Ah, I see. My app is constantly connected to an MQTT broker so in my case there's no overhead with the client being rather rich -- it's the main resource consumer but for a good reason. I'm unsure though about using MQTT only to flag that there's a new release, then downloading it via http (so compiling a whole new stack for this exclusive singular use case) when I could get it directly and without even asking for it. Agree that the UUID is a reasonable replacement for authentication token in an HTTPS context. By the way, does 'jag flash' encrypt the flash? I'm already encrypting my secrets but an encrypted flash would be better. Thanks for the thread, I'll read it!