Issue link: https://read.uberflip.com/i/1545681
LoRaWAN ® Device Identification QR Codes for Automated Onboarding Specification TS018- 1.0.0 ©2026 LoRa Alliance ® Page 12 of 17 The authors reserve the right to change specifications without notice. APPENDIX A. EXAMPLE GENERATION AND 303 USE OF OWNERTOKEN 304 305 This is an example of how OwnerToken may be generated and used. There are possibly other 306 ways of managing the OwnerToken. They are all valid as long as they are compliant with the 307 specification in Section 4.2.5.2. 308 309 - At the time of device provisioning on the JS, the JS generates a random OwnerToken and 310 assigns it to the DevEUI of the device. Both the DevEUI and the OwnerToken (along with 311 some other attributes, such as AppKey) are stored on the JS. The JS marks the device as 312 "unclaimed" at that point. 313 314 - The OwnerToken is provided to the manufacturer to generate the QR code to be printed and 315 placed on the end-device. There are other information elements needed for the QR that are 316 not mentioned here for the sake of brevity. 317 318 - Device with the QR code is placed inside a box and made available to the final owner through 319 a chain of events. The QR code cannot be readily seen from outside the box during this 320 journey. 321 322 - The owner unboxes the device. The owner uses the mobile app provided by his/her 323 LoRaWAN operator in order to provision the newly-acquired device with his her own account. 324 325 - Mobile app reads the QR code on the device and sends that to a user account management 326 server in the operator domain. 327 328 - The server contacts the JS as identified by the JoinEUI which is encoded on the QR code to 329 attempt to claim the device as identified by the DevEUI in order to set its home NS while 330 presenting the OwnerToken as the proof of ownership. The interface allowing this interaction 331 is currently outside the scope of LoRa Alliance. 332 333 - The JS verifies the device identified by the DevEUI is not claimed and the received 334 OwnerToken matches the stored value. If this is the case, the JS marks the device as 335 "claimed", and sets the home NS to the value received in the request. 336 337 In this example, one-time claim is illustrated. Subsequent unclaim/claim procedures can be 338 implemented by the JS generating and providing a new OwnerToken back to the current owner 339 to be shared with the future owner of the device. 340 341