Everything a Device Fleet Actually Needs

For anyone tired of config drift

Every pigeon has a desired state and a reported state, versioned independently. Push a target_config, and the device confirms back exactly what it applied and when — so you always know whether a fleet has actually converged, not just whether you told it to.

For anyone who's had to rotate a leaked API key at 2am

Every pigeon gets its own Ed25519 keypair, generated on device creation — only the public key is ever stored, and the private key signs one token before it's discarded. Devices authenticate with a 69-byte binary bearer token, not a JWT. Refreshing a device's token mints a brand-new keypair on the spot, which permanently invalidates the old one; there's no separate revocation list to maintain because overwriting the verification key is the revocation.

For anyone who's outgrown a spreadsheet of sensor readings

Devices report flat key/value telemetry over HTTPS, CoAP, or the WebSocket channel — captured as a latest-value snapshot and a full queryable history, so you can build graphs against any key, over any pigeon or an entire flock, with time ranges you pick. Don't want us holding your data at all? Point a pigeon's telemetry endpoint at your own InfluxDB-line-protocol-compatible database (InfluxDB, GreptimeDB, and friends) and reports go straight there instead of into the platform's history store.

For anyone who finds out about outages from their customers

Define a condition once and get an email when it trips: a telemetry key crossing a threshold, a reading jumping further between reports than it plausibly should, a device sitting stale or offline, or a pigeon that's simply stopped reporting altogether. Value conditions are checked the moment a report arrives; silence conditions run on a scheduled sweep, because "nothing arrived" can't be observed at ingest time. Notifications go to the flock owner by default, or to any address you set per alert.

For anyone debugging a device that's three states away

The Zephyr device library ships structured logs as dictionary-compressed codes instead of raw strings — a fraction of the bytes over a cellular link. They land in a rolling per-device buffer, and the dashboard's log viewer decodes them back against the firmware's own dictionary, so you get readable log lines without the wire cost.

For anyone who's bricked a device pushing firmware

Firmware images are content-addressed by SHA-256, stored in R2, and catalogued per flock — assigned to a pigeon through the same shadow model as config. Downloads use Range requests straight into the MCUboot secondary slot, so a device can resume a large image instead of restarting it. Every image and every pigeon carries a board tag, and an assignment is rejected outright unless they match — a fail-closed check against a real incident, not a hypothetical one. Hardware-verified end to end on both the nRF9160 and the nRF9151.

For anyone whose hardware can't afford a full HTTPS stack

No proprietary firmware, no supported-device list. Speak HTTPS if you can, or RFC 8323 CoAP-over-TLS/TCP if your hardware is too constrained for a full HTTPS stack — both hit the same ingestion API, both stay fully encrypted. There's no bare, unencrypted UDP path.

For anyone who's had a device go dark without noticing

Every pigeon shows Online, Stale, or Offline right on its card — self-calibrated from that pigeon's own reporting interval, not a single fixed timeout across your whole fleet. No extra device traffic, no new route to wire up; it's derived entirely from data the dashboard already has.

For anyone who doesn't want to run their own auth stack

Dashboard accounts run on a self-hosted Ory Kratos instance — your users' credentials never leave infrastructure you control, and account emails (verification, recovery) are sent under our own branding, not a generic template. Device identity is completely separate: a pigeon's Ed25519 keypair proves control of that pigeon, full stop, with no Kratos identity involved at all.

For anyone tired of waiting on the next poll interval

WiFi and mains-powered devices can hold one long-lived WebSocket connection instead of polling — a shadow update reaches the device the moment you push it, and telemetry can ride the same socket. Built on Durable Object hibernation, so an idle connection survives without keeping anything warm. Hardware-verified end to end in production: connect, sub-second config pushes, telemetry ingestion, and autonomous reconnect, all on a real device against the live API.

For anyone who's wanted to poke a device without a physical console

Run one diagnostic command on a WebSocket-connected device and get its output back over an ordinary dashboard request — relayed through that device's existing socket, gated to the pigeon's owner, with whatever the device's own command allowlist permits. Rides the same live production WebSocket channel described above, verified on real hardware.

For anyone who's read a JS backend's node_modules folder and wept

The edge router, the dashboard, and the shared wire types are all Rust — the backend compiles to a Cloudflare Worker, the frontend compiles to WebAssembly. One language, one type system, shared structs between frontend and backend so they can't drift apart. AGPL-3.0 licensed and developed in the open.