diff --git a/.github/workflows/dangerjs.yml b/.github/workflows/dangerjs.yml
deleted file mode 100644
index 07871a79a9a0..000000000000
--- a/.github/workflows/dangerjs.yml
+++ /dev/null
@@ -1,27 +0,0 @@
-name: DangerJS Pull Request review
-
-on:
-  pull_request_target:
-    types: [opened, edited, reopened, synchronize]
-
-permissions:
-  pull-requests: write
-  contents: write
-
-jobs:
-  pull-request-style-linter:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Check out PR head
-      uses: actions/checkout@v4
-      with:
-        ref: ${{ github.event.pull_request.head.sha }}
-
-    - name: DangerJS pull request linter
-      uses: espressif/shared-github-dangerjs@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        instructions-gitlab-mirror: 'true'
-        instructions-contributions-file: 'CONTRIBUTING.md'
-        instructions-cla-link: 'https://cla-assistant.io/espressif/esp-idf'
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
deleted file mode 100644
index 88deb00f9b46..000000000000
--- a/.github/workflows/docker.yml
+++ /dev/null
@@ -1,87 +0,0 @@
-name: docker
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'release/*'
-    tags:
-      - 'v*.*'
-
-env:
-  # Platforms to build the image for
-  BUILD_PLATFORMS: linux/amd64,linux/arm64
-  DOCKERHUB_REPO: ${{ github.repository_owner }}/idf
-
-jobs:
-  docker:
-    # Disable the job in forks
-    if: ${{ github.repository_owner == 'espressif' }}
-
-    runs-on: ubuntu-latest
-    steps:
-      # Depending on the branch/tag, set CLONE_BRANCH_OR_TAG variable (used in the Dockerfile
-      # as a build arg) and TAG_NAME (used when tagging the image).
-      #
-      # The following 3 steps cover the alternatives (tag, release branch, master branch):
-      - name: Set variables (tags)
-        if: ${{ github.ref_type == 'tag' }}
-        run: |
-          echo "CLONE_BRANCH_OR_TAG=$GITHUB_REF_NAME" >> $GITHUB_ENV
-          echo "TAG_NAME=$GITHUB_REF_NAME" >> $GITHUB_ENV
-      - name: Set variables (release branches)
-        if: ${{ github.ref_type == 'branch' && startsWith(github.ref_name, 'release/') }}
-        run: |
-          echo "CLONE_BRANCH_OR_TAG=$GITHUB_REF_NAME" >> $GITHUB_ENV
-          echo "TAG_NAME=release-${GITHUB_REF_NAME##release/}" >> $GITHUB_ENV
-      - name: Set variables (main branch)
-        if: ${{ github.ref_type == 'branch' && github.ref_name == 'master' }}
-        run: |
-          echo "CLONE_BRANCH_OR_TAG=master" >> $GITHUB_ENV
-          echo "TAG_NAME=latest" >> $GITHUB_ENV
-
-      # Display the variables set above, just in case.
-      - name: Check variables
-        run: |
-          echo "CLONE_BRANCH_OR_TAG: $CLONE_BRANCH_OR_TAG"
-          echo "CHECKOUT_REF: $CHECKOUT_REF"
-          echo "TAG_NAME: $TAG_NAME"
-
-      # The following steps are the standard boilerplate from
-      # https://github.com/marketplace/actions/build-and-push-docker-images
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Login to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Set up QEMU for multiarch builds
-        uses: docker/setup-qemu-action@v2
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-      - name: Build and push
-        uses: docker/build-push-action@v3
-        with:
-          context: tools/docker
-          push: true
-          tags: ${{ env.DOCKERHUB_REPO }}:${{ env.TAG_NAME }}
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: |
-            IDF_CLONE_URL=${{ github.server_url }}/${{ github.repository }}.git
-            IDF_CLONE_BRANCH_OR_TAG=${{ env.CLONE_BRANCH_OR_TAG }}
-
-      - name: Update Docker Hub repository description (master branch)
-        if: ${{ github.ref_type == 'branch' && github.ref_name == 'master' }}
-        uses: peter-evans/dockerhub-description@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          # Token based authentication is not supported here:
-          # https://github.com/peter-evans/dockerhub-description/issues/10
-          # https://github.com/docker/roadmap/issues/115#issuecomment-891694974
-          password: ${{ secrets.DOCKERHUB_PASSWORD }}
-          repository: ${{ env.DOCKERHUB_REPO }}
-          readme-filepath: ./tools/docker/README.md
diff --git a/MutuallyHuman_Fork_Changes.md b/MutuallyHuman_Fork_Changes.md
new file mode 100644
index 000000000000..6d810f3bac24
--- /dev/null
+++ b/MutuallyHuman_Fork_Changes.md
@@ -0,0 +1,213 @@
+# MututallyHuman ESP IDF v5.5.1 Changes
+
+The following is an analysis of the changes to [ESP IDF](https://github.com/espressif/esp-idf) `v5.5.1` in this [MutuallyHuman fork](https://github.com/mhs/esp-idf) on branch `mhs_changes_v5.5.1`. The purpose is to categorize the changes into features and describe their purpose and usage in the [Callbox Embedded Starter Kit](https://github.com/msx/callbox-embedded/). The analysis was originally performed for the `spindance_changes_v5.0` branch against the Espressif `v5.0` tag and has been updated after porting the MutuallyHuman branch to v5.5.1.
+
+Because the esp-idf uprevs from 4.x to 5.0 and from 5.0 to 5.5.1 used squashed patch generation,
+the `spindance_changes_v5.0`  and `mhs_changes_v5.5.1` branches do not include specific commits
+for each MutuallyHuman fork feature. To help provide context, the feature sections include pointers to the original commits where possible (usually on a 4.x branch).
+
+A handy way to view the diff is via this [Github pull request link](TBD).  // FIXME
+
+The original ESP repo and this MutuallyHuman fork can be cloned and viewed separately via:
+```
+git clone git@github.com:espressif/esp-idf.git esp-idf
+cd esp-idf
+git checkout v5.5.1
+
+cd ..
+git clone git@github.com:mhs/esp-idf.git callbox-embedded
+cd callbox-embedded
+git checkout mhs_changes_v5.5.1
+```
+
+## Changed Files
+
+```(text)
+.github/workflows/docker.yml            // DELETED
+MutuallyHuman_Fork_Changes.md           // Renamed from SpinDance_Fork_Changes.md
+components/esp_netif/include/lwip/esp_netif_net_stack.h  (was components/lwip/port/esp32/include/netif/wlanif.h before v5.0)
+components/esp_netif/lwip/netif/wlanif.c
+components/freertos/CMakeLists.txt
+components/json/json.mk
+components/protocomm/include/security/protocomm_security.h
+components/protocomm/include/transports/protocomm_ble.h
+components/protocomm/src/common/protocomm.c
+components/protocomm/src/security/security1.c
+components/protocomm/src/transports/protocomm_nimble.c
+components/wifi_provisioning/include/wifi_provisioning/manager.h
+components/wifi_provisioning/include/wifi_provisioning/wifi_config.h
+components/wifi_provisioning/include/wifi_provisioning/wifi_scan.h
+components/wifi_provisioning/proto-c/wifi_config.pb-c.c
+components/wifi_provisioning/proto-c/wifi_config.pb-c.h
+components/wifi_provisioning/proto-c/wifi_scan.pb-c.c
+components/wifi_provisioning/proto-c/wifi_scan.pb-c.h
+components/wifi_provisioning/proto/wifi_config.proto
+components/wifi_provisioning/proto/wifi_scan.proto
+components/wifi_provisioning/python/wifi_config_pb2.py
+components/wifi_provisioning/python/wifi_constants_pb2.py
+components/wifi_provisioning/python/wifi_scan_pb2.py
+components/wifi_provisioning/src/manager.c
+components/wifi_provisioning/src/wifi_config.c
+components/wifi_provisioning/src/wifi_provisioning_priv.h
+components/wifi_provisioning/src/wifi_scan.c
+tools/idf_tools.py
+```
+
+## Feature List
+The following is a list of the MutuallyHuman Embedded Starter Kit features that the changes in this fork support:
+- Network (NW) Metrics Reporting
+- Protocomm BLE Connectivity Reporting
+- Provisioning State in BLE Advertisement Data (AD)
+- JWT Authorization for Protocomm WiFi Provisioning
+- WPA2 Enterprise NW Support
+- WiFi Provisioning Sequence Changes
+- Python Version Change
+- WICED build system support
+
+## Feature Details
+The features, their associated changes to ESP IDF and how the change is related to the Embedded Starter Kit are described in more detail below:
+- **Network (NW) Metrics Reporting**
+  - Added support for simple bytes in/bytes out tracking and reporting in ESP's LWIP implementation
+  - Embedded Starter Kit accesses these values via its PAL and includes them in metrics reported to MQTT
+  - Impacted ESP IDF files:
+    - esp_netif_net_stack.h
+    - wlanif.c
+  - Original Commits:
+    - [lwip/port/esp32: add metrics for wlan bytes in/out](https://github.com/mhs/esp-idf/commit/ef9b870d0dad29b4993815c323c57202f5c1700b)
+- **Protocomm BLE Connectivity Reporting**
+  - Added reporting of BLE peer connectivity state (connected, connected securely, not connected)
+  - Embedded Starter Kit reports these states to analogous pubsub topic IDs in the pubsub namespace `WIFI_TOPIC_NS`
+  - Note: We'd likely want to implement this for `Security2` if/when we migrate to ESP IDF v5. Used to display LEDs of different colors depending upon the state.
+  - Note 2:  The esp-idf v5.0 added a new `protocomm_transport_ble_event_t` type that had two out of the 3 events that we added in our fork change to add `ble_event`. Since they did NOT include the secure connection event, we continue to use our fork changes. As a result, you'll see a little duplication of events, e.g. in `protocomm_nimble.c`, between our ble_event and their protocomm_transport_ble_event_t. We should keep an eye on the evolution of protocomm_transport_ble_event_t and see if they ever add the secure connection, at which point we would be able to undo our fork changes and be closer to the unmodified esp-idf.
+  - Impacted ESP IDF files:
+    - protocomm_security.h
+    - protocomm_ble.h
+    - protocomm.c
+    - security1.c
+    - protocomm_nimble.c
+  - Original Commits:
+    - [mutually human changes for wifi_provisioning](https://github.com/mhs/esp-idf/commit/56c743a69cf9dce0bf4ce4eab4048a2c1088fdee)
+- **Provisioning State in BLE Advertisement Data (AD)**
+  - Added ability to directly modify the manufacturer specific data in the BLE advertisement.
+  - Embedded Starter Kit uses this to include the WiFi provisioning state in the advertisement
+  - Note: It maybe possible that the ESP IDF provides a different way to modify the advertisement.
+  - Impacted ESP IDF files:
+    - protocomm_ble.h
+    - protocomm_nimble.c
+  - Original Commits:
+    - [mutually human changes for wifi_provisioning](https://github.com/mhs/esp-idf/commit/56c743a69cf9dce0bf4ce4eab4048a2c1088fdee)
+- **JWT Authorization for Protocomm WiFi Provisioning**
+  - Added an auth token property to the Protocomm protobuf messages, which is supplied to an also added optional authorization callback for validation prior to scanning for or configuring a WiFi access point.
+  - Embedded Starter Kit registers an authorization handler that validates the token as a JWT. This feature is disabled in the WiFi configuration in `devkit`.
+  - Note: This was added to validate device claiming.
+  - Impacted ESP IDF files:
+    - Protobuf definition files:
+      - wifi_config.proto
+      - wifi_scan.proto
+      - wifi_config.pb-c.h
+      - wifi_config.pb-c.c
+      - wifi_scan.pb-c.c
+      - wifi_scan.pb-c.h
+      - wifi_config_pb2.py
+      - wifi_constants_pb2.py
+      - wifi_scan_pb2.py
+    - manager.h
+    - manager.c
+    - wifi_config.h
+    - wifi_config.c
+    - wifi_scan.h
+    - wifi_scan.c
+  - Original Commits:
+    - [mutually human changes for wifi_provisioning](https://github.com/mhs/esp-idf/commit/56c743a69cf9dce0bf4ce4eab4048a2c1088fdee)
+- **WPA2 Enterprise NW Support**
+  - Existing internal IDF helper functions that provide information about scanned WiFi access points were made public by moving their declarations to a public IDF header file.
+  - Embedded Starter Kit uses these functions to determine if the access point attempting to be configured is a WPA2 enterprise NW, and then enables or disables support for WPA2 enterprise.
+  - Note: It's possible that a newer version of ESP IDF may sufficiently support WPA2 enterprise. _Also, it's possible that WPA2 enterprise NW support inside the Starter Kit's `wifi` component is not tested or fully functional._
+  - Impacted ESP IDF files:
+    - manager.h
+    - wifi_provisioning_priv.h
+  - Original Commits:
+    - [mutually human changes for wifi_provisioning](https://github.com/mhs/esp-idf/commit/56c743a69cf9dce0bf4ce4eab4048a2c1088fdee)
+- **WiFi Provisioning Sequence Changes**
+  - `WIFI_PROV_SCAN_STARTED` was added to the `wifi_prov_cb_event_t` enum and is reported via the `app_event_handler` in manager.c once a WiFi access point scan is started.
+    - Embedded Starter kit wifi.c listens for `WIFI_PROV_SCAN_STARTED`, at which point it sets a boolean flag `_provisioning_in_progress` indicating WiFi is being used to scan for and configure an access points. It also disconnects wifi via `esp_wifi_disconnect()`, which happens to be one of the calls that is removed in manager.c `wifi_prov_mgr_start_provisioning()`, as discussed below.
+  - Code was removed in manager.c `wifi_prov_mgr_start_provisioning()` to remove steps from the setup when WiFi provisioning is started.
+    - Removed "Start Wi-Fi in Station Mode":
+      - Removed calls: `esp_wifi_set_mode(WIFI_MODE_STA); esp_wifi_start();`
+      - Embedded Starter Kit calls these two functions once, at startup, in `wifi_init()`. It's not clear if calling these again in `wifi_prov_mgr_start_provisioning()` is therefore necessary (apparently it is not), _nor is it clear if calling them again by re-including the removed calls would be problematic_.
+    - Removed "Change Wi-Fi storage to RAM temporarily and erase any old credentials in RAM"
+      - Removed calls: `esp_wifi_set_storage(WIFI_STORAGE_RAM); esp_wifi_set_config(WIFI_IF_STA, &wifi_cfg_empty);`
+      - Based upon the comments, this appears to be a sort of back door means of preventing the **application code** from attempting to auto-reconnect when it receives `WIFI_EVENT_STA_DISCONNECTED` due to the call to `esp_wifi_disconnect()` discussed below. Presumably the auto-reconnect cannot occur or won't succeed due to there being no stored access point credentials.
+      - Embedded Starter Kit wifi.c appears to manage not attempting to reconnect during provisioning. It controls when it calls `esp_wifi_connect()` when it receives `WIFI_EVENT_STA_DISCONNECTED`, only calling it if `_provisioning_in_progress` is false and WiFi is not actively being disconnected from.
+    - Removed "Disconnect to make sure device doesn't remain connected to the AP whose credentials were present earlier"
+      - Removed call: `esp_wifi_disconnect();`
+      - Embedded Starter Kit calls this function when it receives the `WIFI_PROV_SCAN_STARTED` event, as discussed above.
+  - Impacted ESP IDF files:
+    - manager.h
+    - manager.c
+  - Original Commits:
+    - [mutually human changes for wifi_provisioning](https://github.com/mhs/esp-idf/commit/56c743a69cf9dce0bf4ce4eab4048a2c1088fdee)
+- **Python Version Change**
+  - idf_tools.py was modified to use `python3` instead of the Mac default (`python2`)
+  - Impacted ESP IDF files:
+    - idf_tools.py
+  - Original Commits:
+    - [mutually human changes for wifi_provisioning](https://github.com/mhs/esp-idf/commit/56c743a69cf9dce0bf4ce4eab4048a2c1088fdee)
+
+- **WICED Build System Support Changes**
+  - components/freertos/CMakeLists.txt was modified to include a path needed by the WICED build
+  - components/json/json.mk was added to provide a pure makefile build of the cJSON component used in the example WICED build.
+
+## Feature / File Association
+
+| File                                                                 | SK Feature(s) |
+|:-------------------------------------------------------------------- | -------------- |
+|components/lwip/port/esp32/include/esp_netif_net_stack.h              | NW Metrics Reporting |
+|components/lwip/port/esp32/netif/wlanif.c                             | NW Metrics Reporting |
+| components/freertos/CMakeLists.txt                                   | WICED Build System Support Changes |
+| components/json/json.mk                                              | WICED Build System Support Changes |
+|components/protocomm/include/security/protocomm_security.h            | Protocomm BLE Connectivity Reporting |
+|components/protocomm/include/transports/protocomm_ble.h               | Protocomm BLE Connectivity Reporting, Provisioning State in BLE AD |
+|components/protocomm/src/common/protocomm.c                           | Protocomm BLE Connectivity Reporting |
+|components/protocomm/src/security/security1.c                         | Protocomm BLE Connectivity Reporting |
+|components/protocomm/src/transports/protocomm_nimble.c                | Protocomm BLE Connectivity Reporting, Provisioning State in BLE AD |
+|components/wifi_provisioning/include/wifi_provisioning/manager.h      | WiFi Provisioning Sequence Changes, JWT Authorization for Protocomm WiFi provisioning, WPA2 Enterprise NW Support |
+|components/wifi_provisioning/include/wifi_provisioning/wifi_config.h  | JWT Authorization for Protocomm WiFi Provisioning |
+|components/wifi_provisioning/include/wifi_provisioning/wifi_scan.h    | JWT Authorization for Protocomm WiFi Provisioning |
+|components/wifi_provisioning/proto/wifi_config.proto                  | JWT Authorization for Protocomm WiFi Provisioning |
+|components/wifi_provisioning/proto/wifi_scan.proto                    | JWT Authorization for Protocomm WiFi Provisioning |
+|components/wifi_provisioning/proto-c/wifi_config.pb-c.c               | JWT Authorization for Protocomm WiFi Provisioning |
+|components/wifi_provisioning/proto-c/wifi_config.pb-c.h               | JWT Authorization for Protocomm WiFi Provisioning |
+|components/wifi_provisioning/proto-c/wifi_scan.pb-c.c                 | JWT Authorization for Protocomm WiFi Provisioning |
+|components/wifi_provisioning/proto-c/wifi_scan.pb-c.h                 | JWT Authorization for Protocomm WiFi Provisioning |
+|components/wifi_provisioning/python/wifi_config_pb2.py                | JWT Authorization for Protocomm WiFi Provisioning |
+|components/wifi_provisioning/python/wifi_constants_pb2.py             | JWT Authorization for Protocomm WiFi Provisioning |
+|components/wifi_provisioning/python/wifi_scan_pb2.py                  | JWT Authorization for Protocomm WiFi Provisioning |
+|components/wifi_provisioning/src/manager.c                            | JWT Authorization for Protocomm WiFi Provisioning, WiFi Provisioning Sequence Changes |
+|components/wifi_provisioning/src/wifi_config.c                        | JWT Authorization for Protocomm WiFi Provisioning |
+|components/wifi_provisioning/src/wifi_provisioning_priv.h             | WPA2 Enterprise NW Support |
+|components/wifi_provisioning/src/wifi_scan.c                          | JWT Authorization for Protocomm WiFi Provisioning |
+|tools/idf_tools.py                                                    | Python Version Change |
+
+# Comparison of the v5.0 and v5.5.1 fork changes
+
+After generating the new branch `mhs_changes_v5.5.1`, we did a comparison of the diffs
+1. Diff `mhs_changes_v5.5.1` branch  vs `v5.5.1 ` tag
+1. Diff `spindance_changes_v5.0` branch vs `v5.0` tag
+to ensure the update was complete.
+
+## Summary
+
+For most files, the changes were applied exactly the same in both diffs. But for a small number of files there were minor differences. The only possibly functional difference is the addition of authorization checks inside `wifi_config.c` and `wifi_scan.c`. Since JWT authentication is empirically working during testing, the addition of those extra checks seems safe.
+
+## Details for the diff of diffs
+
+Here are the files that show non-trivial differences between the two diffs along with some notes.
+
+| File                                                                 | Notes |
+|:-------------------------------------------------------------------- | -------------- |
+| protocomm_nimble.c |  The changes to report PROTOCOMM_BLE_PEER_DISCONNECTED and PROTOCOMM_BLE_PEER_CONNECTED events applied exactly. </br>Note that v5.0 added `protocomm_transport_ble_event_t` type that had two out of the 3 events that we added in our fork change to add `ble_event`. But since they did NOT include the secure connection event, we continue to use our fork changes. As a result, you'll see a little duplication of events in this file between our `ble_event` and their `protocomm_transport_ble_event_t`. </br>We should keep an eye on the evolution of `protocomm_transport_ble_event_t` and see if Espressif ever adds the secure connection, at which point we would be able to undo our fork changes and be closer to the unmodified esp-idf. |
+| wifi_constants_pb2.py | Mostly changes applied exactly, including the "WifiConnectedState = _reflection.GeneratedProtocolMessageType" paragraph. But the v5.5.1 port added a "WifiAttemptFailed = _reflection.GeneratedProtocolMessageType  paragraph as needed in the v5.5.1 code. |
+|  manager.c | The code structure around our line `ESP_LOGI(TAG, "Delaying %lu ms", cleanup_delay);` changed but the logging was added into the new structure successfully. Otherwise, all changes applied exactly. |
+|  wifi_config.c | Our v5.0 fork added to the `wifi_prov_config_data_handler` function the code paragraph "Authorize before dispatching command". And that was applied exactly in the new branch. But in creating our v5.5.1 fork, claude code added to the `cmd_set_config_handler` function the code paragraph "Check authorization if callback is set" |
+|  wifi_scan.c | Similar to `wifi_config.c`, our v5.0 fork added to the `wifi_prov_scan_handler`  function the code paragraph "Authorize before dispatching command". And that was applied exactly in the new branch. But in creating our v5.5.1 fork, claude code added to `cmd_scan_start_handler`  function the code paragraph "Check authorization if callback is set". |
diff --git a/components/esp_netif/include/lwip/esp_netif_net_stack.h b/components/esp_netif/include/lwip/esp_netif_net_stack.h
index cf6fb3a8de2c..e071b10f8768 100644
--- a/components/esp_netif/include/lwip/esp_netif_net_stack.h
+++ b/components/esp_netif/include/lwip/esp_netif_net_stack.h
@@ -89,6 +89,10 @@ err_t wlanif_init_nan(struct netif *netif);
  */
 esp_netif_recv_ret_t wlanif_input(void *h, void *buffer, size_t len, void* l2_buff);
 
