Claim a ready-to-use tag

A ready-to-use tag arrives locked, with a claim card. Claiming it swaps the card’s keys for your own, so only your server can check its taps from then on, and the card stops being useful to anyone.

Check the seal first

If the seal over the claim code was already broken when the card arrived, don’t claim that tag. Someone may have read the code first. Contact the seller for a new one.

Version

Claiming needs knurctl, knurd and the Knura app newer than 0.3.0-alpha.

KnuraPaired

What do you want to do with a tag?

Set up a tagGive it Knura keys

Tag infoUID, keys, link

Check a tapIs this tag genuine?

Reset tagBack to factory keys

Claim a tagIt came with a claim card

Claim a tag

Scan the QR code on the claim card, or type the code under its seal.

Scan cardType code

Point the camera at the card

Knura tag04DE5F1EACC040

Code checkedFor tag 04DE5F1EACC040

Claim a tag

Hold a tag to the back

Keep it still until you see the result.

1. Unlocked
2. Tag found
3. Keys swapped for your own

NTAG 424 DNA

Claim a tag

Tag claimed

Only your server can check its taps now.

UID

04DE5F1EACC040

Keys

Your own, from your master key

Pack card

3 tags claimed

Copy detailsClaim next tag

1. 1Open Claim a tagOn the app's home screen, tap Claim a tag.
2. 2Scan the cardTap Scan card and point the camera at the QR code. Or tap Type code and type the code under the seal.
3. 3The app checks the codeA typo is caught here, before anything touches the tag.
4. 4Hold the tag to the phoneUnlock, then hold the tag flat against the back. Your server swaps the card's keys for your own.
5. 5It's yoursThe tag now answers only to your server. With a pack card, tap Claim next tag for the next one.

PauseExample values. Click a step to jump to it.

The claim card

The card shows the tag’s UID, its claim code and a QR code holding both. Keep it until every tag it opens is claimed.

On the card	Example
Tag UID	04DE5F1EACC040
Claim code	28 letters and digits in groups of four, like 0004-1061-050R-3GG2-8A1C-60T3-GFQS
QR code	knura://claim?uid=<UID>&code=<code>

Claim it

Phone app

1. Open Claim a tag. In the Knura app, tap Claim a tag, then Start.

2. Scan the card. Scan the QR code, or tap Type code and type the claim code.

3. Hold the tag to the phone. Unlock, then hold the tag to the back of the phone until it says it’s done.

4. It’s yours. The app says the tag is claimed. With a pack card, tap Claim next tag for the next one.

The app checks the code for typos and, with the QR code, that you’re holding the card’s own tag. The code goes only to your server, which forgets it when the claim is done.

knurctl

Put the tag on the reader and run, with the code from your card:

knurctl provision --from claim:0004-1061-050R-3GG2-8A1C-60T3-GFQS

Case, spaces and dashes don’t matter, and O, I and L are read as 0, 1 and 1. A typo is caught before knurctl touches the tag.

To also check that the tag on the reader is the one the card was made for, give the whole link from the QR code, in quotes because of its &:

knurctl provision --from 'claim:knura://claim?uid=04DE5F1EACC040&code=...'

Pack cards

A pack can come with one card for all of its tags instead of one card each. The pack card says how many tags it claims instead of showing a UID. Claim each tag the same way; the app offers Claim next tag so you don’t scan the card again. With knurctl, run the same command once per tag.

Each tag still gets keys of its own, so claiming one doesn’t touch the others. Claim them all before you throw the card away: an unclaimed tag can’t be claimed without it.

If something goes wrong

What you see	What it means
The code doesn’t open a tag you’ve never claimed	Someone else may have claimed it already. Stop, keep the card and the tag, and contact the seller with the tag’s UID.
The code doesn’t open the next tag of a pack	That tag is already claimed. Move on to the next one.

To put an unclaimed tag back to factory keys instead, run knurctl reset --from claim:CODE.

How it works

The claim code holds a random secret. All of the tag’s keys come from that secret and the tag’s UID, so a card only opens its own tag. The open format is described in claim-tags.md.