Secure gateway onboarding via mobile devices for internet of things device management

1. A system, comprising:

at least one computing device of a client device; and

a data store of the client device, the data store comprising instructions executable by the at least one computing device, wherein the instructions, when executed, cause the at least one computing device to:

retrieve an onboarding token using a request for the onboarding token that is authenticated based on user credentials associated with a user account with a management service;

cause a gateway account to be created using a request to create the gateway account, wherein the request to create the gateway account is transmitted to the management service, wherein the request to create the gateway account comprises a gateway identifier that uniquely identifies a gateway, and wherein the request to create the gateway account is authenticated based on the onboarding token;

relay gateway credentials for the gateway account from the management service to the gateway, wherein the gateway credentials authenticate communications between the gateway and the management service, and wherein the gateway credentials are stored in the data store of the client device and concealed from users of the client device; and

remove the gateway credentials from the data store based on an event comprising at least one of: a transmission of the gateway credentials to the gateway, a confirmation from the gateway that the gateway credentials are received by the gateway, or a confirmation from the management service that the gateway has checked in using the gateway credentials.

2. The system of claim 1 , wherein the instructions, when executed, further cause the at least one computing device to:

capture image data that depicts the gateway, wherein the image data is captured by a camera device of the client device; and

analyze the image data to identify the gateway identifier of the gateway.

3. The system of claim 2 , wherein the gateway identifier is identified based on a machine-readable identifier in the image data, and wherein the gateway identifier is encoded in the machine-readable identifier.

4. The system of claim 2 , wherein the gateway identifier is identified based on optical character recognition of characters in the image data.

5. The system of claim 1 , wherein the gateway credentials comprise a username and password associated with the gateway account.

6. The system of claim 1 , wherein the gateway credentials comprise a certificate associated with the management service.

7. The system of claim 1 , wherein the instructions, when executed, further cause the at least one computing device to:

determine that the onboarding token is expired based on timeout data associated with the onboarding token; and

obtain an updated onboarding token based on a certificate associated with a user identifier and a device identifier that uniquely identifies the client device.

8. A non-transitory computer-readable medium embodying instructions executable in at least one computing device of a client device wherein the instructions, when executed, cause the at least one computing device to:

retrieve an onboarding token using a request for the onboarding token that is authenticated based on user credentials associated with a user account with a management service;

cause a gateway account to be created using a request to create the gateway account, wherein the request to create the gateway account is transmitted to the management service, wherein the request to create the gateway account comprises a gateway identifier that uniquely identifies a gateway, and wherein the request to create the gateway account is authenticated based on the onboarding token;

relay gateway credentials for the gateway account from the management service to the gateway, wherein the gateway credentials authenticate communications between the gateway and the management service, and wherein the gateway credentials are stored in a data store of the client device and concealed from users of the client device; and

remove the gateway credentials from the data store based on an event comprising at least one of: a transmission of the gateway credentials to the gateway, a confirmation from the gateway that the gateway credentials are received by the gateway, or a confirmation from the management service that the gateway has checked in using the gateway credentials.

9. The non-transitory computer-readable medium of claim 8 , wherein the instructions, when executed, further cause the at least one computing device to:

capture image data that depicts the gateway, wherein the image data is captured by a camera device of the client device; and

analyze the image data to identify the gateway identifier of the gateway.

10. The non-transitory computer-readable medium of claim 9 , wherein the gateway identifier is identified based on a machine-readable identifier in the image data, and wherein the gateway identifier is encoded in the machine-readable identifier.

11. The non-transitory computer-readable medium of claim 9 , wherein the gateway identifier is identified based on optical character recognition of characters in the image data.

12. The non-transitory computer-readable medium of claim 8 , wherein the gateway credentials comprise a username and password associated with the gateway account.

13. The non-transitory computer-readable medium of claim 8 , and wherein the gateway credentials comprise a certificate associated with the management service.

14. A method implemented using a client device, the method comprising:

retrieving an onboarding token using a request for the onboarding token that is authenticated based on user credentials associated with a user account with a management service;

causing a gateway account to be created using a request to create the gateway account, wherein the request to create the gateway account is transmitted to the management service, wherein the request to create the gateway account comprises a gateway identifier that uniquely identifies a gateway, and wherein the request to create the gateway account is authenticated based on the onboarding token; and

relaying gateway credentials for the gateway account from the management service to the gateway, wherein the gateway credentials authenticate communications between the gateway and the management service, and wherein the gateway credentials are stored in a data store of the client device and concealed from users of the client device; and

removing the gateway credentials from the data store based on an event comprising at least one of: a transmission of the gateway credentials to the gateway, a confirmation from the gateway that the gateway credentials are received by the gateway, or a confirmation from the management service that the gateway has checked in using the gateway credentials.

15. The method of claim 14 , further comprising:

capturing image data that depicts the gateway, wherein the image data is captured by a camera device of the client device; and

analyzing the image data to identify the gateway identifier of the gateway.

16. The method of claim 15 , wherein the gateway identifier is identified based on a machine-readable identifier in the image data, and wherein the gateway identifier is encoded in the machine-readable identifier.

17. The method of claim 15 , wherein the gateway identifier is identified based on optical character recognition of characters in the image data.

18. The method of claim 14 , wherein the gateway credentials comprise a username and password associated with the gateway account.

19. The method of claim 14 , wherein the gateway credentials comprise a certificate associated with the management service.

20. The method of claim 14 , further comprising:

determining that the onboarding token is expired based on timeout data associated with the onboarding token; and

obtaining an updated onboarding token based on a certificate associated with a user identifier and a device identifier that uniquely identifies the client device.