+// Statistics
+int wlanif_bytes_in(void);
+int wlanif_bytes_out(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/components/esp_netif/lwip/netif/wlanif.c b/components/esp_netif/lwip/netif/wlanif.c
index a7d26ed86cdd..36bfd5709be3 100644
--- a/components/esp_netif/lwip/netif/wlanif.c
+++ b/components/esp_netif/lwip/netif/wlanif.c
@@ -26,6 +26,9 @@
 #include "lwip/esp_pbuf_ref.h"
 #include "esp_netif_types.h"
 
+static int _bytes_in = 0;
+static int _bytes_out = 0;
+
 /**
  * In this function, the hardware should be initialized.
  * Called from wlanif_input().
@@ -88,6 +91,8 @@ static err_t low_level_output(struct netif *netif, struct pbuf *p)
     esp_err_t netif_ret = ESP_FAIL;
     err_t ret = ERR_IF;
 
+    _bytes_out += q->len;
+
     if(q->next == NULL) {
         netif_ret = esp_netif_transmit_wrap(esp_netif, q->payload, q->len, q);
 
@@ -131,6 +136,14 @@ static err_t low_level_output(struct netif *netif, struct pbuf *p)
     return ret;
 }
 
+int wlanif_bytes_in(void) {
+    return _bytes_in;
+}
+
+int wlanif_bytes_out(void) {
+    return _bytes_out;
+}
+
 /**
  * This function should be called when a packet is ready to be read
  * from the interface. It uses the function low_level_input() that
@@ -156,6 +169,8 @@ esp_netif_recv_ret_t wlanif_input(void *h, void *buffer, size_t len, void* l2_bu
         return ESP_NETIF_OPTIONAL_RETURN_CODE(ESP_FAIL);
     }
 
+    _bytes_in += len;
+
 #ifdef CONFIG_LWIP_L2_TO_L3_COPY
     p = pbuf_alloc(PBUF_RAW, len, PBUF_RAM);
     if (p == NULL) {
diff --git a/components/freertos/CMakeLists.txt b/components/freertos/CMakeLists.txt
index 87798ab7885e..c9782672141c 100644
--- a/components/freertos/CMakeLists.txt
+++ b/components/freertos/CMakeLists.txt
@@ -121,7 +121,8 @@ list(APPEND include_dirs
 
