Many (most?) consumer IoT devices onboard through a phone where the customer has to switch over to the IoT device network, provide credentials, switch back etc. Very easy do customers get in trouble not understanding the protocol.
Onboarding through NFC i.e., hold a phone to the IoT's device NFC tag whereby credentials are exchanged appears much easier - at least for the customer. For a device we are developing going the NFC route seems the best way forward. However, I have yet to see a library, sample code, article that discusses how keys and credentials are exchanged in a secure manner. After a phone is set up, it should not be possible for a 3rd party to glean e.g. WiFi credentials or what ever info was exchanged with an NDEF tag reader. Additionally, in our case, we may have a professional installer who does the initial verification of the system (so needs some credentials to connect to the customer's WLAN) but should not be permitted to keep this info.
I can develop the protocol but I rather follow industry expert best practices. Is there anything out there that describes this? Source code would be great but I would be peachy with a best practice white paper already.