Features
Six things every fleet needs. All of them on day one.
Not a box of primitives to wire together — identity, config, firmware, telemetry, alerts and logs designed against each other in one codebase.
A key per device, minted where its state lives
Each pigeon gets its own Ed25519 keypair, generated inside the isolated object that will later verify it. The private half signs one token and is discarded on the spot — only the public key is ever stored. That token is 69 bytes: version, expiry, signature, and it's the same 69 bytes whether the device talks plain HTTPS, holds a live socket open, or speaks CoAP over DTLS or TLS because that's all its modem can afford. Authentication costs almost nothing on a metered link.
Refreshing a token overwrites the old public key, which means rotation is revocation. There's no fleet-wide secret to leak and no revocation list to sync.
// the entire device auth pathpub fnverify_device_token(token: &str, key_b64: &str) -> bool {
let Ok(raw) = URL_SAFE_NO_PAD.decode(token) else { .. }; if raw.len() != 69 { return false } let (payload, sig) = raw.split_at(5); // ver + expiry key.verify(payload, &sig).is_ok()}Set what you want. See what landed.
Every device carries a desired state and a reported state. You push the first; the device confirms the second with exactly what it applied — so "configured" is a fact, not an assumption.
Over a live socket it lands in about a second. Devices that sleep pick it up on their next check-in and confirm then.
Desired
report_interval: 60s
gps_enabled: true
Reported
report_interval: 60s ✓
gps_enabled: true ✓
applied 1.1s after push · live over WebSocket, no polling
OTA that refuses to brick the wrong board
Upload an image once and roll it out per device or per flock. Images and devices both carry a board tag, and a mismatched assignment is rejected outright.
Images live content-addressed by their own SHA-256, and devices resume interrupted downloads with Range requests instead of starting the whole file again.
firmware · v1.4.2
board: nrf9160sha256 9f2c…a41b 612 KiB
assign → pigeon-0417 board matches ✓
assign → pigeon-0902 board mismatch — refused
resumable · Range requests straight into the secondary slot
Graphs and tracks, no setup
Devices report flat key/value pairs. You get a latest-value snapshot, queryable history, a graph against any numeric key, and a GPS track when the keys are a fix.
Email when it matters
Thresholds, rate-of-change and heartbeats on your own keys, scoped to one device or a whole flock — mailed when they fire and again when they clear.
FIRING temp_c > 30 for 5m · pigeon-0440
CLEARED battery_v < 3.4 · pigeon-0421
HEARTBEAT no report in 2h · pigeon-0440
Remote logs that fit the link
Structured Zephyr logs ship as dictionary-compressed codes — a fraction of the bytes over cellular — into a rolling per-device buffer you pull on demand. When reading isn't enough, ask a connected device a question directly and get its answer back: the site visit you didn't have to make.
12:04:18 <inf> modem: attach ok, rsrp -91
12:04:19 <dbg> pigeon: token ok (69 B)
12:04:21 <wrn> sensor: retry 1/3
What isn't here yet
Two things are designed and not built: a user-authored rule engine — your own logic running against incoming telemetry at the edge — and per-flock storage, which would give a fleet a database of its own instead of a shared one. We'd rather list them here than imply they ship today. Everything else on this page is running now.
Easier to see than to read about.
A real device is reporting into the demo page right now — live, no signup.