 # Add FreeRTOS Kernel public include directories
 list(APPEND include_dirs
-    "${kernel_impl}/include")       # FreeRTOS headers via `#include "freertos/xxx.h"`
+    "${kernel_impl}/include"        # FreeRTOS headers via `#include "freertos/xxx.h"`
+    "${kernel_impl}/include/freertos") # For WICED build system compatibility
 
 # Add port public include directories
 list(APPEND include_dirs
diff --git a/components/json/json.mk b/components/json/json.mk
new file mode 100644
index 000000000000..e51bfadff0b9
--- /dev/null
+++ b/components/json/json.mk
@@ -0,0 +1,38 @@
+#
+# Copyright 2020, Cypress Semiconductor Corporation or a subsidiary of
+ # Cypress Semiconductor Corporation. All Rights Reserved.
+ # This software, including source code, documentation and related
+ # materials ("Software"), is owned by Cypress Semiconductor Corporation
+ # or one of its subsidiaries ("Cypress") and is protected by and subject to
+ # worldwide patent protection (United States and foreign),
+ # United States copyright laws and international treaty provisions.
+ # Therefore, you may use this Software only as provided in the license
+ # agreement accompanying the software package from which you
+ # obtained this Software ("EULA").
+ # If no EULA applies, Cypress hereby grants you a personal, non-exclusive,
+ # non-transferable license to copy, modify, and compile the Software
+ # source code solely for use in connection with Cypress's
+ # integrated circuit products. Any reproduction, modification, translation,
+ # compilation, or representation of this Software except as specified
+ # above is prohibited without the express written permission of Cypress.
+ #
+ # Disclaimer: THIS SOFTWARE IS PROVIDED AS-IS, WITH NO WARRANTY OF ANY KIND,
+ # EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, NONINFRINGEMENT, IMPLIED
+ # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Cypress
+ # reserves the right to make changes to the Software without notice. Cypress
+ # does not assume any liability arising out of the application or use of the
+ # Software or any product or circuit described in the Software. Cypress does
+ # not authorize its products for use in any products where a malfunction or
+ # failure of the Cypress product may reasonably be expected to result in
+ # significant property damage, injury or death ("High Risk Product"). By
+ # including Cypress's product in a High Risk Product, the manufacturer
+ # of such system or application assumes all risk of such use and in doing
+ # so agrees to indemnify Cypress against all liability.
+#
+
+NAME := Lib_Json
+
+GLOBAL_INCLUDES := ./cJSON
+
+$(NAME)_SOURCES := cJSON/cJSON.c \
+                   cJSON/cJSON_Utils.c
diff --git a/components/protocomm/include/security/protocomm_security.h b/components/protocomm/include/security/protocomm_security.h
index 38c6a70e55a9..ecc4c78f3367 100644
--- a/components/protocomm/include/security/protocomm_security.h
+++ b/components/protocomm/include/security/protocomm_security.h
@@ -7,6 +7,7 @@
 #pragma once
 
 #include <esp_err.h>
+#include <stdbool.h>
 #include "esp_event.h"
 
 #ifdef __cplusplus
@@ -140,6 +141,14 @@ typedef struct protocomm_security {
                          uint32_t session_id,
                          const uint8_t *inbuf, ssize_t inlen,
                          uint8_t **outbuf, ssize_t *outlen);
+
+    /**
+     * Function which checks whether or not a secure connection has
+     * been established
+     *
+     * note: only relevant to security1
+     */
+    bool (*secure_session_established)(protocomm_security_handle_t handle);
 } protocomm_security_t;
 
 #ifdef __cplusplus
diff --git a/components/protocomm/include/transports/protocomm_ble.h b/components/protocomm/include/transports/protocomm_ble.h
index 22cd84785ec8..d962d045597b 100644
--- a/components/protocomm/include/transports/protocomm_ble.h
+++ b/components/protocomm/include/transports/protocomm_ble.h
@@ -41,6 +41,18 @@ typedef enum {
  * (29 - (BLE device name length) - 2). */
 #define MAX_BLE_MANUFACTURER_DATA_LEN 29
 
+typedef enum {
+    // Peer is connected without any security (i.e., no PoP has been entered)
+    PROTOCOMM_BLE_PEER_CONNECTED,
+    // Peer disconnected
+    PROTOCOMM_BLE_PEER_DISCONNECTED,
+    // Peer is connected securely with a valid PoP
+    PROTOCOMM_BLE_PEER_CONNECTED_SECURE,
+} ble_event;
+
+/// type of function called when a peer device connects or disconnects
+typedef void (*protocomm_ble_event_fn)(ble_event event);
+
 #define BLE_ADDR_LEN 6
 /**
  * @brief   This structure maps handler required by protocomm layer to
@@ -172,6 +184,16 @@ typedef struct protocomm_ble_config {
  */
 esp_err_t protocomm_ble_start(protocomm_t *pc, const protocomm_ble_config_t *config);
 
+esp_err_t protocomm_ble_set_manufacturer_data(uint8_t *data, uint8_t length);
+
+/// Register a callback that is called when a BLE event occurs (peer connects or disconnects)
+void protocomm_ble_register_ble_event_fn(protocomm_ble_event_fn fn);
+
+/// Get the registered BLE event callback
+///
+/// @return protocomm_ble_event_fn callback, or NULL if no callback is registered.
+protocomm_ble_event_fn protocomm_ble_get_ble_event_fn(void);
+
 /**
  * @brief   Stop Bluetooth Low Energy based transport layer for provisioning
  *
diff --git a/components/protocomm/src/common/protocomm.c b/components/protocomm/src/common/protocomm.c
index 1a548267904e..d1b3d396f4af 100644
--- a/components/protocomm/src/common/protocomm.c
+++ b/components/protocomm/src/common/protocomm.c
@@ -13,6 +13,7 @@
 #include <sys/queue.h>
 
 #include <protocomm.h>
+#include <protocomm_ble.h>
 #include <protocomm_security.h>
 
 #include "protocomm_priv.h"
@@ -265,11 +266,18 @@ static int protocomm_common_security_handler(uint32_t session_id,
     protocomm_t *pc = (protocomm_t *) priv_data;
 
     if (pc->sec && pc->sec->security_req_handler) {
-        return pc->sec->security_req_handler(pc->sec_inst,
+        esp_err_t ret = pc->sec->security_req_handler(pc->sec_inst,
                                              pc->sec_params, session_id,
                                              inbuf, inlen,
                                              outbuf, outlen,
                                              priv_data);
+        if (ESP_OK == ret && NULL != pc->sec->secure_session_established) {
+            protocomm_ble_event_fn fn = protocomm_ble_get_ble_event_fn();
+
+            if (NULL != fn && pc->sec->secure_session_established(pc->sec_inst)) {
+                fn(PROTOCOMM_BLE_PEER_CONNECTED_SECURE);
+            }
+        }
     }
 
     return ESP_OK;
diff --git a/components/protocomm/src/security/security1.c b/components/protocomm/src/security/security1.c
index 08911df4fd83..91051abd8f4e 100644
--- a/components/protocomm/src/security/security1.c
+++ b/components/protocomm/src/security/security1.c
@@ -192,7 +192,7 @@ static esp_err_t handle_session_command1(session_t *cur_session,
         ESP_LOGE(TAG, "Failed to post secure session setup success event");
     }
 
-    ESP_LOGD(TAG, "Secure session established successfully");
+    ESP_LOGI(TAG, "Secure session established successfully");
     return ESP_OK;
 }
 
@@ -602,6 +602,15 @@ static esp_err_t sec1_req_handler(protocomm_security_handle_t handle,
     return ESP_OK;
 }
 
+static bool sec1_secure_session_established(protocomm_security_handle_t handle) {
+    session_t *cur_session = (session_t *) handle;
+    if (NULL == cur_session) {
+        return false;
+    }
+
+    return cur_session->state == SESSION_STATE_DONE;
+}
+
 const protocomm_security_t protocomm_security1 = {
     .ver = 1,
     .init = sec1_init,
@@ -611,4 +620,5 @@ const protocomm_security_t protocomm_security1 = {
     .security_req_handler = sec1_req_handler,
     .encrypt = sec1_decrypt, /* Encrypt == decrypt for AES-CTR */
     .decrypt = sec1_decrypt,
+    .secure_session_established = sec1_secure_session_established,
 };
diff --git a/components/protocomm/src/transports/protocomm_nimble.c b/components/protocomm/src/transports/protocomm_nimble.c
index 51f5c6332735..65489be38751 100644
--- a/components/protocomm/src/transports/protocomm_nimble.c
+++ b/components/protocomm/src/transports/protocomm_nimble.c
@@ -76,6 +76,7 @@ static _protocomm_ble_internal_t *protoble_internal;
 static struct ble_gap_adv_params adv_params;
 static char *protocomm_ble_device_name;
 static struct ble_hs_adv_fields adv_data, resp_data;
+static protocomm_ble_event_fn _ble_event_fn;
 
 static uint8_t *protocomm_ble_mfg_data;
 static size_t protocomm_ble_mfg_data_len;
@@ -449,6 +450,14 @@ gatt_svr_register_cb(struct ble_gatt_register_ctxt *ctxt, void *arg)
     }
 }
 
+void protocomm_ble_register_ble_event_fn(protocomm_ble_event_fn fn) {
+    _ble_event_fn = fn;
+}
+
+protocomm_ble_event_fn protocomm_ble_get_ble_event_fn(void) {
+    return _ble_event_fn;
+}
+
 int
 gatt_svr_init(const simple_ble_cfg_t *config)
 {
@@ -600,6 +609,9 @@ static void transport_simple_ble_disconnect(struct ble_gap_event *event, void *a
         if (ret != ESP_OK) {
             ESP_LOGE(TAG, "error closing the session after disconnect");
         } else {
+            if (NULL != _ble_event_fn) {
+                _ble_event_fn(PROTOCOMM_BLE_PEER_DISCONNECTED);
+            }
             protocomm_ble_event_t ble_event = {};
             /* Assign the event type */
             ble_event.evt_type = PROTOCOMM_TRANSPORT_BLE_DISCONNECTED;
@@ -632,17 +644,22 @@ static void transport_simple_ble_connect(struct ble_gap_event *event, void *arg)
             protoble_internal->pc_ble->sec->new_transport_session(protoble_internal->pc_ble->sec_inst, event->connect.conn_handle);
         if (ret != ESP_OK) {
             ESP_LOGE(TAG, "error creating the session");
-        } else {
-            protocomm_ble_event_t ble_event = {};
-            /* Assign the event type */
-            ble_event.evt_type = PROTOCOMM_TRANSPORT_BLE_CONNECTED;
-            /* Set the Connection handle */
-            ble_event.conn_handle = event->connect.conn_handle;
-            ble_event.conn_status = event->connect.status;
+            return;
+        }
 
-            if (esp_event_post(PROTOCOMM_TRANSPORT_BLE_EVENT, PROTOCOMM_TRANSPORT_BLE_CONNECTED, &ble_event, sizeof(protocomm_ble_event_t), portMAX_DELAY) != ESP_OK) {
-                ESP_LOGE(TAG, "Failed to post transport pairing event");
-            }
+        if (NULL != _ble_event_fn) {
+            _ble_event_fn(PROTOCOMM_BLE_PEER_CONNECTED);
+        }
+
+        protocomm_ble_event_t ble_event = {};
+        /* Assign the event type */
+        ble_event.evt_type = PROTOCOMM_TRANSPORT_BLE_CONNECTED;
+        /* Set the Connection handle */
+        ble_event.conn_handle = event->connect.conn_handle;
+        ble_event.conn_status = event->connect.status;
+
+        if (esp_event_post(PROTOCOMM_TRANSPORT_BLE_EVENT, PROTOCOMM_TRANSPORT_BLE_CONNECTED, &ble_event, sizeof(protocomm_ble_event_t), portMAX_DELAY) != ESP_OK) {
+            ESP_LOGE(TAG, "Failed to post transport pairing event");
         }
     }
 }
@@ -1037,6 +1054,23 @@ esp_err_t protocomm_ble_start(protocomm_t *pc, const protocomm_ble_config_t *con
     return ESP_OK;
 }
 
