have a button and LED, no display or keyboard. However we want the link encrypted and the devices to be bonded.

RE: How to initiate BLE pairing manually

Vidar Berg — Fri, 06 May 2022 13:19:32 GMT

The MIC failures occur because the sniffer does not have the encryption key to decrypt the payload. To be able to sniff LESC pairing you need to enable the debug DH keys: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/1.9.1/kconfig/CONFIG_BT_USE_DEBUG_KEYS.html

RE: How to initiate BLE pairing manually

ealtan — Thu, 05 May 2022 22:11:51 GMT

I was using one Nordic nRF52840-DK in Peripheral mode and the other unit was another nRF52840-based module DK from another company. So, I switched to two Nordic DKs and connection problems went away, so that's good. But pairing failures are still here, so I've put Nordic nRF52840 dongle with Wireshark capture in between.

It seems like all is going well till when Slave responds with LL_START_ENC_REQ and then I see all packets that are not empty PDU having "Encrypted packet decrypted incorrectly (bad MIC) " error.

Any idea why these bad MIC errors might be happening ?

RE: How to initiate BLE pairing manually

Vidar Berg — Fri, 29 Apr 2022 15:24:09 GMT

I don't think there is much you can do in FW to improve chances for a connection attempt to succeed except for increasing the Radio's TX output power ( example ). Default is 0 dBm and radio is supporting up to +8 dBm. But I'm surprised you don't see this with the other board. Maybe the other board automatically repeats the connection attempt if it fails the first time? A Bluetooth sniffer trace may help show what the problem is.

You are still using 2 Nordic DKs for this test?

RE: How to initiate BLE pairing manually

ealtan — Fri, 29 Apr 2022 14:56:19 GMT

Yes, it is possible, however, I repeat the test with another MCU vendor and I don't have these connection and pairing issues. So, my question is, what can I change to create a more robust connection and pairing operation ? For example, is there more info on these parameters ? How do they affect connections ? :

/** Connection parameters for LE connections */

struct bt_le_conn_param {

uint16_t interval_min;

uint16_t interval_max;

uint16_t latency;

uint16_t timeout;

};

.options = (_options), \

.interval = (_interval), \

.window = (_window), \

.interval_coded = 0, \

.window_coded = 0, \

.timeout = 0, \

RE: How to initiate BLE pairing manually

Vidar Berg — Fri, 29 Apr 2022 12:22:50 GMT

Hi,

Could it be the environment you are testing this in? BT_HCI_ERR_CONN_FAIL_TO_ESTABLISH will happen from time to time. It means the peripheral did not respond to the connect request (only one request is sent per connect attempt) and that the central have to retry. It is normal for this error to happen from time time, but it can also occur quite frequently if there is lots of noise or interference from other nearby sources, for instance, active scanning from other BLE devices.

RE: How to initiate BLE pairing manually

ealtan — Thu, 28 Apr 2022 12:17:34 GMT

Thank you, I did that, but overall pairing seems to be very unreliable. Many times it fails with unspecified reason.

But before that getting into details with pairing, connections have been pretty undeterministic, too. I have a Central which issues a connect to a Peripheral, many times Central comes back with disconnected callback with reason BT_HCI_ERR_CONN_FAIL_TO_ESTAB. So, do you have any recommendations to make connections more reliable ? Any parameters to tweak ? Why would it keep disconnecting with BT_HCI_ERR_CONN_FAIL_TO_ESTAB reason ?

RE: How to initiate BLE pairing manually

Vidar Berg — Wed, 27 Apr 2022 06:53:40 GMT

I see. In that case you can add CONFIG_BT_BONDABLE=n to your project, or call bt_set_bondable('false') on startup.

RE: How to initiate BLE pairing manually

ealtan — Tue, 26 Apr 2022 21:21:52 GMT

[quote userid="4240" url="~/f/nordic-q-a/86794/how-to-initiate-ble-pairing-manually/364605#364605"]The other connections will be secured with the encryption key that was exchanged during pairing.[/quote]

Is that because these two devices are bonded ? I don't want them to be bonded, I want to trigger and restart pairing process every time . Is there a way of doing this ?

RE: How to initiate BLE pairing manually

Vidar Berg — Mon, 25 Apr 2022 07:29:06 GMT

Thanks for the clarification and sorry for delayed response. The reason you are not getting the pairing_complete callback on the subsequent connections is that the pairing procedure is only performed in the first connection. The other connections will be secured with the encryption key that was exchanged during pairing.

You can register the "security changed" callback if you want to monitor when the link becomes secured in both cases (i.e. after pairing or encryption with existing keys):

https://developer.nordicsemi.com/nRF_Connect_SDK/doc/1.9.1/zephyr/reference/bluetooth/connection_mgmt.html#c.bt_conn_cb.security_changed

Here is how the callback is used in our central uart sample for reference: https://github.com/nrfconnect/sdk-nrf/blob/7848293244a0904cb401f13f420bf610d7aa8e91/samples/bluetooth/central_uart/src/main.c#L425

RE: How to initiate BLE pairing manually

ealtan — Thu, 21 Apr 2022 03:17:55 GMT

Thank you, Vidar, just one clarification, I initiate pairing from Central to Peripheral. By using bt_conn_set_security() I can upgrade the security level and that causes pairing_complete callback to be called. So, that's good, thank you.

But I have a new issue. I have a test suite that I'm running in a loop : Central connects to a Peripheral, Central initiates pairing, pairing successfully completes, Central does some characteristics read/write and then disconnects. This process is run in a loop. My problem is, after the first run, pairing never completes, ie I never see pairing_complete callback being called. So I'm guessing that I need to do something else to clear old pairing info. Any idea how I can do that ?

Many thanks,

RE: How to initiate BLE pairing manually

Vidar Berg — Mon, 11 Apr 2022 11:49:12 GMT

Hello,

It is generally recommended to let the central initiate the pairing request, or at least, give it a chance to send it first. From the "Accessory Design
Guidelines for Apple Devices" document:

40.10 Pairing
The accessory should not request pairing until an ATT request is rejected using the Insufficient
Authentication error code. See the Bluetooth 4.0 specification, Volume 3, Part F, Section 4 for details.

If, for security reasons, the accessory requires a bonded relationship with the Central, the Peripheral
should reject the ATT request using the Insufficient Authentication error code, as appropriate. As a
result, the device may proceed with the necessary security procedures.

Similarly, if the device acts as a Central and a GATT server, it may reject an ATT request using the
Insufficient Authentication error code. The accessory should initiate the security procedure for pairing
in response.

Pairing may require user authorization depending on device. Once an accessory is paired with a device,
it shall retain the distributed keys of both central and peripheral for future use. If the pairing is no longer
required, the accessory shall delete both sets of keys.

The Insufficient Authentication error code is returned when the GATT client tries to read a characteristic that has the security level set to a level that requires authentication. The user will automatically get a pairing popup if they use iOS.

Characteristic read and write permissions (i.e. security level) is configured when you initialize the service. Like here for the HIDS service: https://github.com/nrfconnect/sdk-nrf/blob/35f91d3151abfaddf60d826ed87c91cfa81773a5/subsys/bluetooth/services/hids.c#L751

But to answer your question, it should be possible to issue a security request from the peripheral by calling the bt_conn_set_security() function, or by enabling the CONFIG_BT_GATT_AUTO_SEC_REQ option.

Best regards,

Vidar