Level 2 — Signed: integrity without TLS

L2 is the clever middle that enterprise clouds skip: every message carries an HMAC-SHA256 signature of the payload, computed with a device key you ask for on the device page — Get signing key. Claiming a device mints no key: the key is a separate, deliberate step, and it is shown exactly once.

Getting the key changes nothing at the door. The device carries on reporting as it is, and enforcement follows the firmware — the first message that arrives with a valid signature is what moves it to L2. Moving up without going dark is the whole sequence.

X-Chirp-Signature: hex( hmac_sha256(device_key, body) )

Why this level exists

TLS is heavy for the smallest MCUs — RAM for the handshake, flash for the cert store, a correct clock for validation. L2 delivers the property most projects actually need — nobody can forge or alter a message from your device — using one hash function that runs on anything, over plain HTTP or UDP. An attacker can still read your traffic (it’s not encryption); they can’t speak as you or tamper undetected.

How to protect yourself at L2

• Add a nonce or timestamp inside the signed payload and let the platform’s replay window reject repeats — otherwise a captured valid message can be re-sent verbatim.
• The device key is shown once and never travels again. Same hygiene as the L1 token: config file, not public source. Lost it? Rotating the token issues a fresh token and a fresh key together — and takes the board dark until both are on it, so prefer re-provisioning, which rotates and pushes in one pass.
• L2 means the same thing on every transport: HTTP and UDP carry the signature in a header/field; MQTT and raw TCP prefix each payload with the 32 raw HMAC bytes. Your device computes one HMAC either way — only where it rides differs, and the docs snippets show both forms.

Choose L2 when

The device acts on commands (relay, fan, valve, lock — within the acceptable-use limits), or decisions get made from its data, but the payload itself isn’t secret. Greenhouse controller: yes. Anything whose readings are sensitive: keep L2 and arm Enforce TLS as well — the signature stops forgery, the flag stops reading, and they are separate switches.