+esp_err_t protocomm_ble_set_manufacturer_data(uint8_t *data, uint8_t length)
+{
+    adv_data.mfg_data = data;
+    adv_data.mfg_data_len = length;
+
+    ESP_LOGI(TAG, "Setting mfg_data to:");
+    ESP_LOG_BUFFER_HEX(TAG, data, length);
+
+    if (protoble_internal != NULL) {
+        if (0 != ble_gap_adv_set_fields(&adv_data)) {
+            return ESP_FAIL;
+        }
+    }
+
+    return ESP_OK;
+}
+
 esp_err_t protocomm_ble_stop(protocomm_t *pc)
 {
     ESP_LOGD(TAG, "protocomm_ble_stop called here...");
diff --git a/components/wifi_provisioning/include/wifi_provisioning/manager.h b/components/wifi_provisioning/include/wifi_provisioning/manager.h
index c65540e9f24c..d4ed6b1be67d 100644
--- a/components/wifi_provisioning/include/wifi_provisioning/manager.h
+++ b/components/wifi_provisioning/include/wifi_provisioning/manager.h
@@ -36,6 +36,8 @@ typedef enum {
      */
     WIFI_PROV_START,
 
+    WIFI_PROV_SCAN_STARTED,
+
     /**
      * Emitted before accepting the wifi credentials to
      * set the wifi configurations according to requirement.
@@ -77,6 +79,12 @@ typedef enum {
 
 typedef void (*wifi_prov_cb_func_t)(void *user_data, wifi_prov_cb_event_t event, void *event_data);
 
+/** Returns ESP_OK if operation is authorized, ESP_ERR_FAIL otherwise
+ *
+ *  @note: auth is not NULL terminated. Callbacks must only check up to auth_len characters.
+ */
+typedef esp_err_t (*wifi_prov_cb_auth_t)(const char* auth, size_t auth_len);
+
 /**
  * @brief   Event handler that is used by the manager while
  *          provisioning service is active
@@ -629,6 +637,40 @@ esp_err_t wifi_prov_mgr_reset_sm_state_on_failure(void);
  */
 esp_err_t wifi_prov_mgr_reset_sm_state_for_reprovision(void);
 
+/**
+ * @brief Callback for authorizing wifi prov scans and config changes.
+ * Will be called before dispatching prov-scan or
+ * prov-config commands to verify the operation is authorized.
+ *
+ * @note Authorization is disabled by default until this function
+ * is called to set the authorization callback.
+ *
+ * @param[in] auth_cb Callback function to authorize wifi prov commands
+ *
+ * @return
+ *  - ESP_OK       : Callback set
+ *  - ESP_FAIL : Callback not set
+ */
+esp_err_t wifi_prov_mgr_set_authorization_cb(wifi_prov_cb_auth_t auth_cb);
+
+/**
+ * @brief   Get the count of results in the scan list
+ *
+ * @return
+ *  - count  : Number of Wi-Fi Access Points detected while scanning
+ */
+uint16_t wifi_prov_mgr_wifi_scan_result_count(void);
+
+/**
+ * @brief   Get AP record for a particular index in the scan list result
+ *
+ * @param[out] index  Index of the result to fetch
+ *
+ * @return
+ *  - result : Pointer to Access Point record
+ */
+const wifi_ap_record_t *wifi_prov_mgr_wifi_scan_result(uint16_t index);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/components/wifi_provisioning/include/wifi_provisioning/wifi_config.h b/components/wifi_provisioning/include/wifi_provisioning/wifi_config.h
index cd26ebef2ba8..b0addaa61bb2 100644
--- a/components/wifi_provisioning/include/wifi_provisioning/wifi_config.h
+++ b/components/wifi_provisioning/include/wifi_provisioning/wifi_config.h
@@ -128,6 +128,17 @@ typedef struct wifi_prov_config_handlers {
      */
     esp_err_t (*apply_config_handler)(wifi_prov_ctx_t **ctx);
 
+    /**
+     * Handler function called to authorize get/set/apply commands.
+     * Can be NULL if no authorization required.
+     * If set, will be called before handling commands.
+     *
+     * Returns:
+     *  ESP_OK: Command is authorized
+     *  ESP_FAIL: Command is not authorized
+     */
+    esp_err_t (*config_auth)(const char* auth, size_t auth_len);
+
     /**
      * Context pointer to be passed to above handler functions upon invocation
      */
diff --git a/components/wifi_provisioning/include/wifi_provisioning/wifi_scan.h b/components/wifi_provisioning/include/wifi_provisioning/wifi_scan.h
index a4ebb7e57002..7cf3c6eec8e4 100644
--- a/components/wifi_provisioning/include/wifi_provisioning/wifi_scan.h
+++ b/components/wifi_provisioning/include/wifi_provisioning/wifi_scan.h
@@ -1,16 +1,8 @@
-// Copyright 2019 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2019-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #ifndef _PROV_WIFI_SCAN_H_
 #define _PROV_WIFI_SCAN_H_
@@ -89,7 +81,7 @@ typedef struct wifi_prov_scan_handlers {
      * mode is SoftAP, where scanning all channels in one go may not
      * give the Wi-Fi driver enough time to send out beacons, and
      * hence may cause disconnection with any connected stations.
-     * When scanning in groups, the manager will wait for atleast
+     * When scanning in groups, the manager will wait for at least
      * 120ms after completing scan on a group of channels, and thus
      * allow the driver to send out the beacons. For example, given
      * that the total number of Wi-Fi channels is 14, then setting
@@ -144,6 +136,17 @@ typedef struct wifi_prov_scan_handlers {
                              wifi_prov_scan_result_t *result,
                              wifi_prov_scan_ctx_t **ctx);
 
+    /**
+     * Handler function called to authorize scan_* commands.
+     * Can be NULL if no authorization required.
+     * If set, will be called before handling scan commands.
+     *
+     * Returns:
+     *  ESP_OK: Command is authorized
+     *  ESP_FAIL: Command is not authorized
+     */
+    esp_err_t (*scan_auth)(const char* auth, size_t auth_len);
+
     /**
      * Context pointer to be passed to above handler functions upon invocation
      */
diff --git a/components/wifi_provisioning/proto-c/wifi_config.pb-c.c b/components/wifi_provisioning/proto-c/wifi_config.pb-c.c
index d451dbf6264c..f4f46707d633 100644
--- a/components/wifi_provisioning/proto-c/wifi_config.pb-c.c
+++ b/components/wifi_provisioning/proto-c/wifi_config.pb-c.c
@@ -602,7 +602,7 @@ const ProtobufCMessageDescriptor resp_apply_config__descriptor =
   (ProtobufCMessageInit) resp_apply_config__init,
   NULL,NULL,NULL    /* reserved[123] */
 };
-static const ProtobufCFieldDescriptor wi_fi_config_payload__field_descriptors[7] =
+static const ProtobufCFieldDescriptor wi_fi_config_payload__field_descriptors[8] =
 {
   {
     "msg",
@@ -616,6 +616,18 @@ static const ProtobufCFieldDescriptor wi_fi_config_payload__field_descriptors[7]
     0,             /* flags */
     0,NULL,NULL    /* reserved1,reserved2, etc */
   },
+  {
+    "auth_token",
+    9,
+    PROTOBUF_C_LABEL_NONE,
+    PROTOBUF_C_TYPE_BYTES,
+    0,   /* quantifier_offset */
+    offsetof(WiFiConfigPayload, auth_token),
+    NULL,
+    NULL,
+    0,             /* flags */
+    0,NULL,NULL    /* reserved1,reserved2, etc */
+  },
   {
     "cmd_get_status",
     10,
@@ -690,19 +702,20 @@ static const ProtobufCFieldDescriptor wi_fi_config_payload__field_descriptors[7]
   },
 };
 static const unsigned wi_fi_config_payload__field_indices_by_name[] = {
-  5,   /* field[5] = cmd_apply_config */
-  1,   /* field[1] = cmd_get_status */
-  3,   /* field[3] = cmd_set_config */
+  1,   /* field[1] = auth_token */
+  6,   /* field[6] = cmd_apply_config */
+  2,   /* field[2] = cmd_get_status */
+  4,   /* field[4] = cmd_set_config */
   0,   /* field[0] = msg */
-  6,   /* field[6] = resp_apply_config */
-  2,   /* field[2] = resp_get_status */
-  4,   /* field[4] = resp_set_config */
+  7,   /* field[7] = resp_apply_config */
+  3,   /* field[3] = resp_get_status */
+  5,   /* field[5] = resp_set_config */
 };
 static const ProtobufCIntRange wi_fi_config_payload__number_ranges[2 + 1] =
 {
   { 1, 0 },
-  { 10, 1 },
-  { 0, 7 }
+  { 9, 1 },
+  { 0, 8 }
 };
 const ProtobufCMessageDescriptor wi_fi_config_payload__descriptor =
 {
@@ -712,7 +725,7 @@ const ProtobufCMessageDescriptor wi_fi_config_payload__descriptor =
   "WiFiConfigPayload",
   "",
   sizeof(WiFiConfigPayload),
-  7,
+  8,
   wi_fi_config_payload__field_descriptors,
   wi_fi_config_payload__field_indices_by_name,
   2,  wi_fi_config_payload__number_ranges,
diff --git a/components/wifi_provisioning/proto-c/wifi_config.pb-c.h b/components/wifi_provisioning/proto-c/wifi_config.pb-c.h
index d0247458abd3..5e1ca70eb40b 100644
--- a/components/wifi_provisioning/proto-c/wifi_config.pb-c.h
+++ b/components/wifi_provisioning/proto-c/wifi_config.pb-c.h
@@ -131,6 +131,7 @@ struct  WiFiConfigPayload
 {
   ProtobufCMessage base;
   WiFiConfigMsgType msg;
+  ProtobufCBinaryData auth_token;
   WiFiConfigPayload__PayloadCase payload_case;
   union {
     CmdGetStatus *cmd_get_status;
@@ -143,7 +144,7 @@ struct  WiFiConfigPayload
 };
 #define WI_FI_CONFIG_PAYLOAD__INIT \
  { PROTOBUF_C_MESSAGE_INIT (&wi_fi_config_payload__descriptor) \
-    , WI_FI_CONFIG_MSG_TYPE__TypeCmdGetStatus, WI_FI_CONFIG_PAYLOAD__PAYLOAD__NOT_SET, {0} }
+    , WI_FI_CONFIG_MSG_TYPE__TypeCmdGetStatus, {0,NULL}, WI_FI_CONFIG_PAYLOAD__PAYLOAD__NOT_SET, {0} }
 
