# Setup a PoC

**URL:** <https://hub.mender.io/t/setup-a-poc/7393>\
**Category:** General Discussions\
**Created:** [December 16, 2024, 3:21am UTC](https://hub.mender.io/t/setup-a-poc/7393 "2024-12-16T03:21:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tom-Isaacson](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/tom-isaacson/32/2371_2.png) [@Tom-Isaacson](https://hub.mender.io/u/Tom-Isaacson)\
**Post date:** [December 16, 2024, 3:21am UTC](https://hub.mender.io/t/setup-a-poc/7393/1 "2024-12-16T03:21:47Z")

</div>

I’m trying to setup a proof of concept using the Mender APIs but I can’t figure out where to configure the tenant token. I generated a public/private key using [Sign and verify | Mender documentation](https://docs.mender.io/artifact-creation/sign-and-verify#generating-keys) and used it to call [Mender API docs](https://docs.mender.io/api/?shell#device-api-device-authentication-authenticate-device) but I get “tenant token missing” in reply. I assume I need to upload the private key to the server but I can’t find any details for how to do that.

Also is “X-MEN-Signature” just supposed to be set to “string”?

---

<div class="post-metadata">

**Author:** ![Tom-Isaacson](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/tom-isaacson/32/2371_2.png) [@Tom-Isaacson](https://hub.mender.io/u/Tom-Isaacson)\
**Post date:** [December 16, 2024, 4:36am UTC](https://hub.mender.io/t/setup-a-poc/7393/2 "2024-12-16T04:36:39Z")

</div>

I realised the body needs to contain `tenant_token` which is the value of Organization token from the web UI. My device appeared requiring authentication in the web UI and I approved it but I still get an error calling the API “signature verification failed”.

I tried setting `X-MEN-Signature` to `ECDSA` but got the same result. There’s nothing in the Audit Log of the web UI.

---

<div class="post-metadata">

**Author:** ![TheYoctoJester](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/theyoctojester/32/1444_2.png) [@TheYoctoJester](https://hub.mender.io/u/TheYoctoJester)\
**Post date:** [December 16, 2024, 8:46pm UTC](https://hub.mender.io/t/setup-a-poc/7393/3 "2024-12-16T20:46:30Z")

</div>

Hi @Tom-Isaacson,

Thanks for reaching out! Just so I can understand and hopefully help right: which API do you want to use? The tenant token is almost never needed, unless you want to write a custom client.

In the context of Mender, there are a number of tokens:

- tenant: this one is constant and fixed for your whole organization. Its sole purpose is to correlated device authentication during the provisioning process to your organization.
- session: a short-lived token that you can use for authenticating to API endpoints, but mostly superseded by personal access token since some time (see below).
- personal access: allows authentication to API endpoints on the management backend. It is passed in the headers conceptually like this:

```auto
headers: {
	'Accept': 'application/json', # depending on endpoint
	'Authorization': 'Bearer ' + patToken, # patToken holds the token as string
	...other headers
}

```

Generally the APIs are used like this: [Using the APIs | Mender documentation](https://docs.mender.io/server-integration/using-the-apis#using-the-apis), and personal access tokens are specifically outlined at [Using the APIs | Mender documentation](https://docs.mender.io/server-integration/using-the-apis#personal-access-tokens).

Hope this helps, if not then please provide a bit more detail on the endpoint which you want to call.

Greetz,  
Josef

---

<div class="post-metadata">

**Author:** ![Tom-Isaacson](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/tom-isaacson/32/2371_2.png) [@Tom-Isaacson](https://hub.mender.io/u/Tom-Isaacson)\
**Post date:** [December 16, 2024, 9:26pm UTC](https://hub.mender.io/t/setup-a-poc/7393/4 "2024-12-16T21:26:16Z")

</div>

Ok, documentation is a bit poor. `X-MEN-Signature` is actually a signature as explained in [How to write a custom client interfacing a Mender server](https://hub.mender.io/t/how-to-write-a-custom-client-interfacing-a-mender-server/1353). Documentation could do with an update.

My confusion now comes from all the different APIs being able to send custom data. That article says we need to call [Device inventory](https://docs.mender.io/api/?shell#device-api-device-inventory) with a minimum of `device_type` and the `artifact_name`. But this isn’t mentioned in the API spec? Then we can call [Deployments v2](https://docs.mender.io/api/?shell#device-api-deployments-v2) but this also includes `additionalProperties`. If I just add `additionalProperties` here I get 204 No Content so I assume I need to declare all additional properties in the inventory. But if this is the case why do I have the ability to add them to the Check Update call? Is this in case the values change?