# Validation of CPI identity

According to the WInnForum requirements, certain CBSDs require that a Certified Professional
Installer (CPI) validates the installation parameters before they are sent to the SAS.
![CPI identity validation flow](https://developers.google.com/static/spectrum-access-system/images/user-with-role-cpi.png) **Figure 1.** CPI identity validation flow

In the SAS Portal API, we need to validate that a given user has a valid CPI certification before
they can call the
[`SignDevice()`](https://developers.google.com/spectrum-access-system/reference/rest/customers.devices/signDevice)
method. We achieve this with the following two-step validation method:

1. A user with the `role_cpi` role calls the [`GenerateSecret()`](https://developers.google.com/spectrum-access-system/reference/rest/customers.devices/generateSecret) method, which returns a secret.
2. The user signs the secret with their private key and uses the [`ValidateInstaller()`](https://developers.google.com/spectrum-access-system/reference/rest/customers.devices/validate) method to send the encoded version back as a [JWT](https://jwt.io/), along with their CPI ID and the original secret. For more details about token creation, see [JSON Web Token format](https://developers.google.com/spectrum-access-system/guides/json-web-token-format).

> [!NOTE]
> **Note:** For the prior steps, it's assumed that the user is logged in with their Google Account, and the traffic uses HTTPS.

The CPI role privileges become effective only after a user with the `role_cpi` role
successfully completes the CPI validation flow.