 
 /* CmdGetStatus methods */
diff --git a/components/wifi_provisioning/proto-c/wifi_scan.pb-c.c b/components/wifi_provisioning/proto-c/wifi_scan.pb-c.c
index 4cf5b5dc3b1f..a5eec94e0862 100644
--- a/components/wifi_provisioning/proto-c/wifi_scan.pb-c.c
+++ b/components/wifi_provisioning/proto-c/wifi_scan.pb-c.c
@@ -710,7 +710,7 @@ const ProtobufCMessageDescriptor resp_scan_result__descriptor =
   (ProtobufCMessageInit) resp_scan_result__init,
   NULL,NULL,NULL    /* reserved[123] */
 };
-static const ProtobufCFieldDescriptor wi_fi_scan_payload__field_descriptors[8] =
+static const ProtobufCFieldDescriptor wi_fi_scan_payload__field_descriptors[9] =
 {
   {
     "msg",
@@ -736,6 +736,18 @@ static const ProtobufCFieldDescriptor wi_fi_scan_payload__field_descriptors[8] =
     0,             /* flags */
     0,NULL,NULL    /* reserved1,reserved2, etc */
   },
+  {
+    "auth_token",
+    9,
+    PROTOBUF_C_LABEL_NONE,
+    PROTOBUF_C_TYPE_BYTES,
+    0,   /* quantifier_offset */
+    offsetof(WiFiScanPayload, auth_token),
+    NULL,
+    NULL,
+    0,             /* flags */
+    0,NULL,NULL    /* reserved1,reserved2, etc */
+  },
   {
     "cmd_scan_start",
     10,
@@ -810,20 +822,21 @@ static const ProtobufCFieldDescriptor wi_fi_scan_payload__field_descriptors[8] =
   },
 };
 static const unsigned wi_fi_scan_payload__field_indices_by_name[] = {
-  6,   /* field[6] = cmd_scan_result */
-  2,   /* field[2] = cmd_scan_start */
-  4,   /* field[4] = cmd_scan_status */
+  2,   /* field[2] = auth_token */
+  7,   /* field[7] = cmd_scan_result */
+  3,   /* field[3] = cmd_scan_start */
+  5,   /* field[5] = cmd_scan_status */
   0,   /* field[0] = msg */
-  7,   /* field[7] = resp_scan_result */
-  3,   /* field[3] = resp_scan_start */
-  5,   /* field[5] = resp_scan_status */
+  8,   /* field[8] = resp_scan_result */
+  4,   /* field[4] = resp_scan_start */
+  6,   /* field[6] = resp_scan_status */
   1,   /* field[1] = status */
 };
 static const ProtobufCIntRange wi_fi_scan_payload__number_ranges[2 + 1] =
 {
   { 1, 0 },
-  { 10, 2 },
-  { 0, 8 }
+  { 9, 2 },
+  { 0, 9 }
 };
 const ProtobufCMessageDescriptor wi_fi_scan_payload__descriptor =
 {
@@ -833,7 +846,7 @@ const ProtobufCMessageDescriptor wi_fi_scan_payload__descriptor =
   "WiFiScanPayload",
   "",
   sizeof(WiFiScanPayload),
-  8,
+  9,
   wi_fi_scan_payload__field_descriptors,
   wi_fi_scan_payload__field_indices_by_name,
   2,  wi_fi_scan_payload__number_ranges,
diff --git a/components/wifi_provisioning/proto-c/wifi_scan.pb-c.h b/components/wifi_provisioning/proto-c/wifi_scan.pb-c.h
index bab84159dec9..c1b31b30d3e0 100644
--- a/components/wifi_provisioning/proto-c/wifi_scan.pb-c.h
+++ b/components/wifi_provisioning/proto-c/wifi_scan.pb-c.h
@@ -135,6 +135,7 @@ struct  WiFiScanPayload
   ProtobufCMessage base;
   WiFiScanMsgType msg;
   Status status;
+  ProtobufCBinaryData auth_token;
   WiFiScanPayload__PayloadCase payload_case;
   union {
     CmdScanStart *cmd_scan_start;
@@ -147,7 +148,7 @@ struct  WiFiScanPayload
 };
 #define WI_FI_SCAN_PAYLOAD__INIT \
  { PROTOBUF_C_MESSAGE_INIT (&wi_fi_scan_payload__descriptor) \
-    , WI_FI_SCAN_MSG_TYPE__TypeCmdScanStart, STATUS__Success, WI_FI_SCAN_PAYLOAD__PAYLOAD__NOT_SET, {0} }
+    , WI_FI_SCAN_MSG_TYPE__TypeCmdScanStart, STATUS__Success, {0,NULL}, WI_FI_SCAN_PAYLOAD__PAYLOAD__NOT_SET, {0} }
 
 
 /* CmdScanStart methods */
diff --git a/components/wifi_provisioning/proto/wifi_config.proto b/components/wifi_provisioning/proto/wifi_config.proto
index 9ff79bbb6eb8..fa945c89e039 100644
--- a/components/wifi_provisioning/proto/wifi_config.proto
+++ b/components/wifi_provisioning/proto/wifi_config.proto
@@ -47,6 +47,7 @@ enum WiFiConfigMsgType {
 
 message WiFiConfigPayload {
     WiFiConfigMsgType msg = 1;
+    bytes auth_token = 9;
     oneof payload {
         CmdGetStatus cmd_get_status = 10;
         RespGetStatus resp_get_status = 11;
diff --git a/components/wifi_provisioning/proto/wifi_scan.proto b/components/wifi_provisioning/proto/wifi_scan.proto
index ea240f20f72e..15abc184c81f 100644
--- a/components/wifi_provisioning/proto/wifi_scan.proto
+++ b/components/wifi_provisioning/proto/wifi_scan.proto
@@ -52,6 +52,7 @@ enum WiFiScanMsgType {
 message WiFiScanPayload {
     WiFiScanMsgType msg = 1;
     Status status = 2;
+    bytes auth_token = 9;
     oneof payload {
         CmdScanStart cmd_scan_start = 10;
         RespScanStart resp_scan_start = 11;
diff --git a/components/wifi_provisioning/python/wifi_config_pb2.py b/components/wifi_provisioning/python/wifi_config_pb2.py
index f24f9fc9cb8f..444e05bc1548 100644
--- a/components/wifi_provisioning/python/wifi_config_pb2.py
+++ b/components/wifi_provisioning/python/wifi_config_pb2.py
@@ -2,9 +2,12 @@
 # Generated by the protocol buffer compiler.  DO NOT EDIT!
 # source: wifi_config.proto
 """Generated protocol buffer code."""
-from google.protobuf.internal import builder as _builder
+
+from google.protobuf.internal import enum_type_wrapper
 from google.protobuf import descriptor as _descriptor
 from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import message as _message
+from google.protobuf import reflection as _reflection
 from google.protobuf import symbol_database as _symbol_database
 # @@protoc_insertion_point(imports)
 
@@ -15,27 +18,120 @@
 import wifi_constants_pb2 as wifi__constants__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x11wifi_config.proto\x1a\x0f\x63onstants.proto\x1a\x14wifi_constants.proto\"\x0e\n\x0c\x43mdGetStatus\"\xe0\x01\n\rRespGetStatus\x12\x17\n\x06status\x18\x01 \x01(\x0e\x32\x07.Status\x12$\n\tsta_state\x18\x02 \x01(\x0e\x32\x11.WifiStationState\x12/\n\x0b\x66\x61il_reason\x18\n \x01(\x0e\x32\x18.WifiConnectFailedReasonH\x00\x12(\n\tconnected\x18\x0b \x01(\x0b\x32\x13.WifiConnectedStateH\x00\x12,\n\x0e\x61ttempt_failed\x18\x0c \x01(\x0b\x32\x12.WifiAttemptFailedH\x00\x42\x07\n\x05state\"P\n\x0c\x43mdSetConfig\x12\x0c\n\x04ssid\x18\x01 \x01(\x0c\x12\x12\n\npassphrase\x18\x02 \x01(\x0c\x12\r\n\x05\x62ssid\x18\x03 \x01(\x0c\x12\x0f\n\x07\x63hannel\x18\x04 \x01(\x05\"(\n\rRespSetConfig\x12\x17\n\x06status\x18\x01 \x01(\x0e\x32\x07.Status\"\x10\n\x0e\x43mdApplyConfig\"*\n\x0fRespApplyConfig\x12\x17\n\x06status\x18\x01 \x01(\x0e\x32\x07.Status\"\xc3\x02\n\x11WiFiConfigPayload\x12\x1f\n\x03msg\x18\x01 \x01(\x0e\x32\x12.WiFiConfigMsgType\x12\'\n\x0e\x63md_get_status\x18\n \x01(\x0b\x32\r.CmdGetStatusH\x00\x12)\n\x0fresp_get_status\x18\x0b \x01(\x0b\x32\x0e.RespGetStatusH\x00\x12\'\n\x0e\x63md_set_config\x18\x0c \x01(\x0b\x32\r.CmdSetConfigH\x00\x12)\n\x0fresp_set_config\x18\r \x01(\x0b\x32\x0e.RespSetConfigH\x00\x12+\n\x10\x63md_apply_config\x18\x0e \x01(\x0b\x32\x0f.CmdApplyConfigH\x00\x12-\n\x11resp_apply_config\x18\x0f \x01(\x0b\x32\x10.RespApplyConfigH\x00\x42\t\n\x07payload*\x9e\x01\n\x11WiFiConfigMsgType\x12\x14\n\x10TypeCmdGetStatus\x10\x00\x12\x15\n\x11TypeRespGetStatus\x10\x01\x12\x14\n\x10TypeCmdSetConfig\x10\x02\x12\x15\n\x11TypeRespSetConfig\x10\x03\x12\x16\n\x12TypeCmdApplyConfig\x10\x04\x12\x17\n\x13TypeRespApplyConfig\x10\x05\x62\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(
+    b'\n\x11wifi_config.proto\x1a\x0f\x63onstants.proto\x1a\x14wifi_constants.proto"\x0e\n\x0c\x43mdGetStatus"\xe0\x01\n\rRespGetStatus\x12\x17\n\x06status\x18\x01 \x01(\x0e\x32\x07.Status\x12$\n\tsta_state\x18\x02 \x01(\x0e\x32\x11.WifiStationState\x12/\n\x0b\x66\x61il_reason\x18\n \x01(\x0e\x32\x18.WifiConnectFailedReasonH\x00\x12(\n\tconnected\x18\x0b \x01(\x0b\x32\x13.WifiConnectedStateH\x00\x12,\n\x0e\x61ttempt_failed\x18\x0c \x01(\x0b\x32\x12.WifiAttemptFailedH\x00\x42\x07\n\x05state"P\n\x0c\x43mdSetConfig\x12\x0c\n\x04ssid\x18\x01 \x01(\x0c\x12\x12\n\npassphrase\x18\x02 \x01(\x0c\x12\r\n\x05\x62ssid\x18\x03 \x01(\x0c\x12\x0f\n\x07\x63hannel\x18\x04 \x01(\x05"(\n\rRespSetConfig\x12\x17\n\x06status\x18\x01 \x01(\x0e\x32\x07.Status"\x10\n\x0e\x43mdApplyConfig"*\n\x0fRespApplyConfig\x12\x17\n\x06status\x18\x01 \x01(\x0e\x32\x07.Status"\xd7\x02\n\x11WiFiConfigPayload\x12\x1f\n\x03msg\x18\x01 \x01(\x0e\x32\x12.WiFiConfigMsgType\x12\x12\n\nauth_token\x18\t \x01(\x0c\x12\'\n\x0e\x63md_get_status\x18\n \x01(\x0b\x32\r.CmdGetStatusH\x00\x12)\n\x0fresp_get_status\x18\x0b \x01(\x0b\x32\x0e.RespGetStatusH\x00\x12\'\n\x0e\x63md_set_config\x18\x0c \x01(\x0b\x32\r.CmdSetConfigH\x00\x12)\n\x0fresp_set_config\x18\r \x01(\x0b\x32\x0e.RespSetConfigH\x00\x12+\n\x10\x63md_apply_config\x18\x0e \x01(\x0b\x32\x0f.CmdApplyConfigH\x00\x12-\n\x11resp_apply_config\x18\x0f \x01(\x0b\x32\x10.RespApplyConfigH\x00\x42\t\n\x07payload*\x9e\x01\n\x11WiFiConfigMsgType\x12\x14\n\x10TypeCmdGetStatus\x10\x00\x12\x15\n\x11TypeRespGetStatus\x10\x01\x12\x14\n\x10TypeCmdSetConfig\x10\x02\x12\x15\n\x11TypeRespSetConfig\x10\x03\x12\x16\n\x12TypeCmdApplyConfig\x10\x04\x12\x17\n\x13TypeRespApplyConfig\x10\x05\x62\x06proto3'
+)
 
-_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, globals())
-_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'wifi_config_pb2', globals())
-if _descriptor._USE_C_DESCRIPTORS == False:
+_WIFICONFIGMSGTYPE = DESCRIPTOR.enum_types_by_name['WiFiConfigMsgType']
+WiFiConfigMsgType = enum_type_wrapper.EnumTypeWrapper(_WIFICONFIGMSGTYPE)
+TypeCmdGetStatus = 0
+TypeRespGetStatus = 1
+TypeCmdSetConfig = 2
+TypeRespSetConfig = 3
+TypeCmdApplyConfig = 4
+TypeRespApplyConfig = 5
+
+
+_CMDGETSTATUS = DESCRIPTOR.message_types_by_name['CmdGetStatus']
+_RESPGETSTATUS = DESCRIPTOR.message_types_by_name['RespGetStatus']
+_CMDSETCONFIG = DESCRIPTOR.message_types_by_name['CmdSetConfig']
+_RESPSETCONFIG = DESCRIPTOR.message_types_by_name['RespSetConfig']
+_CMDAPPLYCONFIG = DESCRIPTOR.message_types_by_name['CmdApplyConfig']
+_RESPAPPLYCONFIG = DESCRIPTOR.message_types_by_name['RespApplyConfig']
+_WIFICONFIGPAYLOAD = DESCRIPTOR.message_types_by_name['WiFiConfigPayload']
+CmdGetStatus = _reflection.GeneratedProtocolMessageType(
+    'CmdGetStatus',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _CMDGETSTATUS,
+        '__module__': 'wifi_config_pb2',
+        # @@protoc_insertion_point(class_scope:CmdGetStatus)
+    },
+)
+_sym_db.RegisterMessage(CmdGetStatus)
+
+RespGetStatus = _reflection.GeneratedProtocolMessageType(
+    'RespGetStatus',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _RESPGETSTATUS,
+        '__module__': 'wifi_config_pb2',
+        # @@protoc_insertion_point(class_scope:RespGetStatus)
+    },
+)
+_sym_db.RegisterMessage(RespGetStatus)
+
+CmdSetConfig = _reflection.GeneratedProtocolMessageType(
+    'CmdSetConfig',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _CMDSETCONFIG,
+        '__module__': 'wifi_config_pb2',
+        # @@protoc_insertion_point(class_scope:CmdSetConfig)
+    },
+)
+_sym_db.RegisterMessage(CmdSetConfig)
 
