Every activation is a session. Not two MQTT messages.
Your firmware decides what “on” does. PumpLink decides who may send it, for how long, and keeps the record — authenticated commands, timed sessions, per-device quotas, and one recorded reason every run ended.
It assumes you can wire and flash a device; there is no appliance to plug in.
How it works, and what it doesn't do →
// Credentials come from the dashboard, shown once
// Username is the device ID. Password is the token.
#defineWIFI_SSID"YourNetwork"
#defineWIFI_PASSWORD"YourPassword"
#defineMQTT_USERNAME"42"
#defineMQTT_PASSWORD"••••••••••••"
// Flash it. That's the whole integration.
$ pio run --target upload
✓ Device connected to PumpLink
API operational
MQTT broker online
Per-device ACL enforced
TLS encrypted
Platform
PumpLink owns policy. Your firmware owns the relay.
The device is deliberately dumb about policy. It never receives a duration, a quota, or a user identity — it responds to on and off, and acks both.
Activation with a server-side timer
Trigger a run from the app, dashboard, or API. The backend publishes on, holds the timer itself, and publishes off when the duration expires — it doesn't rely on the device to stop itself.
Scheduling & recurrence
One-shot or recurring activations, set days ahead. The schedule survives a restart and skips missed ticks instead of firing them all at once when it comes back.
Users, roles, and sessions
Registration, login, roles, and revocation are already built. Not one shared password taped to the pump house. Users are free and unlimited; you pay per device.
Full audit trail
Every session records who triggered it, whether it was manual or scheduled, the duration requested, the duration actually measured, and the one reason it ended — ran to completion, force-stopped by an admin, or the connection dropped.
Per-device credentials and ACL
Each device gets its own MQTT username and password, scoped to device/{id}/. Device A cannot publish or subscribe to device B's topics — enforced at the broker, not in your firmware.
State and reachability, separately
Reachability says whether the device is on the network. State says whether it's off, running, or unknown. A device that drops mid-session is recorded as unknown, not off — and won't re-activate until its real state is confirmed.
Per-device runtime quotas
Each device gets its own rolling 24-hour budget. The full duration is reserved before dispatch — if it doesn't fit, the activation is rejected and the device is never commanded. A run already in progress is never cut short.
Push notifications
Notifications when a device activates, finishes, drops off the broker, or has an activation turned down for quota. No polling loop of your own.
Tenant isolation
Devices, users, and logs are scoped per tenant. If you run hardware for more than one customer, they don't see each other's fleet.
Per-user device assignment
Assign specific devices to specific users. Control who can activate, schedule, or even see each device in the fleet.
Integration
What changes on your side.
You already have the hardware and the firmware. Four things happen, and none of them are writing a backend.
01
Create a tenant
Sign up and invite whoever needs access. Users are free and unlimited; devices are what you pay for.
02
Register the device you already have
Register it in the dashboard and you get a numeric device ID and a 24-byte token, shown once. Those are the MQTT username and password — the ID goes in as the username, verbatim.
03
Point your firmware at the broker
Connect to mqtt.pumplink.dev:42743 over TLS, subscribe to device/{id}/command, and ack every on and off within 10 seconds. That's the entire contract. If you'd rather start from working code, the ESP32 firmware is on GitHub.
04
Everything above the broker is already built
Activate on demand, schedule ahead, cap daily runtime, or hand a device to one specific user — from the dashboard, the iOS app, or the API. Every run is logged.
Pricing
Pay for devices. Users are always free.
The free tier covers one device. Scheduling requires a paid plan; manual activation, quota, sessions, and the full activation log are on every tier. No per-seat fees, ever.