WiFi Provisioning for IoT Devices: SmartConfig vs BLE Provisioning

WiFi Provisioning for IoT Devices: SmartConfig vs BLE Provisioning

Getting your IoT device connected to WiFi without a screen or keyboard is one of the most common challenges in embedded development. WiFi provisioning for IoT devices using SmartConfig and BLE are the two dominant approaches every maker in India needs to know. Whether you are building a smart home gadget, an industrial sensor, or a consumer product, choosing the right provisioning method determines user experience, reliability, and time-to-market. This guide covers both techniques in depth so you can pick the best one for your project.

What Is WiFi Provisioning?

WiFi provisioning is the process of securely transferring your network SSID and password to a headless IoT device — one that has no display or physical keyboard. Think of smart bulbs, temperature loggers, door locks, or any microcontroller-based product that needs to join your home or office WiFi.

The challenge: the device cannot show a screen to ask for credentials, and typing them via a serial port is impractical for end users. Provisioning methods solve this by using a secondary channel — either a phone’s WiFi frame broadcast (SmartConfig) or a Bluetooth Low Energy link (BLE provisioning) — to pass credentials securely during first-time setup.

The two most popular approaches in the ESP32/ESP8266 ecosystem are Espressif SmartConfig (also called ESP-TOUCH) and BLE Provisioning using the esp_prov manager library. Each has distinct advantages depending on your product’s hardware, target audience, and network environment.

SmartConfig Explained

SmartConfig (ESP-TOUCH) was developed by TI and later adopted by Espressif. It works by putting the ESP chip’s WiFi radio into promiscuous mode — listening to all packets in the air — while a companion phone app encodes the WiFi password inside UDP broadcast or multicast packet lengths. The device sniffs these packets, decodes the credentials, and joins the network.

How SmartConfig Works Step by Step

1. Device powers on and sets WiFi mode to station + promiscuous sniffing.
2. User opens the ESP-TOUCH or Espressif BLE Provisioning app on their phone.
3. App encodes SSID and password into a sequence of UDP packets with varying lengths.
4. Device decodes the sequence, extracts credentials, and connects to the AP.
5. Device sends its IP back to the app via a UDP broadcast confirmation.

SmartConfig Limitations

• 5 GHz band: SmartConfig only works on 2.4 GHz networks. Most Indian home routers support 2.4 GHz, but dual-band routers with band steering can confuse phones into sending on 5 GHz.
• Hidden SSIDs: SmartConfig cannot handle hidden networks — the SSID is not broadcast for the device to discover.
• Router isolation: Some routers with AP isolation or “guest” networks block the necessary broadcasts.
• Reliability: In noisy RF environments (apartments with many WiFi networks), packet decoding can fail or take longer.

BLE Provisioning Explained

BLE provisioning uses Bluetooth Low Energy as a secure, dedicated side-channel to transfer WiFi credentials. The ESP32 starts a BLE GATT server advertising a provisioning service. The phone app scans for the device, connects, authenticates using a proof-of-possession (PoP) pin, and writes the SSID/password as encrypted GATT characteristics.

How BLE Provisioning Works Step by Step

1. ESP32 starts BLE advertising with a device name like PROV_MYDEVICE.
2. User opens the Espressif Provisioning app and scans for BLE devices.
3. App connects and performs session establishment (Curve25519 key exchange + AES-GCM encryption).
4. User optionally enters a PoP pin displayed on the device (or printed on the label).
5. App sends encrypted SSID and password; ESP32 decrypts and connects to WiFi.
6. App receives success confirmation and provisioning ends.

Security Advantages of BLE Provisioning

Unlike SmartConfig which broadcasts credentials (even if obfuscated by packet lengths), BLE provisioning uses proper end-to-end encryption via the proto-comm security layer. The PoP pin prevents unauthorized devices from eavesdropping on provisioning packets. This makes BLE provisioning a much better choice for commercial products or any project where security matters.

SmartConfig vs BLE: Head-to-Head Comparison

Verdict: For DIY projects and ESP8266 boards where BLE is unavailable, SmartConfig is a quick and working solution. For anything with an ESP32 that may end up with real users, BLE provisioning’s security and reliability make it the professional choice.

Implementing SmartConfig on ESP32

The ESP-IDF and Arduino ESP32 core both include SmartConfig support. Here is the Arduino sketch skeleton:

#include <WiFi.h>

void setup() {
  Serial.begin(115200);
  WiFi.mode(WIFI_AP_STA);
  WiFi.beginSmartConfig();

  Serial.println("Waiting for SmartConfig...");
  while (!WiFi.smartConfigDone()) {
    delay(500);
    Serial.print(".");
  }
  Serial.println("nSmartConfig received. Connecting...");

  while (WiFi.status() != WL_CONNECTED) {
    delay(500);
    Serial.print(".");
  }
  Serial.print("nConnected. IP: ");
  Serial.println(WiFi.localIP());
  // Save credentials to NVS using Preferences library
  // WiFi library auto-saves to flash on ESP32
}

void loop() {
  // Your application code here
}

To trigger reprovisioning, add a button that clears saved credentials (WiFi.disconnect(true)) and restarts the device. The Espressif ESP-TOUCH app (available on Google Play Store and Apple App Store) is the standard companion app used in India.