-  DESCRIPTOR._options = None
-  _WIFICONFIGMSGTYPE._serialized_start=816
-  _WIFICONFIGMSGTYPE._serialized_end=974
-  _CMDGETSTATUS._serialized_start=60
-  _CMDGETSTATUS._serialized_end=74
-  _RESPGETSTATUS._serialized_start=77
-  _RESPGETSTATUS._serialized_end=301
-  _CMDSETCONFIG._serialized_start=303
-  _CMDSETCONFIG._serialized_end=383
-  _RESPSETCONFIG._serialized_start=385
-  _RESPSETCONFIG._serialized_end=425
-  _CMDAPPLYCONFIG._serialized_start=427
-  _CMDAPPLYCONFIG._serialized_end=443
-  _RESPAPPLYCONFIG._serialized_start=445
-  _RESPAPPLYCONFIG._serialized_end=487
-  _WIFICONFIGPAYLOAD._serialized_start=490
-  _WIFICONFIGPAYLOAD._serialized_end=813
+RespSetConfig = _reflection.GeneratedProtocolMessageType(
+    'RespSetConfig',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _RESPSETCONFIG,
+        '__module__': 'wifi_config_pb2',
+        # @@protoc_insertion_point(class_scope:RespSetConfig)
+    },
+)
+_sym_db.RegisterMessage(RespSetConfig)
+
+CmdApplyConfig = _reflection.GeneratedProtocolMessageType(
+    'CmdApplyConfig',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _CMDAPPLYCONFIG,
+        '__module__': 'wifi_config_pb2',
+        # @@protoc_insertion_point(class_scope:CmdApplyConfig)
+    },
+)
+_sym_db.RegisterMessage(CmdApplyConfig)
+
+RespApplyConfig = _reflection.GeneratedProtocolMessageType(
+    'RespApplyConfig',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _RESPAPPLYCONFIG,
+        '__module__': 'wifi_config_pb2',
+        # @@protoc_insertion_point(class_scope:RespApplyConfig)
+    },
+)
+_sym_db.RegisterMessage(RespApplyConfig)
+
+WiFiConfigPayload = _reflection.GeneratedProtocolMessageType(
+    'WiFiConfigPayload',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _WIFICONFIGPAYLOAD,
+        '__module__': 'wifi_config_pb2',
+        # @@protoc_insertion_point(class_scope:WiFiConfigPayload)
+    },
+)
+_sym_db.RegisterMessage(WiFiConfigPayload)
+
+if _descriptor._USE_C_DESCRIPTORS == False:
+    DESCRIPTOR._options = None
+    _WIFICONFIGMSGTYPE._serialized_start = 836
+    _WIFICONFIGMSGTYPE._serialized_end = 994
+    _CMDGETSTATUS._serialized_start = 60
+    _CMDGETSTATUS._serialized_end = 74
+    _RESPGETSTATUS._serialized_start = 77
+    _RESPGETSTATUS._serialized_end = 301
+    _CMDSETCONFIG._serialized_start = 303
+    _CMDSETCONFIG._serialized_end = 383
+    _RESPSETCONFIG._serialized_start = 385
+    _RESPSETCONFIG._serialized_end = 425
+    _CMDAPPLYCONFIG._serialized_start = 427
+    _CMDAPPLYCONFIG._serialized_end = 443
+    _RESPAPPLYCONFIG._serialized_start = 445
+    _RESPAPPLYCONFIG._serialized_end = 487
+    _WIFICONFIGPAYLOAD._serialized_start = 490
+    _WIFICONFIGPAYLOAD._serialized_end = 833
 # @@protoc_insertion_point(module_scope)
diff --git a/components/wifi_provisioning/python/wifi_constants_pb2.py b/components/wifi_provisioning/python/wifi_constants_pb2.py
index 018dbd1ff0d2..7cb23ff51273 100644
--- a/components/wifi_provisioning/python/wifi_constants_pb2.py
+++ b/components/wifi_provisioning/python/wifi_constants_pb2.py
@@ -2,32 +2,78 @@
 # Generated by the protocol buffer compiler.  DO NOT EDIT!
 # source: wifi_constants.proto
 """Generated protocol buffer code."""
-from google.protobuf.internal import builder as _builder
+
+from google.protobuf.internal import enum_type_wrapper
 from google.protobuf import descriptor as _descriptor
 from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import message as _message
+from google.protobuf import reflection as _reflection
 from google.protobuf import symbol_database as _symbol_database
 # @@protoc_insertion_point(imports)
 
 _sym_db = _symbol_database.Default()
 
 
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(
+    b'\n\x14wifi_constants.proto"/\n\x11WifiAttemptFailed\x12\x1a\n\x12\x61ttempts_remaining\x18\x01 \x01(\r"v\n\x12WifiConnectedState\x12\x10\n\x08ip4_addr\x18\x01 \x01(\t\x12 \n\tauth_mode\x18\x02 \x01(\x0e\x32\r.WifiAuthMode\x12\x0c\n\x04ssid\x18\x03 \x01(\x0c\x12\r\n\x05\x62ssid\x18\x04 \x01(\x0c\x12\x0f\n\x07\x63hannel\x18\x05 \x01(\x05*Y\n\x10WifiStationState\x12\r\n\tConnected\x10\x00\x12\x0e\n\nConnecting\x10\x01\x12\x10\n\x0c\x44isconnected\x10\x02\x12\x14\n\x10\x43onnectionFailed\x10\x03*=\n\x17WifiConnectFailedReason\x12\r\n\tAuthError\x10\x00\x12\x13\n\x0fNetworkNotFound\x10\x01*\x84\x01\n\x0cWifiAuthMode\x12\x08\n\x04Open\x10\x00\x12\x07\n\x03WEP\x10\x01\x12\x0b\n\x07WPA_PSK\x10\x02\x12\x0c\n\x08WPA2_PSK\x10\x03\x12\x10\n\x0cWPA_WPA2_PSK\x10\x04\x12\x13\n\x0fWPA2_ENTERPRISE\x10\x05\x12\x0c\n\x08WPA3_PSK\x10\x06\x12\x11\n\rWPA2_WPA3_PSK\x10\x07\x62\x06proto3'
+)
 
+_WIFISTATIONSTATE = DESCRIPTOR.enum_types_by_name['WifiStationState']
+WifiStationState = enum_type_wrapper.EnumTypeWrapper(_WIFISTATIONSTATE)
+_WIFICONNECTFAILEDREASON = DESCRIPTOR.enum_types_by_name['WifiConnectFailedReason']
+WifiConnectFailedReason = enum_type_wrapper.EnumTypeWrapper(_WIFICONNECTFAILEDREASON)
+_WIFIAUTHMODE = DESCRIPTOR.enum_types_by_name['WifiAuthMode']
+WifiAuthMode = enum_type_wrapper.EnumTypeWrapper(_WIFIAUTHMODE)
+Connected = 0
+Connecting = 1
+Disconnected = 2
+ConnectionFailed = 3
+AuthError = 0
+NetworkNotFound = 1
+Open = 0
+WEP = 1
+WPA_PSK = 2
+WPA2_PSK = 3
+WPA_WPA2_PSK = 4
+WPA2_ENTERPRISE = 5
+WPA3_PSK = 6
+WPA2_WPA3_PSK = 7
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x14wifi_constants.proto\"/\n\x11WifiAttemptFailed\x12\x1a\n\x12\x61ttempts_remaining\x18\x01 \x01(\r\"v\n\x12WifiConnectedState\x12\x10\n\x08ip4_addr\x18\x01 \x01(\t\x12 \n\tauth_mode\x18\x02 \x01(\x0e\x32\r.WifiAuthMode\x12\x0c\n\x04ssid\x18\x03 \x01(\x0c\x12\r\n\x05\x62ssid\x18\x04 \x01(\x0c\x12\x0f\n\x07\x63hannel\x18\x05 \x01(\x05*Y\n\x10WifiStationState\x12\r\n\tConnected\x10\x00\x12\x0e\n\nConnecting\x10\x01\x12\x10\n\x0c\x44isconnected\x10\x02\x12\x14\n\x10\x43onnectionFailed\x10\x03*=\n\x17WifiConnectFailedReason\x12\r\n\tAuthError\x10\x00\x12\x13\n\x0fNetworkNotFound\x10\x01*\x84\x01\n\x0cWifiAuthMode\x12\x08\n\x04Open\x10\x00\x12\x07\n\x03WEP\x10\x01\x12\x0b\n\x07WPA_PSK\x10\x02\x12\x0c\n\x08WPA2_PSK\x10\x03\x12\x10\n\x0cWPA_WPA2_PSK\x10\x04\x12\x13\n\x0fWPA2_ENTERPRISE\x10\x05\x12\x0c\n\x08WPA3_PSK\x10\x06\x12\x11\n\rWPA2_WPA3_PSK\x10\x07\x62\x06proto3')
 
-_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, globals())
-_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'wifi_constants_pb2', globals())
-if _descriptor._USE_C_DESCRIPTORS == False:
+_WIFIATTEMPTFAILED = DESCRIPTOR.message_types_by_name['WifiAttemptFailed']
+_WIFICONNECTEDSTATE = DESCRIPTOR.message_types_by_name['WifiConnectedState']
+WifiAttemptFailed = _reflection.GeneratedProtocolMessageType(
+    'WifiAttemptFailed',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _WIFIATTEMPTFAILED,
+        '__module__': 'wifi_constants_pb2',
+        # @@protoc_insertion_point(class_scope:WifiAttemptFailed)
+    },
+)
+_sym_db.RegisterMessage(WifiAttemptFailed)
 
-  DESCRIPTOR._options = None
-  _WIFISTATIONSTATE._serialized_start=193
-  _WIFISTATIONSTATE._serialized_end=282
-  _WIFICONNECTFAILEDREASON._serialized_start=284
-  _WIFICONNECTFAILEDREASON._serialized_end=345
-  _WIFIAUTHMODE._serialized_start=348
-  _WIFIAUTHMODE._serialized_end=480
-  _WIFIATTEMPTFAILED._serialized_start=24
-  _WIFIATTEMPTFAILED._serialized_end=71
-  _WIFICONNECTEDSTATE._serialized_start=73
-  _WIFICONNECTEDSTATE._serialized_end=191
+WifiConnectedState = _reflection.GeneratedProtocolMessageType(
+    'WifiConnectedState',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _WIFICONNECTEDSTATE,
+        '__module__': 'wifi_constants_pb2',
+        # @@protoc_insertion_point(class_scope:WifiConnectedState)
+    },
+)
+_sym_db.RegisterMessage(WifiConnectedState)
+
+if _descriptor._USE_C_DESCRIPTORS == False:
+    DESCRIPTOR._options = None
+    _WIFISTATIONSTATE._serialized_start = 193
+    _WIFISTATIONSTATE._serialized_end = 282
+    _WIFICONNECTFAILEDREASON._serialized_start = 284
+    _WIFICONNECTFAILEDREASON._serialized_end = 345
+    _WIFIAUTHMODE._serialized_start = 348
+    _WIFIAUTHMODE._serialized_end = 480
+    _WIFIATTEMPTFAILED._serialized_start = 24
+    _WIFIATTEMPTFAILED._serialized_end = 71
+    _WIFICONNECTEDSTATE._serialized_start = 73
+    _WIFICONNECTEDSTATE._serialized_end = 191
 # @@protoc_insertion_point(module_scope)
diff --git a/components/wifi_provisioning/python/wifi_scan_pb2.py b/components/wifi_provisioning/python/wifi_scan_pb2.py
index aaf69c60f2ae..0a50bd890198 100644
--- a/components/wifi_provisioning/python/wifi_scan_pb2.py
+++ b/components/wifi_provisioning/python/wifi_scan_pb2.py
@@ -2,9 +2,12 @@
 # Generated by the protocol buffer compiler.  DO NOT EDIT!
 # source: wifi_scan.proto
 """Generated protocol buffer code."""
-from google.protobuf.internal import builder as _builder
+
+from google.protobuf.internal import enum_type_wrapper
 from google.protobuf import descriptor as _descriptor
 from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import message as _message
+from google.protobuf import reflection as _reflection
 from google.protobuf import symbol_database as _symbol_database
 # @@protoc_insertion_point(imports)
 
