---
title: Device & Token Lifecycles
description: Device & Token Lifecycles
---
[Skip to content](https://portal.sandgrain.eu/knowledge-base/device-token-lifecycles#main-content)
English
Show submenu for translations
.png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1).png)
Open main navigation
Close main navigation
- English
Show submenu for translations
- [Contact us](https://portal.sandgrain.eu/login)
[Contact us](https://portal.sandgrain.eu/login?hsLang=en)
How can we help you?
- There are no suggestions because the search field is empty.
1. [Knowledge Base](https://portal.sandgrain.eu/knowledge-base?hsLang=en)
2. [User Documentation](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en)
3. [TrustBridge](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#trustbridge)
October 6, 2026
# Device & Token Lifecycles
**Who this is for:** Operators and administrators who manage devices in TrustBridge, and anyone reconciling what they see in the frontend with what CyberRock reports.
**What you'll learn:** The device status machine TrustBridge maintains, how it maps to the frontend tabs, and how it differs from the separate token lifecycle CyberRock tracks.
### The TrustBridge device status machine
Each enrolled device moves through an explicit status machine maintained by the backend and surfaced as tabs in the frontend:
```
idle -> inprogress -> claimed -> (approved) -> authenticated | rejected (failure)
```
- A device starts **idle** on registration.
- It becomes **inprogress** while an authentication run is underway.
- It becomes **claimed** once the first mutual authentication and CyberRock claim succeed.
- It becomes **authenticated** once moved into the active lifecycle.
- A failed run sets the device to **rejected**.
### How the statuses map to frontend tabs
| Frontend tab | Status |
| --- | --- |
| Device Enrollment | idle / new |
| Authenticated (Claimed) Devices | claimed |
| Active Devices | authenticated, `is_active` = true |
| Inactive Devices | authenticated, `is_active` = false |
| Rejected Devices | rejected |
Authenticated devices are periodically re-authenticated on a per-profile schedule (`auth_frequency`). Repeated failures beyond `max_failed_auth_attempts` mark the device inactive. Those two parameters come from the device's profile,
see [*Device Profiles & Groups*.](https://portal.sandgrain.eu/knowledge-base/device-profiles-groups?hsLang=en)
### Two linked but distinct lifecycles
A device is tracked by **two** lifecycles that are related but separate:
- **TrustBridge** maintains the operational device lifecycle above: what the device is allowed to do in your deployment.
- **CyberRock** (SandGrain's cloud authentication service) maintains its own claim/credential lifecycle for the token itself: whether the token is claimed and which cryptographic credentials remain valid.
A token starts **unclaimed** in CyberRock. On the first successful mutual authentication, CyberRock returns `CLAIM_TOKEN` with a `claim_token_id`, which TrustBridge auto-claims. From then on the token is claimed against your tenant. Independently of the claim, CyberRock issues and consumes the token's challenge/response credentials (HCW/HRW): each pair is single-use (`cr-already_used`) and is either fetched live during online import or pre-provisioned in a bulk-import manifest for offline authentication.
### Why the two can disagree
Because the lifecycles are independent, a device can be **claimed in CyberRock yet still idle or rejected in TrustBridge**. And wiping TrustBridge (`start-all wipe`) resets the operational lifecycle but does **not** un-claim the token in CyberRock. Keep this in mind when a device's state looks inconsistent after a reset.
---
*Related articles: [TrustBridge Frontend: First Login & Dashboard](https://portal.sandgrain.eu/knowledge-base/trustbridge-frontend-first-login-dashboard?hsLang=en) · [Device Profiles & Groups](https://portal.sandgrain.eu/knowledge-base/device-profiles-groups?hsLang=en) · [Token Lifecycle Management](https://portal.sandgrain.eu/knowledge-base/token-lifecycle-management-operational-runbook?hsLang=en) · [Bulk Device Import & Offline Authentication](https://portal.sandgrain.eu/knowledge-base/bulk-device-import-offline-authentication?hsLang=en) · [Key Concepts & Glossary](https://portal.sandgrain.eu/knowledge-base/key-concepts-glossary?hsLang=en)*
- [User Documentation](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#main-content)
- [Quick Starter Guide](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#quick-starter-guide)
- [User Manual](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#user-manual)
- [Whitepaper](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#whitepaper)
- [Token Leaflet](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#token-leaflet)
- [Claim Token Procedure](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#claim-token-procedure)
- [Daisy Chain](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#daisy-chain)
- [Release Note](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#release-note)
- [Naming Convention](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#naming-convention)
- [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#sandgrain-sdk)
- [TrustBridge](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#trustbridge)
- [API Documentation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#main-content)
- [Device API Integration](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#device-api-integration)
- [Daisy Chain and Attestation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#daisy-chain-and-attestation)
- [SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#main-content)
- [Core Functions](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#core-functions)
- [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#sandgrain-sdk)
[-1.png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1)-1.png "SandGrain_Logo_RGB_white-bijgesneden (1)-1")](https://portal.sandgrain.eu/?hsLang=en)
[mailto:email@email.com](mailto:email@email.com)
Copyright © 2026, sandgrain.eu