Network and authentication
Network requirements, credential roles and operator privileges.
Network requirements
| Connection | Requirement |
|---|---|
| Reader → relay | streamzet-embedded.plitsoft.workers.dev · TCP 443 · HTTPS/WSS |
| Operator browser | streamzet.com · streamzet-embedded.plitsoft.workers.dev · *.supabase.co · HTTPS/WSS |
| OEM web dashboard | xspan.streamzet.com · HTTPS |
| Inside the reader | Dashboard traffic reaches loopback TLS 9000; no inbound port forwarding required. |
The reader initiates outbound TLS, allowing operation behind NAT. DNS, a correct clock and WebSocket-compatible egress are required. Retain CA and hostname verification.
Credential roles
| Credential | Purpose |
|---|---|
| Enrollment key | Enrolls new readers; does not grant operator terminal or Fleet authority. |
| Device secret | Stored in state/identity; unique per reader and used for its connection. |
| Operator login | Authorizes terminal, commands and dashboard access after ownership checks. |
| OEM login | Separate Basic authentication for the original RFID dashboard. |
Privileges and authentication boundaries
Shells run with the installed agent’s OS privileges. The qualified reader’s OEM environment runs as root. The OEM must choose and qualify the deployment UID and file access scope.
The RFID UI uses a separate web origin from the StreamZet console. A one-use launch ticket and HttpOnly session cookie protect access; operator Bearer tokens are not forwarded to the reader. Dashboard traffic travels only over the reader’s own connection, authenticated with its per-device secret, and changes to the reader’s HTTPS certificate are recorded on the server.