@@ -15,29 +18,134 @@
 import wifi_constants_pb2 as wifi__constants__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x0fwifi_scan.proto\x1a\x0f\x63onstants.proto\x1a\x14wifi_constants.proto\"\\\n\x0c\x43mdScanStart\x12\x10\n\x08\x62locking\x18\x01 \x01(\x08\x12\x0f\n\x07passive\x18\x02 \x01(\x08\x12\x16\n\x0egroup_channels\x18\x03 \x01(\r\x12\x11\n\tperiod_ms\x18\x04 \x01(\r\"\x0f\n\rRespScanStart\"\x0f\n\rCmdScanStatus\"=\n\x0eRespScanStatus\x12\x15\n\rscan_finished\x18\x01 \x01(\x08\x12\x14\n\x0cresult_count\x18\x02 \x01(\r\"3\n\rCmdScanResult\x12\x13\n\x0bstart_index\x18\x01 \x01(\r\x12\r\n\x05\x63ount\x18\x02 \x01(\r\"i\n\x0eWiFiScanResult\x12\x0c\n\x04ssid\x18\x01 \x01(\x0c\x12\x0f\n\x07\x63hannel\x18\x02 \x01(\r\x12\x0c\n\x04rssi\x18\x03 \x01(\x05\x12\r\n\x05\x62ssid\x18\x04 \x01(\x0c\x12\x1b\n\x04\x61uth\x18\x05 \x01(\x0e\x32\r.WifiAuthMode\"2\n\x0eRespScanResult\x12 \n\x07\x65ntries\x18\x01 \x03(\x0b\x32\x0f.WiFiScanResult\"\xd8\x02\n\x0fWiFiScanPayload\x12\x1d\n\x03msg\x18\x01 \x01(\x0e\x32\x10.WiFiScanMsgType\x12\x17\n\x06status\x18\x02 \x01(\x0e\x32\x07.Status\x12\'\n\x0e\x63md_scan_start\x18\n \x01(\x0b\x32\r.CmdScanStartH\x00\x12)\n\x0fresp_scan_start\x18\x0b \x01(\x0b\x32\x0e.RespScanStartH\x00\x12)\n\x0f\x63md_scan_status\x18\x0c \x01(\x0b\x32\x0e.CmdScanStatusH\x00\x12+\n\x10resp_scan_status\x18\r \x01(\x0b\x32\x0f.RespScanStatusH\x00\x12)\n\x0f\x63md_scan_result\x18\x0e \x01(\x0b\x32\x0e.CmdScanResultH\x00\x12+\n\x10resp_scan_result\x18\x0f \x01(\x0b\x32\x0f.RespScanResultH\x00\x42\t\n\x07payload*\x9c\x01\n\x0fWiFiScanMsgType\x12\x14\n\x10TypeCmdScanStart\x10\x00\x12\x15\n\x11TypeRespScanStart\x10\x01\x12\x15\n\x11TypeCmdScanStatus\x10\x02\x12\x16\n\x12TypeRespScanStatus\x10\x03\x12\x15\n\x11TypeCmdScanResult\x10\x04\x12\x16\n\x12TypeRespScanResult\x10\x05\x62\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(
+    b'\n\x0fwifi_scan.proto\x1a\x0f\x63onstants.proto\x1a\x14wifi_constants.proto"\\\n\x0c\x43mdScanStart\x12\x10\n\x08\x62locking\x18\x01 \x01(\x08\x12\x0f\n\x07passive\x18\x02 \x01(\x08\x12\x16\n\x0egroup_channels\x18\x03 \x01(\r\x12\x11\n\tperiod_ms\x18\x04 \x01(\r"\x0f\n\rRespScanStart"\x0f\n\rCmdScanStatus"=\n\x0eRespScanStatus\x12\x15\n\rscan_finished\x18\x01 \x01(\x08\x12\x14\n\x0cresult_count\x18\x02 \x01(\r"3\n\rCmdScanResult\x12\x13\n\x0bstart_index\x18\x01 \x01(\r\x12\r\n\x05\x63ount\x18\x02 \x01(\r"i\n\x0eWiFiScanResult\x12\x0c\n\x04ssid\x18\x01 \x01(\x0c\x12\x0f\n\x07\x63hannel\x18\x02 \x01(\r\x12\x0c\n\x04rssi\x18\x03 \x01(\x05\x12\r\n\x05\x62ssid\x18\x04 \x01(\x0c\x12\x1b\n\x04\x61uth\x18\x05 \x01(\x0e\x32\r.WifiAuthMode"2\n\x0eRespScanResult\x12 \n\x07\x65ntries\x18\x01 \x03(\x0b\x32\x0f.WiFiScanResult"\xec\x02\n\x0fWiFiScanPayload\x12\x1d\n\x03msg\x18\x01 \x01(\x0e\x32\x10.WiFiScanMsgType\x12\x17\n\x06status\x18\x02 \x01(\x0e\x32\x07.Status\x12\x12\n\nauth_token\x18\t \x01(\x0c\x12\'\n\x0e\x63md_scan_start\x18\n \x01(\x0b\x32\r.CmdScanStartH\x00\x12)\n\x0fresp_scan_start\x18\x0b \x01(\x0b\x32\x0e.RespScanStartH\x00\x12)\n\x0f\x63md_scan_status\x18\x0c \x01(\x0b\x32\x0e.CmdScanStatusH\x00\x12+\n\x10resp_scan_status\x18\r \x01(\x0b\x32\x0f.RespScanStatusH\x00\x12)\n\x0f\x63md_scan_result\x18\x0e \x01(\x0b\x32\x0e.CmdScanResultH\x00\x12+\n\x10resp_scan_result\x18\x0f \x01(\x0b\x32\x0f.RespScanResultH\x00\x42\t\n\x07payload*\x9c\x01\n\x0fWiFiScanMsgType\x12\x14\n\x10TypeCmdScanStart\x10\x00\x12\x15\n\x11TypeRespScanStart\x10\x01\x12\x15\n\x11TypeCmdScanStatus\x10\x02\x12\x16\n\x12TypeRespScanStatus\x10\x03\x12\x15\n\x11TypeCmdScanResult\x10\x04\x12\x16\n\x12TypeRespScanResult\x10\x05\x62\x06proto3'
+)
 
-_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, globals())
-_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'wifi_scan_pb2', globals())
-if _descriptor._USE_C_DESCRIPTORS == False:
+_WIFISCANMSGTYPE = DESCRIPTOR.enum_types_by_name['WiFiScanMsgType']
+WiFiScanMsgType = enum_type_wrapper.EnumTypeWrapper(_WIFISCANMSGTYPE)
+TypeCmdScanStart = 0
+TypeRespScanStart = 1
+TypeCmdScanStatus = 2
+TypeRespScanStatus = 3
+TypeCmdScanResult = 4
+TypeRespScanResult = 5
+
+
+_CMDSCANSTART = DESCRIPTOR.message_types_by_name['CmdScanStart']
+_RESPSCANSTART = DESCRIPTOR.message_types_by_name['RespScanStart']
+_CMDSCANSTATUS = DESCRIPTOR.message_types_by_name['CmdScanStatus']
+_RESPSCANSTATUS = DESCRIPTOR.message_types_by_name['RespScanStatus']
+_CMDSCANRESULT = DESCRIPTOR.message_types_by_name['CmdScanResult']
+_WIFISCANRESULT = DESCRIPTOR.message_types_by_name['WiFiScanResult']
+_RESPSCANRESULT = DESCRIPTOR.message_types_by_name['RespScanResult']
+_WIFISCANPAYLOAD = DESCRIPTOR.message_types_by_name['WiFiScanPayload']
+CmdScanStart = _reflection.GeneratedProtocolMessageType(
+    'CmdScanStart',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _CMDSCANSTART,
+        '__module__': 'wifi_scan_pb2',
+        # @@protoc_insertion_point(class_scope:CmdScanStart)
+    },
+)
+_sym_db.RegisterMessage(CmdScanStart)
+
+RespScanStart = _reflection.GeneratedProtocolMessageType(
+    'RespScanStart',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _RESPSCANSTART,
+        '__module__': 'wifi_scan_pb2',
+        # @@protoc_insertion_point(class_scope:RespScanStart)
+    },
+)
+_sym_db.RegisterMessage(RespScanStart)
+
+CmdScanStatus = _reflection.GeneratedProtocolMessageType(
+    'CmdScanStatus',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _CMDSCANSTATUS,
+        '__module__': 'wifi_scan_pb2',
+        # @@protoc_insertion_point(class_scope:CmdScanStatus)
+    },
+)
+_sym_db.RegisterMessage(CmdScanStatus)
 
-  DESCRIPTOR._options = None
-  _WIFISCANMSGTYPE._serialized_start=809
-  _WIFISCANMSGTYPE._serialized_end=965
-  _CMDSCANSTART._serialized_start=58
-  _CMDSCANSTART._serialized_end=150
-  _RESPSCANSTART._serialized_start=152
-  _RESPSCANSTART._serialized_end=167
-  _CMDSCANSTATUS._serialized_start=169
-  _CMDSCANSTATUS._serialized_end=184
-  _RESPSCANSTATUS._serialized_start=186
-  _RESPSCANSTATUS._serialized_end=247
-  _CMDSCANRESULT._serialized_start=249
-  _CMDSCANRESULT._serialized_end=300
-  _WIFISCANRESULT._serialized_start=302
-  _WIFISCANRESULT._serialized_end=407
-  _RESPSCANRESULT._serialized_start=409
-  _RESPSCANRESULT._serialized_end=459
-  _WIFISCANPAYLOAD._serialized_start=462
-  _WIFISCANPAYLOAD._serialized_end=806
+RespScanStatus = _reflection.GeneratedProtocolMessageType(
+    'RespScanStatus',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _RESPSCANSTATUS,
+        '__module__': 'wifi_scan_pb2',
+        # @@protoc_insertion_point(class_scope:RespScanStatus)
+    },
+)
+_sym_db.RegisterMessage(RespScanStatus)
+
+CmdScanResult = _reflection.GeneratedProtocolMessageType(
+    'CmdScanResult',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _CMDSCANRESULT,
+        '__module__': 'wifi_scan_pb2',
+        # @@protoc_insertion_point(class_scope:CmdScanResult)
+    },
+)
+_sym_db.RegisterMessage(CmdScanResult)
+
+WiFiScanResult = _reflection.GeneratedProtocolMessageType(
+    'WiFiScanResult',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _WIFISCANRESULT,
+        '__module__': 'wifi_scan_pb2',
+        # @@protoc_insertion_point(class_scope:WiFiScanResult)
+    },
+)
+_sym_db.RegisterMessage(WiFiScanResult)
+
+RespScanResult = _reflection.GeneratedProtocolMessageType(
+    'RespScanResult',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _RESPSCANRESULT,
+        '__module__': 'wifi_scan_pb2',
+        # @@protoc_insertion_point(class_scope:RespScanResult)
+    },
+)
+_sym_db.RegisterMessage(RespScanResult)
+
+WiFiScanPayload = _reflection.GeneratedProtocolMessageType(
+    'WiFiScanPayload',
+    (_message.Message,),
+    {
+        'DESCRIPTOR': _WIFISCANPAYLOAD,
+        '__module__': 'wifi_scan_pb2',
+        # @@protoc_insertion_point(class_scope:WiFiScanPayload)
+    },
+)
+_sym_db.RegisterMessage(WiFiScanPayload)
+
+if _descriptor._USE_C_DESCRIPTORS == False:
+    DESCRIPTOR._options = None
+    _WIFISCANMSGTYPE._serialized_start = 829
+    _WIFISCANMSGTYPE._serialized_end = 985
+    _CMDSCANSTART._serialized_start = 58
+    _CMDSCANSTART._serialized_end = 150
+    _RESPSCANSTART._serialized_start = 152
+    _RESPSCANSTART._serialized_end = 167
+    _CMDSCANSTATUS._serialized_start = 169
+    _CMDSCANSTATUS._serialized_end = 184
+    _RESPSCANSTATUS._serialized_start = 186
+    _RESPSCANSTATUS._serialized_end = 247
+    _CMDSCANRESULT._serialized_start = 249
+    _CMDSCANRESULT._serialized_end = 300
+    _WIFISCANRESULT._serialized_start = 302
+    _WIFISCANRESULT._serialized_end = 407
+    _RESPSCANRESULT._serialized_start = 409
+    _RESPSCANRESULT._serialized_end = 459
+    _WIFISCANPAYLOAD._serialized_start = 462
+    _WIFISCANPAYLOAD._serialized_end = 826
 # @@protoc_insertion_point(module_scope)
diff --git a/components/wifi_provisioning/src/manager.c b/components/wifi_provisioning/src/manager.c
index 3f8139787f43..f5f2f6f06275 100644
--- a/components/wifi_provisioning/src/manager.c
+++ b/components/wifi_provisioning/src/manager.c
@@ -25,6 +25,16 @@
 
