API security, generated router identifiers and secrets

Prerequisites and authority

Network/RouterOS authority, known topology and a recovery management path are required. Preserve existing router configuration before managed changes.

Protect both directions of router authentication

API credentials authenticate BryanNet to MikroTik. Generated router identifiers/secrets authenticate managed router events back to BryanNet. They have different owners and rotation consequences.

Use a dedicated RouterOS API account, private management path and protected BryanNet configuration. The prior guide describes encrypted storage for generated router secrets; source inspection must establish the exact bootstrap and rotation behavior for the target release.

Do not copy API passwords, encrypted secrets, generated event URLs or internal service tokens into ordinary support tickets. Even an encrypted credential field is outside the public diagnostic query set.

For API credential rotation, preserve a working administrative router path, update the dedicated account and BryanNet configuration in a controlled window, then test authentication and synchronization. Do not rotate the router event secret manually on only one side.

For generated-secret rotation, use the supported product workflow and verify that managed scripts receive the new value. Old script versions or scheduler entries may otherwise keep sending rejected events.

If credentials are compromised, capture the scope, restrict the path, rotate through the supported process and check audit/event records. Verify both communication directions after recovery.

API security, generated router identifiers and secrets

Prerequisites and authority

Protect both directions of router authentication

Related guides