Request a demo

Tessera Codes · one-time-code login

The engineer's phone instead of a token

The engineer scans a QR code from the device screen, confirms identity on your corporate sign-in page, and receives a short one-time code. The device verifies the code without a network — it still needs no internet access.

Request a demo Documentation
No token no certificates to issue or hand out — the engineer's phone is enough
SSO / 2FA identity is confirmed by your corporate sign-in — offboarding means instant loss of access
Offline the device verifies the code locally: the network is for the phone, not the device

01 · How it works

QR on the device, code on the phone — only the phone is online

Every code is single-use, expires quickly and is bound to a specific device, role and login attempt.

FLEET OWNER'S PERIMETER Device any device · Linux / Astra QR: device, nonce, level VERIFIED OFFLINE Engineer only the phone is online Tessera Codes sign-in site · SSO / 2FA one-time code issuance server record: who, where, when Tessera Control roles, policies, revocation (CRL) device keys · inventory audit intake for the whole fleet ① scan the QR ② sign in engineer's SSO / 2FA ③ short code ④ enter the code code verified offline, no server call push approval (roadmap) ← background sync: roles · CRL · device keys audit upload when connectivity exists →
fig. 1 — code login: at most the engineer's phone needs a network; login itself never waits for a connection
Energy · contractor

Access under a work order

The contractor scans a QR code with a phone, the dispatcher approves online (four-eyes — a second person signs off), and access lasts only for the duration of the work. The device itself never touches the network.

  1. The ATM shows a QR offline

    device_id · nonce · requested level

  2. The engineer's phone: scan network

    SSO / 2FA

  3. Tessera Codes: every check must pass — otherwise no code network

    work order (ITSM) · shift window · four-eyes · device status · rate-limit → code = MAC(per-device key)

  4. The code on the phone screen network

    one-time, bound to the device and the level

  5. The engineer types the code on the device offline

    Engine verifies the MAC locally → opens the session

fig. 2 — QR login under a work order: the phone is online, the device is not

02 · Security and accountability

The code is short because it carries no rights

The code only references a role

Roles and policies are already delivered to the device — the code merely points at one of them. It is cryptographically bound to the device, the login attempt and the chosen level — it cannot be repurposed.

rights live on the device beforehand

Dual accountability

The server records each issuance: who, for which device, when, at what level. The device keeps its own login journal, chained record by record so no entry can be altered after the fact — offline.

server + device

Access lives in your SSO

Before issuing a code the server checks: may this engineer have this level on this device. An engineer offboarded or blocked in SSO gets no more codes, immediately.

issuance is a server decision

One platform with Tessera Access

Codes is enabled on the same open-source Tessera agent — nothing to reinstall on the devices. Shared roles, shared Tessera Control, shared audit journal.

the same agent on the device

Need certificate login with contractor delegation, fully server-free? That's Tessera Access, already in production across bank ATM fleets. Learn more →

Next step — a pilot on your fleet

We connect your SSO, take a few devices and run through real field-maintenance scenarios.

Discuss a pilot Documentation

or email us: tessera@tessera-access.com