SafeCall Docs

Appearance

Administrator provisioning and first-line support ​

Last updated: 13 September 2026 · English only

How a SafeCall administrator turns on Keryx for SafeCall: pick alert categories, generate a QR on Mobile Access, scan it on their own phone, and get help when something fails.

This is the #120 handbook. It is not the deployer packet (ntfy-deployer.md) and not the phone-side app guide (app-onboarding-guide.md, #121). #120 is closed (13 September 2026). OA-120-admin-walk is done (one SafeCall user installed and scanned the QR). Czech handbook stays on #108. Do not close #117, #121, #124, or #125 from this page.

Do not put QR photos, tk_… tokens, passwords, or real client names / MAC addresses in git, chat, or tickets.

The Mobile Access card is titled Phone alerts. Use the friendly category names below. Do not set up the official ntfy app as the supported path. The on-screen manual-fallback line means “contact the SafeCall support channel,” not “configure a generic client.” The ntfy server URL stays under Admin features, not on the ordinary card.

1. Prerequisites ​

  • A contracted SafeCall installation you can sign into as an administrator.
  • Alert notifications enabled on that install (the QR button stays disabled until they are).
  • Keryx for SafeCall installed from the store or Internal testing (Play / TestFlight). Sideloaded or official-ntfy-app installs are not this handbook.
  • On the phone: Camera (to scan) and Notifications allowed for Keryx.

Keryx is a free companion for that SafeCall deployment. Downloading it does not buy SafeCall.

2. Friendly categories ​

On SafeCall open Mobile Access. Select the categories this phone should receive. Default operational set (leave these checked unless you have a reason not to):

Category (what you see)Typical meaning
Sensor threshold alertsTemperature / humidity out of range
Panic button alertsPanic button press
Watch button alertsWatch button press
Low battery alertsLow battery on a button or sensor
Device not seen alertsPanic, watch, or sensor stopped reporting
Calibration expiryAssigned sensor past its calibration interval
Installation health alertsInstall / fleet problems

Keep Admin features collapsed unless sourcectl asked you to open it.

Admin featureWhen to use
Notification pipeline testsNeeded so Send test notification reaches this QR. Leave it off for everyday phones unless you are proving the path.
Grant debug/admin accessSupport-only. Shows extra diagnostic fields in Keryx. Still must not show subscribe secrets. Requires a warning confirmation.

You do not need topic IDs or server URLs. Those stay with deployers.

3. Generate the QR and scan it ​

  1. Click Generate Keryx QR.
  2. Scan it on the administrator’s own phone with Keryx (not a photo from someone else, not email, not Slack).
  3. Treat the QR as a secret. Anyone who scans it can receive those categories until support revokes the credential.
  4. Do not photograph the QR into chat or tickets.

If you included pipeline tests or debug access, confirm the warning modal before the QR appears.

4. First test ​

  1. Keep Notification pipeline tests selected on the QR you just generated.
  2. On Mobile Access click Send test notification.
  3. Keep Keryx open on Active. You should see a low-priority test card. Recheck / this test stay quiet (priority=min). Watch/Panic Test Send on those device pages is louder (urgent) and is a different control.
  4. Optional: swipe Keryx away and confirm a lock-screen banner. First-device proof already landed; the full OEM/Focus matrix is #117.

If the QR did not include pipeline tests, generate a new one that does. Keryx will not show that Mobile Access test otherwise.

5. Day-to-day ​

  • Active / Archive — current vs older alerts. Marking read is local. It does not confirm to SafeCall that you saw it.
  • Pause — suppresses banners on this phone until you resume.
  • Rescan — replace this phone’s categories with a new QR.
  • Category cards follow the cadence SafeCall already uses (immediate panic/watch, slower summaries for some fleet items). You do not tune ntfy from Keryx.

Keryx notifications are supplemental. Keep site SOPs, phone/radio, and the SafeCall web UI. Keryx is not a guaranteed emergency channel and does not use Apple Critical Alerts.

6. Lost phone, replacement, staff leave ​

There is no revoke button in the SafeCall admin UI today. An API exists for deployers (DELETE by token id). Ordinary administrators:

  1. Generate a new QR for the replacement phone and scan it there.
  2. Open the SafeCall support channel. Ask them to revoke the old credential. Give date, who held the phone, and categories — not the QR and not a token.
  3. If the old phone is still in hand: Reset App or uninstall after support confirms revoke.

Until revoke, the old phone can still receive those categories.

7. Reset and uninstall ​

Reset App clears local config and history on that phone. It does not revoke the subscribe credential. Uninstall is the same: the credential stays live until support/deployer revoke.

Offboarding is always: revoke, then reset or uninstall.

8. Limitations (say these out loud) ​

From safety-claims.md:

  • Delivery is not guaranteed.
  • Focus / Do Not Disturb, mute, denied notification permission, force-stop, OEM battery limits, offline / captive portal, and pause can delay or hide alerts.
  • Keryx is not a medical device and not a sole alarm channel.
  • Opening or marking an alert in the app is not a receipt to SafeCall.

9. Troubleshooting ​

Try these before escalating. Do not ask the administrator to paste a QR or configure a generic ntfy client.

SymptomWhat to try
Camera deniediOS/Android settings → Keryx → Camera. Then rescan.
No bannersSettings → Keryx → Notifications on. Turn off Focus/DND for a test. Confirm the app is not paused.
Scan succeeded, nothing arrivesConfirm categories on the QR include what you are testing. Send the Mobile Access test with pipeline tests selected. Confirm SafeCall alert notifications are enabled.
Android: works only while openDo not enable a perpetual foreground service. Check OEM battery / autostart exceptions only if sourcectl asked. Force-stop can block wake until reopen.
iOS: silent on lock screenFocus/DND; notification permission; this build uses ordinary notifications, not Critical Alerts. Closed-app wake is APNs through the current store/Internal build. Host/APNs credential failures go to the SafeCall channel, not a generic ntfy app.
Old alerts, no new onesNetwork; try rescan; cache can expire if the phone was offline a long time.
Version mismatchInternal 1.0.0+3 cannot receive the closed-app FCM wake. Use the current store/Internal build (first-device proof used 1.2.1 (8)).

Host / TLS / auth / “alerts leave SafeCall but no one receives them” belongs to the SafeCall support channel and, if needed, the restricted ntfy-deployer.md packet. Do not teach ordinary administrators server URLs or tokens.

10. Diagnostics, severity, escalation ​

Redact. Tickets and chat may include: OS version, Keryx version, which friendly categories, “test sent / not shown”, time (CET/CEST). Never include: QR image, tk_…, subscribe headers, raw JSON from debug access, client names, MACs, or room identifiers.

SeverityMeaningWho
Supplemental-channel degradationMissed or delayed Keryx banners; site SOP still worksSite SOP + SafeCall ops, not “Keryx emergency dispatch”
Core-path product issueCannot provision or test on a supported phoneSafeCall support channel
Host / credentialPublish or subscribe failing on the notify pathSupport escalates to deployer; not an admin self-serve step

Channel: existing SafeCall support path. No standalone Keryx mailbox, public status page, 24/7 desk, or emergency-dispatch SLA.

HoursTarget
Czech business hours, Monday–Friday, CET/CESTNext-business-day first response for ordinary contacts
Supported-tier core-path incidentsSame-business-day acknowledgment by the go/no-go owner when reported through SafeCall

These are support-process targets, not alert-delivery SLAs. Draft source: legal/support.md.