Token: the sensible default

Token (formerly L1 Token) adds one secret: a device token, issued once when you claim the device (copy it then — we only show it once). Every message carries it:

• HTTP — header X-Chirp-Token: <token> (or ?token= if headers are awkward; a device that does that collects its commands with POST)
• MQTT — it’s just the connection password
• TCP — third field of the hello line

What it buys you — and the question you should ask

“If the token travels in cleartext, isn’t this as weak as Open?” No — and the difference is who can attack you. Your device id is public by design: it’s on your dashboard, in your screenshots, printed on the board, maybe in a forum post. At Open, anyone on the internet who learns it can speak as your device. The token is a secret — and anyone holding it can speak as your device. It gets out two ways: captured in flight, which means being on your network path (your LAN, an open Wi-Fi network, a router in between), or leaked out of your configuration — committed to a repo, pasted into an issue, left in a screenshot or a support log. Token eliminates every off-path attacker who has neither, which is nearly all of them. Spoofing, junk injection, and drive-by spam are done — rejected with a 401 before your data pipeline ever sees them. This is the level for anything that stays plugged in when you stop watching it.

What Token does not survive is a hostile network — someone who can already read your packets can read your token. If your device lives on networks you don’t control, that’s not an argument for a stronger token; it’s the argument for Encrypted, which puts the token inside TLS without moving this device up a single level.

How to protect yourself at Token

• Treat the token like a password. It’s in your firmware config, so it’s only as private as your source. Keep it out of public repos — a config.h in .gitignore beats a hardcoded string.
• Rotate on suspicion. One click on the device page invalidates the old token; the device stops reporting until you update it — the browser flasher makes that a USB plug, not a re-flash from source.
• Remember what Token doesn’t do: the payload still travels in the clear (readable on the wire) and unauthenticated-in-content (a middlebox could alter bytes in transit; token still valid). If either of those matters, that’s exactly Signed.

Where it sits in the ladder

Token is the default because it matches where most projects actually live: a device on a network you control, exposed to an internet full of off-path strangers. It costs the device one string. When either half of that changes — the network stops being yours, or the messages start driving decisions — the next moves are Signed (integrity without TLS) and Encrypted (nobody reads it, once your MCU can afford it) — two separate axes, and you can take either one without the other.