Engine API and TURN credentials with mTLS

Devices using a client certificate can now access the Engine HTTP API and request short-lived TURN credentials. They no longer need a separate token or application secret for these operations.

Certificate credentials expose Engine and TURN permissions in the dashboard. Grant only the operations and project resources the device needs. Existing certificates keep their previous permissions; TURN issuance must be granted explicitly. The Control plane remains authenticated by tokens or sessions.

The Go and Node SDKs discover the dedicated mTLS API address anonymously and cache it in memory for the lifetime of the client. Credential renewal reuses that discovery. Existing configuration and enrollment flows continue to work, and an explicit mtlsApiUrl can be supplied when needed. Ordinary browser connections continue to use the existing API address without a client-certificate prompt.

Go and JavaScript now share the same TURN selection rules: eligible credentials derive locally when the required metadata is available; otherwise they use the Control plane with Engine fallback on availability failures. Certificate clients use Engine directly. Both managed APIs return the same response format and enforce the same issuance permission and lifetime limits.

With the appropriate Engine permissions, certificate contexts also support CLI inventory, watch, ui, and related resource operations. doctor recognizes the dedicated API and distinguishes missing permissions from connectivity failures. Operations that require Control plane data retain that requirement. Go supports HTTP/3 over QUIC as well as HTTPS over TCP; the Node HTTP client supports HTTPS and SSE, and Python supports HTTPS, SSE, and WebSocket watches.

See mTLS, STUN and TURN, and the CLI command reference for configuration and permissions.