Implementing BLE Provisioning on ESP32

BLE provisioning uses the WiFiProv.h library available in the Arduino ESP32 core 2.x and later. It wraps the ESP-IDF unified provisioning manager.

#include <WiFiProv.h>
#include <WiFi.h>

const char *pop = "abcd1234"; // Proof-of-possession pin
const char *service_name = "PROV_ZBOTIC";
const char *service_key = NULL; // BLE does not need this

void SysProvEvent(arduino_event_t *sys_event) {
  switch (sys_event->event_id) {
    case ARDUINO_EVENT_WIFI_STA_GOT_IP:
      Serial.print("nConnected IP: ");
      Serial.println(IPAddress(sys_event->event_info.got_ip.ip_info.ip.addr));
      break;
    case ARDUINO_EVENT_PROV_START:
      Serial.println("nProvisioning started. Scan QR code or connect via BLE app.");
      break;
    case ARDUINO_EVENT_PROV_CRED_RECV:
      Serial.println("nCredentials received.");
      break;
    case ARDUINO_EVENT_PROV_CRED_SUCCESS:
      Serial.println("nProvisioning successful!");
      break;
    default: break;
  }
}

void setup() {
  Serial.begin(115200);
  WiFi.onEvent(SysProvEvent);
  WiFiProv.beginProvision(
    NETWORK_PROV_SCHEME_BLE,
    NETWORK_PROV_SCHEME_HANDLER_FREE_BTDM,
    NETWORK_PROV_SECURITY_1,
    pop,
    service_name,
    service_key
  );
}

void loop() { delay(10); }

The companion app is Espressif BLE Provisioning on the Play Store. Once provisioned, credentials are stored in NVS (Non-Volatile Storage) and the device automatically reconnects on subsequent boots without going through provisioning again.

Adding a Reset Button for Re-provisioning

Always include a long-press reset mechanism in your firmware. Call wifi_prov_mgr_reset_provisioning() (IDF) or erase the NVS partition to force the device back into provisioning mode. Without this, a user who changes their router password has no way to reprovision without a serial connection.

Recommended Modules for WiFi Provisioning Projects

Ai Thinker ESP32-C3-01M Wi-Fi + BLE Module

Compact ESP32-C3 module with onboard WiFi and BLE 5.0 — ideal for BLE provisioning in space-constrained IoT designs. RISC-V core, low power.

View on Zbotic

Ai-Thinker ESP32-C3-12F Wi-Fi + BLE Module

Larger ESP32-C3 module with 4MB flash and PCB antenna — perfect for BLE provisioning with SmartConfig fallback in production IoT firmware.

View on Zbotic

Ai Thinker ESP32 CAM Development Board WiFi+Bluetooth

Full ESP32 with camera — supports BLE provisioning out of the box. Great for smart camera or doorbell projects that need easy first-time WiFi setup.

View on Zbotic

Waveshare ESP32-C3 0.71inch Round Display Development Board

ESP32-C3 with a tiny round display — show QR code for BLE provisioning or display PoP pin to the user during setup. Compact and stylish.

View on Zbotic

0.96 Inch I2C OLED LCD Module SSD1306

Display provisioning status, IP address after connection, or QR code on this compact OLED. Pairs well with any ESP32 provisioning project.

View on Zbotic

Frequently Asked Questions

Can I use SmartConfig on a 5 GHz WiFi network?

No. SmartConfig relies on packet sniffing in promiscuous mode, which only works reliably on 2.4 GHz channels. If your phone connects to 5 GHz when both bands share the same SSID, SmartConfig will fail. Temporarily force your phone to 2.4 GHz, or switch to BLE provisioning which does not have this limitation.

Does BLE provisioning permanently use BLE on the ESP32?

No. Once provisioning is complete, the BLE stack is released by calling wifi_prov_mgr_deinit(), freeing memory and radio resources. The ESP32 then operates in WiFi-only mode. BLE is only active during the short provisioning window.

How do I prevent unauthorized users from provisioning my device?

With BLE provisioning, always use a unique Proof-of-Possession (PoP) pin per device — ideally printed on a label or shown on a display. This ensures only the physical owner can provision the device. SmartConfig offers no equivalent protection; avoid it for products with security requirements.

What happens if provisioning fails midway?

Set a timeout in your provisioning code (e.g., 3 minutes). If no credentials are received within the timeout, restart the device or revert to a captive portal fallback. Always blink an LED to indicate provisioning mode vs connected mode so users know the device is waiting.

Can I combine SmartConfig and BLE provisioning?

Yes. A common pattern is to try restoring saved credentials from NVS first, then offer BLE provisioning as the primary method, with SmartConfig as a fallback for phones without BLE. The ESP-IDF provisioning manager supports custom transport schemes for this kind of hybrid approach.