ontorelay
Log inStart building
ONTORELAY / FROM IDEA TO FIRST MESSAGE.

From idea to first message.

Connect something real.

OntoRelay gives your MQTT devices a secure home. Create an account, open your dashboard, and follow these steps:

  1. Create a project. Use one project for related devices, a location, or an experiment.
  2. Add a device. Choose Publisher, Subscriber, or Publisher + Subscriber. Creation automatically provisions unique credentials and only the topics that role needs. Optional friendly names replace the default publish topic telemetry and subscribe topic control.
  3. Save the connection details. The Connection window opens immediately with your TLS endpoint, assigned client ID, username, password, and full topic namespaces. The password is shown once. Closing the window or leaving the tab clears it from the page.
  4. Choose your platform. Select Python, Raspberry Pi, ESP32/Arduino, Node.js, Java, PHP, or C#/.NET. Copy the configuration or download the selected example; this first connection window includes your new password in the code.
  5. Connect your device. Follow the example instructions for its libraries, Wi-Fi details, and trusted CA where required. Later, Devices → Connection shows metadata and password placeholders. Use your saved password, or explicitly Rotate if it was lost.

All production device connections use TLS at mqtt.ontorelay.com:8883. Anonymous connections are disabled.

Your first MQTT message

The Connection window and Code generator provide examples for Python, Raspberry Pi, ESP32/Arduino, Node.js, Java, PHP, and C#/.NET. Each uses your assigned client ID and authorized full topics. Passwords are included only in the one-time creation or rotation window; later examples contain a placeholder. With Python, install the MQTT client:

python -m pip install paho-mqtt

Set your generated credentials and full topic as environment variables, then use an MQTT client that verifies the broker’s TLS certificate:

import os
import paho.mqtt.client as mqtt

client = mqtt.Client(
    mqtt.CallbackAPIVersion.VERSION2,
    client_id=os.environ["MQTT_CLIENT_ID"],
)
client.username_pw_set(
    os.environ["MQTT_USER"],
    os.environ["MQTT_PASSWORD"],
)
client.tls_set()
client.connect("mqtt.ontorelay.com", 8883)
client.loop_start()
message = client.publish(
    os.environ["MQTT_TOPIC"],
    '{"temperature": 23.4}', qos=1,
)
message.wait_for_publish(timeout=10)
client.disconnect()
client.loop_stop()

Keep credentials out of source control. Never disable certificate verification to work around a connection error.

Small names. Clear boundaries.

A friendly topic such as temperature becomes a full protected namespace:

or/{customer_id}/{project_id}/{device_id}/temperature

Always use the full namespace copied from Connection or Topics & access. Each topic belongs to one device. The initial publish and subscribe grants follow its selected role; subscriber-only devices do not receive a publish grant. Grant another device subscribe access when it should receive messages from a publisher in the same project. Broker authorization enforces isolation independently of the website.

A subscriber needs a subscription in its MQTT client as well as a platform permission. Subscribe to a publisher’s full topic to receive its telemetry. A subscriber’s own control topic can receive account-authorized commands from the dashboard without granting that device permission to publish.

History when you need it.

Project history is optional. When enabled, the worker stores payloads until your plan’s retention window expires. Disabling history clears that project’s stored payload history. Message and byte accounting remain available independently of telemetry retention.

The dashboard shows recent messages with timestamps, QoS, retained state, and payload format. Payloads do not need to be JSON; binary payloads are displayed as Base64. Last telemetry is the last observed message, not a live connection indicator.

A separate identity for every device.

Device creation provisions a unique username, password, and client ID automatically. Save the one-time connection details before closing the window or leaving the tab. A later Connection view never retrieves or rotates a password. Rotate explicitly replaces credentials and shows a new password once; update the device configuration afterward.

Disable temporarily blocks the existing credentials, while Enable restores those same credentials. Revoke requires a later rotation; revoked credentials cannot simply be enabled again. The dashboard shows credential state separately from online/offline presence.

Use the assigned client ID. If two connections use the same client ID, MQTT session takeover can disconnect the previous client. Configure reconnect backoff and choose QoS according to your delivery needs and plan.

One API for the platform.

The control plane is available under https://api.ontorelay.com/api/v1/. Interactive endpoint and schema documentation is published at api.ontorelay.com/docs.

The hosted dashboard authenticates through the WordPress session and a server-side signed identity. API signing keys and identity tokens stay on the server. The external customer API key flow and mobile authentication are reserved for a later release; a WordPress password is not a public API token.

GET  /api/v1/health
GET  /api/v1/projects
POST /api/v1/projects
GET  /api/v1/devices
POST /api/v1/devices
GET  /api/v1/devices/{id}/connection
POST /api/v1/devices/{id}/credentials
PATCH /api/v1/devices/{id}/credential-state
GET  /api/v1/topics
GET  /api/v1/messages
POST /api/v1/publish
GET  /api/v1/usage

Ownership and plan checks apply on the API. Validation failures return a structured error. The dashboard presents the message and does not silently retry a publish command.

Files live in your storage.

Google Drive, Dropbox, OneDrive, and S3-compatible connections are planned. These providers are not enabled in V1. Do not transfer large files over MQTT or upload them to this WordPress website. A future storage integration will use secure provider authorization and let MQTT carry a file reference.

When a connection needs attention.

  • Authentication failed: verify the latest username, password, and assigned client ID. A credential rotation invalidates the previous password.
  • Publish or subscribe denied: use the full namespace, check the device role, and inspect its topic permissions.
  • No history: check project history, retention, and worker health. Usage may still be recorded when history is disabled.
  • Disconnected repeatedly: check for duplicate client IDs, plan limits, reconnect loops, and TLS errors.
  • Dashboard unavailable: refresh your session. Administrators can inspect API dependencies under WordPress → OntoRelay.

For a support request, include the approximate time, project and device IDs, and the error message. Do not share passwords, API secrets, or provider tokens.