Setting protection levels

The following diagram illustrates the generalized flow for setting protection levels during development:

sequenceDiagram
    participant N as nRF Util
    participant U as UICR
    participant D as Device

    Note over N,D: nrfutil device protection-set
    N->>U: Writes Enabled to UICR.APPROTECT
    N->>D: Resets the device
    Note right of D: AP-Protect active
    Note right of D: Debug access now blocked

Note

With devices that use software AP-Protect, nRF Util cannot enable hardware AP-Protect if the software AP-Protect is already enabled. If you encounter errors with nRF Util, make sure that software AP-Protect is disabled. For more information, see Managing access port protection in the nRF Connect SDK documentation.

To enable readback protection on a device, use the following command pattern:

nrfutil device protection-set <protection_level> --serial-number <serial_number>

Where <protection_level> can have device-specific values, as described in the following sections.

Note

If you use protection-set commands with a multi-core device, they will only set the status for the application core. For multi-core devices, you can set the protection status for a specific core using the --core option, like in the following command pattern:

nrfutil device protection-set All --core <core_id> --serial-number <serial_number>

If you do not specify the --core, the application core is assumed by default.