A gateway’s token is its only credential. This page explains how to replace it, how to stop a gateway temporarily or for good, and what happens to the connection each time. All actions are on the gateway’s LoRaWAN tab (for a licensed router: the LoRaWAN gateway drawer) and need the permission to manage gateways. Each one asks you to confirm first and is written to the audit log.
How the token works
- Hermetry creates a random token when you add a Basics Station gateway and shows it once.
- Only a fingerprint (SHA-256) of the token is stored. Nobody, including Hermetry staff, can read the token back.
- The gateway sends the token in the
Authorization: Bearerheader each time it connects. - The token is tied to the gateway’s EUI. The same token on another gateway is refused (
eui_mismatch).
Licensed routers have no token; they use their device certificate.
Rotate the token
Rotate the token when you lost it, when someone who should not have it may have seen it, or when you hand a gateway to a new installer.
- Open the gateway’s LoRaWAN tab.
- Select Rotate token.
- Confirm Rotate the token: “The gateway is disconnected at once and stays disconnected until you put the new token on it.”
- The tab shows the new Token header and the download buttons for
tc.uri,tc.trustandtc.key. Copy them now: they are shown only once. - Put the new token on the gateway and restart its packet forwarder. See Connect a Basics Station gateway.
What happens:
| Moment | Effect |
|---|---|
| You confirm | The old token stops working immediately. The gateway’s open connection is closed. |
| Until you update the gateway | The gateway tries to reconnect with the old token and is refused. Devices heard only by this gateway do not reach Hermetry. |
| You put the new token on it | The gateway connects again. |
Once the new token is no longer on screen, the setup section says The token was shown once when the gateway was added. Rotate the token to get a new one; the gateway stays disconnected until it has the new one.
Disable and enable
Disable is a temporary stop, for example while a gateway is moved or if you suspect it is misused.
- Select Disable.
- Confirm Disable the gateway: “The gateway is disconnected and refused until you enable it again. Devices it alone hears stop reaching the platform.”
The gateway’s status becomes Disabled and its connection is closed at once. Its token, EUI, device and history stay.
To undo it, select Enable and confirm: “The gateway may connect again with its token.” The gateway reconnects on its own with the token it already has.
Remove
Remove deletes the gateway for good.
- Select Remove.
- Confirm Remove the gateway.
| Gateway type | What is removed | What stays |
|---|---|---|
| Basics Station gateway | The gateway record, its token, its EUI claim and its device. The connection is closed. | Its stored readings. |
| Licensed router | The router’s gateway record and EUI claim. The LoRaWAN link is closed. | The router’s device and its readings. |
After removal the EUI is free again: you, or another organisation, can register it.
Note
A gateway cannot be deleted with the generic device delete on the Devices page. Hermetry answers that the device still has a LoRaWAN record. Use Remove on the LoRaWAN tab, which removes the LoRaWAN parts first.
How fast a gateway is cut off
A rotation, disable or removal closes the gateway’s connection at once. Should that signal be delayed, every open gateway connection is also re-checked against the gateway registry every 60 seconds, so a revoked gateway is closed within a minute at the latest.
Through the API
| Action | Request |
|---|---|
| Rotate the token | POST /tenant/<tenantId>/api/iot/lorawan/gateways/<gatewayId>/credentials returns { gateway, token, stationConfig } once. |
| Disable | PATCH …/gateways/<gatewayId> with { "status": "DISABLED" } |
| Enable | PATCH …/gateways/<gatewayId> with { "status": "ACTIVE" } |
| Rename | PATCH …/gateways/<gatewayId> with { "name": "…" } |
| Remove | DELETE …/gateways/<gatewayId> |
The EUI and the protocol of a gateway never change. A Basics Station gateway always stays in cloud mode; asking for another mode is refused with A Basics Station gateway always runs in cloud mode. Rotating the token of a gateway without a token (a licensed router) is refused with This gateway does not use a token. (no_token_auth).
Audit log entries
| Action | Audit entry |
|---|---|
| Gateway added | iot_lorawan.gateway.created |
| Renamed, disabled, enabled, moved on the map | iot_lorawan.gateway.updated |
| Token rotated | iot_lorawan.gateway.credential_rotated |
| Removed | iot_lorawan.gateway.deleted |