 #include "wifi_provisioning_priv.h"
 
+/**
+ * @brief Enables the SpinDance changes in wifi_prov_mgr_start_provisioning().
+ *
+ * The reasoning behind the SpinDance changes has been lost. Note that the code that remains
+ * (getting the current WiFi configuration) is effectively useless, because the restoring of
+ * the old WiFi config is performed inside the err: label but only if the WIFI_PROV_SETTING_BIT
+ * is set, and the code that sets the bit is commented out.
+ */
+#define INCLUDE_SPINDANCE_PROVISIONING_SETUP_CHANGES 1
+
 #define WIFI_PROV_MGR_VERSION      "v1.1"
 #define WIFI_PROV_STORAGE_BIT       BIT0
 #define WIFI_PROV_SETTING_BIT       BIT1
@@ -144,6 +154,7 @@ struct wifi_prov_mgr_ctx {
     wifi_ap_record_t *ap_list[14];
     wifi_ap_record_t *ap_list_sorted[MAX_SCAN_RESULTS];
     wifi_scan_config_t scan_cfg;
+    wifi_prov_cb_auth_t auth_cb;
 
     /* Total number of attempts done for connecting to Wi-Fi */
     uint32_t connection_attempts_completed;
@@ -374,6 +385,7 @@ static esp_err_t wifi_prov_mgr_start_service(const char *service_name, const cha
         protocomm_delete(prov_ctx->pc);
         return ESP_ERR_NO_MEM;
     }
+    prov_ctx->wifi_prov_handlers->config_auth = prov_ctx->auth_cb;
 
     /* Add protocomm endpoint for Wi-Fi station configuration */
     ret = protocomm_add_endpoint(prov_ctx->pc, "prov-config",
@@ -396,6 +408,7 @@ static esp_err_t wifi_prov_mgr_start_service(const char *service_name, const cha
         protocomm_delete(prov_ctx->pc);
         return ESP_ERR_NO_MEM;
     }
+    prov_ctx->wifi_scan_handlers->scan_auth = prov_ctx->auth_cb;
 
     /* Add endpoint for scanning Wi-Fi APs and sending scan list */
     ret = protocomm_add_endpoint(prov_ctx->pc, "prov-scan",
@@ -568,6 +581,7 @@ static void prov_stop_and_notify(bool is_async)
     if (!is_async)
     {
         uint32_t cleanup_delay = prov_ctx->cleanup_delay > 100 ? prov_ctx->cleanup_delay : 100;
+        ESP_LOGI(TAG, "Delaying %lu ms", cleanup_delay);
         vTaskDelay(cleanup_delay / portTICK_PERIOD_MS);
     }
 
@@ -1045,6 +1059,8 @@ esp_err_t wifi_prov_mgr_wifi_scan_start(bool blocking, bool passive,
         return ESP_OK;
     }
 
+    execute_event_cb(WIFI_PROV_SCAN_STARTED, NULL, 0);
+
     /* Clear sorted list for new entries */
     for (uint8_t i = 0; i < MAX_SCAN_RESULTS; i++) {
         prov_ctx->ap_list_sorted[i] = NULL;
@@ -1582,6 +1598,10 @@ esp_err_t wifi_prov_mgr_start_provisioning(wifi_prov_security_t security, const
      * thread doesn't interfere with this process */
     prov_ctx->prov_state = WIFI_PROV_STATE_STARTING;
 
+#if INCLUDE_SPINDANCE_PROVISIONING_SETUP_CHANGES
+    wifi_config_t wifi_cfg_old = {0};
+    esp_wifi_get_config(WIFI_IF_STA, &wifi_cfg_old);
+#else
     /* Start Wi-Fi in Station Mode.
      * This is necessary for scanning to work */
     ret = esp_wifi_set_mode(WIFI_MODE_STA);
@@ -1626,6 +1646,7 @@ esp_err_t wifi_prov_mgr_start_provisioning(wifi_prov_security_t security, const
         ESP_LOGE(TAG, "Failed to disconnect");
         goto err;
     }
+#endif // INCLUDE_SPINDANCE_PROVISIONING_SETUP_CHANGES
 
 #ifdef CONFIG_ESP_PROTOCOMM_SUPPORT_SECURITY_VERSION_0
     /* Initialize app data */
@@ -1852,3 +1873,11 @@ esp_err_t wifi_prov_mgr_reset_sm_state_for_reprovision(void)
     RELEASE_LOCK(prov_ctx_lock);
     return ret;
 }
+
+esp_err_t wifi_prov_mgr_set_authorization_cb(wifi_prov_cb_auth_t auth_cb) {
+    if (!prov_ctx) {
+        return ESP_FAIL;
+    }
+    prov_ctx->auth_cb = auth_cb;
+    return ESP_OK;
+}
diff --git a/components/wifi_provisioning/src/wifi_config.c b/components/wifi_provisioning/src/wifi_config.c
index b97ef2a55246..89ad58e31480 100644
--- a/components/wifi_provisioning/src/wifi_config.c
+++ b/components/wifi_provisioning/src/wifi_config.c
@@ -155,6 +155,18 @@ static esp_err_t cmd_set_config_handler(WiFiConfigPayload *req,
     }
     resp_set_config__init(resp_payload);
 
+    /* Check authorization if callback is set */
+    if (h->config_auth) {
+        esp_err_t auth_ret = h->config_auth((const char*)req->auth_token.data, req->auth_token.len);
+        if (auth_ret != ESP_OK) {
+            ESP_LOGW(TAG, "Authorization failed for config command");
+            resp_payload->status = STATUS__InvalidArgument;
+            resp->payload_case = WI_FI_CONFIG_PAYLOAD__PAYLOAD_RESP_SET_CONFIG;
+            resp->resp_set_config = resp_payload;
+            return ESP_OK; // Don't close connection, just return auth failure
+        }
+    }
+
     wifi_prov_config_set_data_t req_data;
     memset(&req_data, 0, sizeof(req_data));
 
@@ -319,6 +331,19 @@ esp_err_t wifi_prov_config_data_handler(uint32_t session_id, const uint8_t *inbu
         return ESP_ERR_INVALID_ARG;
     }
 
+    /* Authorize before dispatching command */
+    const wifi_prov_config_handlers_t *h = (const wifi_prov_config_handlers_t *)priv_data;
+    esp_err_t auth_status = ESP_OK;
+    if (h->config_auth) {
+        auth_status = h->config_auth(
+                (const char*)req->auth_token.data,
+                req->auth_token.len);
+    }
+    if (ESP_OK != auth_status) {
+        ESP_LOGE(TAG, "Proto command dispatch not authorized");
+        return ESP_FAIL;
+    }
+
     wi_fi_config_payload__init(&resp);
     ret = wifi_prov_config_command_dispatcher(req, &resp, priv_data);
     if (ret != ESP_OK) {
diff --git a/components/wifi_provisioning/src/wifi_provisioning_priv.h b/components/wifi_provisioning/src/wifi_provisioning_priv.h
index 3deff26c9407..c4b939338211 100644
--- a/components/wifi_provisioning/src/wifi_provisioning_priv.h
+++ b/components/wifi_provisioning/src/wifi_provisioning_priv.h
@@ -54,24 +54,6 @@ esp_err_t wifi_prov_mgr_wifi_scan_start(bool blocking, bool passive,
  */
 bool wifi_prov_mgr_wifi_scan_finished(void);
 
-/**
- * @brief   Get the count of results in the scan list
- *
- * @return
- *  - count  : Number of Wi-Fi Access Points detected while scanning
- */
-uint16_t wifi_prov_mgr_wifi_scan_result_count(void);
-
-/**
- * @brief   Get AP record for a particular index in the scan list result
- *
- * @param[out] index  Index of the result to fetch
- *
- * @return
- *  - result : Pointer to Access Point record
- */
-const wifi_ap_record_t *wifi_prov_mgr_wifi_scan_result(uint16_t index);
-
 /**
  * @brief   Get protocomm handlers for wifi_config provisioning endpoint
  *
diff --git a/components/wifi_provisioning/src/wifi_scan.c b/components/wifi_provisioning/src/wifi_scan.c
index bfc0596f5215..b747ee975d57 100644
--- a/components/wifi_provisioning/src/wifi_scan.c
+++ b/components/wifi_provisioning/src/wifi_scan.c
@@ -1,16 +1,8 @@
-// Copyright 2019 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2019-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #include <stdio.h>
 #include <esp_log.h>
@@ -71,8 +63,19 @@ static esp_err_t cmd_scan_start_handler(WiFiScanPayload *req,
         ESP_LOGE(TAG, "Error allocating memory");
         return ESP_ERR_NO_MEM;
     }
-
     resp_scan_start__init(resp_payload);
+
+    /* Check authorization if callback is set */
+    if (h->scan_auth) {
+        esp_err_t auth_ret = h->scan_auth((const char*)req->auth_token.data, req->auth_token.len);
+        if (auth_ret != ESP_OK) {
+            ESP_LOGW(TAG, "Authorization failed for scan command");
+            resp->status = STATUS__InvalidArgument;
+            resp->payload_case = WI_FI_SCAN_PAYLOAD__PAYLOAD_RESP_SCAN_START;
+            resp->resp_scan_start = resp_payload;
+            return ESP_OK; // Don't close connection, just return auth failure
+        }
+    }
     resp->status = (h->scan_start(req->cmd_scan_start->blocking,
                                   req->cmd_scan_start->passive,
                                   req->cmd_scan_start->group_channels,
@@ -268,6 +271,19 @@ esp_err_t wifi_prov_scan_handler(uint32_t session_id, const uint8_t *inbuf, ssiz
         return ESP_ERR_INVALID_ARG;
     }
 
+    /* Authorize before dispatching command */
+    const wifi_prov_scan_handlers_t *h = (const wifi_prov_scan_handlers_t *)priv_data;
+    esp_err_t auth_status = ESP_OK;
+    if (h->scan_auth) {
+        auth_status = h->scan_auth(
+                (const char*)req->auth_token.data,
+                req->auth_token.len);
+    }
+    if (ESP_OK != auth_status) {
+        ESP_LOGE(TAG, "Proto command dispatch not authorized");
+        return ESP_FAIL;
+    }
+
     wi_fi_scan_payload__init(&resp);
     ret = wifi_prov_scan_cmd_dispatcher(req, &resp, priv_data);
     if (ret != ESP_OK) {
diff --git a/tools/ci/check_copyright_ignore.txt b/tools/ci/check_copyright_ignore.txt
index 4cb53b9ebac5..9af0dd3c71c4 100644
--- a/tools/ci/check_copyright_ignore.txt
+++ b/tools/ci/check_copyright_ignore.txt
@@ -519,7 +519,6 @@ components/tcp_transport/include/esp_transport_ws.h
 components/vfs/include/esp_vfs_common.h
 components/wifi_provisioning/include/wifi_provisioning/scheme_console.h
 components/wifi_provisioning/include/wifi_provisioning/scheme_softap.h
-components/wifi_provisioning/include/wifi_provisioning/wifi_scan.h
 components/wifi_provisioning/proto-c/wifi_config.pb-c.c
 components/wifi_provisioning/proto-c/wifi_config.pb-c.h
 components/wifi_provisioning/proto-c/wifi_constants.pb-c.c
@@ -530,7 +529,6 @@ components/wifi_provisioning/python/wifi_config_pb2.py
 components/wifi_provisioning/python/wifi_constants_pb2.py
 components/wifi_provisioning/python/wifi_scan_pb2.py
 components/wifi_provisioning/src/scheme_console.c
-components/wifi_provisioning/src/wifi_scan.c
 components/wpa_supplicant/esp_supplicant/src/esp_wpa_err.h
 components/wpa_supplicant/include/utils/wpa_debug.h
 components/wpa_supplicant/include/utils/wpabuf.h
diff --git a/tools/idf_tools.py b/tools/idf_tools.py
index f6dc6ec1e19b..fd4a829b6484 100755
--- a/tools/idf_tools.py
+++ b/tools/idf_tools.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # coding=utf-8
 #
 # SPDX-FileCopyrightText: 2019-2025 Espressif Systems (Shanghai) CO LTD