How onboarding works

Onboarding is everything that happens between "a device boots Pantavisor for the first time" and "the device sits in your registry, owned by your account, with its own credentials". Pantahub supports three routes to get there, and they share the same destination — they differ only in who proves ownership, and with what secret.

• Claiming — the device registers unowned and presents a one-time challenge; you claim it interactively from the Hub. Best for your first device, dev boards and small setups.
• Auto-join tokens — a shared token baked into the image assigns every device to your account on first boot, hands-off. Best for batches and factory lines.
• TLS onboarding — an auto-join token plus owner verification: the device must also prove possession of a private key against a certificate chain you registered. Best when the token could leak.

Choosing a route

At a glance:

	Claiming	Auto-join token	+ TLS verification
Best for	First device, dev boards	Batches, factory lines	Factory lines where the token may leak
Secret that proves ownership	Per-device challenge	Shared token in the image	Shared token and a device-held private key
Human interaction	Yes — you claim each device	None	None
Preparation	None	Create a device token	Create a token with a root of trust; ship keys on devices
If the secret leaks	Only that one device, until claimed	Anyone can join devices into your account	Token alone is not enough

What every route ends with

However the device joins, the end state is identical, which is why the rest of the Hub doesn't care how a device was onboarded:

1. A device record in your registry, owned by your account (see Devices).
2. Per-device credentials — during registration the device receives its own secret (creds.secret), and from then on it authenticates with that, not with any onboarding secret. Disabling a token or claiming another device never cuts off devices that already joined.
3. A trail: on first boot the device posts its factory state as revision 0, and from there you manage it by deploying updates.

Where to go next

• Flashing your very first device? Follow Start a new device, which walks you through the image-download and claiming flow end to end.
• Moving to production? Create an auto-join token per batch/product line, and consider TLS onboarding as the second factor.