Retrain – ST – iotconnect

Retrain with ST

Retrain with ST lets your edge models keep improving using real-world data. The SensorTile.box PRO device collects data through the mobile app, uploads it to /IOTCONNECT™, and the platform securely sends it to the ST AIoT Craft service to train a new model. The entire integration is backend-to-backend — secure, server-side, and invisible to the browser and the app.

Architecture Summary

The integration between /IOTCONNECT™ and the ST APIs is backend-to-backend (server-to-server). The ST APIs are called only from the /IOTCONNECT™ backend — they are never called from a web browser or from the mobile app. This keeps all credentials and tokens safely on the server.

The SensorTile.box PRO (firmware v3.1.0), through the mobile app, produces inference and data-logging acquisitions, which are uploaded to the /IOTCONNECT™ platform.

A backend process then reads the stored token and calls the ST AIoT Craft APIs to create a dataset, upload the acquisition, run the ML training job, download the resulting model artifact, and clean up the dataset.

Because the token is held and used entirely server-side, the browser-based attack surface does not apply to this integration path.

Environment Setup & Token Lifecycle

Before any data flows, a one-time setup links the two platforms. After that, authentication is fully automated on the server.

Environment-level setup: /IOTCONNECT™ provides the IDS Client ID and Redirect URL to the ST team. The ST team configures them in the ST AWS Cognito environment using Cognito Federation, then provides the Cognito Client ID and Cognito URL back to /IOTCONNECT™.

Secure storage: /IOTCONNECT™ stores the Cognito Client ID and Cognito URL in the backend database in encrypted format. This configuration is maintained separately for each customer and environment.

Token exchange: When the connector is enabled from the portal (Create Association), the backend performs the OAuth2 exchange with ST Identity (Cognito) and stores the resulting token on the server side only — in secure cloud storage (S3) and a secure cache. Tokens are never exposed to the mobile app or to any browser.

Automatic refresh: Access tokens are refreshed automatically on the server side using the refresh-token grant and never leave the backend.

End-to-End Sequence

Putting it all together, here is what happens from the moment the device captures data to the moment a retrained model is ready:

1. The SensorTile.box PRO, via the mobile app, uploads an inference and data-logging acquisition to /IOTCONNECT™.

2. The backend reads the stored access token (refreshing it first if it has expired).

3–5. Using that token, the backend calls the ST AIoT Craft APIs to create a dataset, upload the acquisition, and run the ML training job.

6–7. When training completes, the backend downloads the resulting model artifact.

8. The backend cleans up the dataset on the ST side.

9. The retrained model is made available for the device.

ⓘ NOTE

All ST API calls happen backend-to-backend over HTTPS. ST access and refresh tokens are stored and used only on the server (secure S3 + secure cache) and are never exposed to the mobile app or a browser. Cognito configuration is stored encrypted, separately for each customer and environment.