Level 1 — Token: the sensible default

L1 adds one secret: a device token, issued once when you claim the device (copy it then — we only show it once). Every message carries it:

• HTTP — header X-Chirp-Token: <token> (or ?token= if headers are awkward)
• MQTT — it’s just the connection password
• TCP — third field of the hello line

What it buys you — and the question you should ask

“If the token travels in cleartext, isn’t this as weak as L0?” No — and the difference is who can attack you. Your device id is public by design: it’s on your dashboard, in your screenshots, printed on the board, maybe in a forum post. At L0, anyone on the internet who learns it can speak as your device. The token is a secret — the only way to steal it is to capture your traffic in flight, which means being on your network path: your LAN, an open Wi-Fi network, a router in between. L1 eliminates every off-path attacker, which is nearly all of them. Spoofing, junk injection, and drive-by spam are done — rejected with a 401 before your data pipeline ever sees them. This is the level for anything that stays plugged in when you stop watching it.

What L1 does not survive is a hostile network — someone who can already read your packets can read your token. If your device lives on networks you don’t control, that’s not an argument for a stronger token; it’s the argument for Enforce TLS, which puts the token inside TLS without moving this device up a single level.

How to protect yourself at L1

• Treat the token like a password. It’s in your firmware config, so it’s only as private as your source. Keep it out of public repos — a config.h in .gitignore beats a hardcoded string.
• Rotate on suspicion. One click on the device page invalidates the old token; the device stops reporting until you update it — the browser flasher makes that a USB plug, not a re-flash from source.
• Remember what L1 doesn’t do: the payload still travels in the clear (readable on the wire) and unauthenticated-in-content (a middlebox could alter bytes in transit; token still valid). If either of those matters, that’s exactly L2.

Where it sits in the ladder

L1 is the default because it matches where most projects actually live: a device on a network you control, exposed to an internet full of off-path strangers. It costs the device one string. When either half of that changes — the network stops being yours, or the messages start driving decisions — the next moves are L2 (integrity without TLS) and Enforce TLS (nobody reads it, once your MCU can afford it) — two separate axes, and you can take either one without the other.