# IMEI Lock Restrict SIM usage to approved device IMEI numbers. The IMEI Lock option provides a straightforward method for securing your IoT SIM, ensuring that in the case that your IoT SIM is stolen, it cannot be used inside another device resulting in unwanted data usage charges. When an IoT SIM card attempts to connect to the network using an IMEI that does not match the one registered with the IMEI Lock configuration, an error with the following format will be shown in the [Error Logs](https://docs.soracom.io/en/services/error-logs): `Subscriber {IMSI} is not allowed to create session: Device IMEI {IMEI} does not match configured IMEI {IMEI}` > [!NOTE] > > If you enable or change IMEI lock for an IoT SIM that is already online, the existing session will still remain active. The updated IMEI lock settings will only apply when a new data session is established. To enforce the IMEI lock immediately, [delete the current session](https://docs.soracom.io/en/services/air/session-status#deleting-an-online-session) or restart your device to initiate a new session. ## Enabling IMEI Lock > [!WARNING] > > You can set an IMEI Lock for multiple IoT SIMs simultaneously by clicking the **☑** for each SIM you want to configure before proceeding with the steps below. Each SIM will be locked to the IMEI number of the device it was most recently associated with. 1. Sign in to the **[User Console](https://console.soracom.io/?coverage_type=g)**. From the **☰ Menu**, open the **SIM Management** screen. 2. From the list of subscribers, click the **☑** for the SIM you want to modify. 3. Click the **Actions ▾** menu, then select **Enable IMEI lock**. ![Enable IMEI lock](https://docs.soracom.io/_astro/enable-imei-lock.gsRT79vZ_Z2beEVY.webp) 4. In the dialog, enter the IMEI number (International Mobile Equipment Identity) of the device the SIM should be locked to, then click **Lock**. ![Set IMEI lock](https://docs.soracom.io/_astro/set-imeilock.DcNHjDDA_7cg3g.webp) > [!NOTE] > > If a local network that the SIM is connected to does not report the IMEI of the device, with IMEI Lock enabled, Soracom will block the connection by default, which may result in unexpected downtime. To enable IMEI Lock, but still allow connections when a local network is not reporting the IMEI information, check the box to **Allow connections when IMEI is temporarily not available** ![temp imei lock](https://docs.soracom.io/_astro/IMEI-lock.BmRgdDxV_1RDia7.webp) ## Removing IMEI Lock > [!WARNING] > > You can remove an IMEI Lock for multiple IoT SIMs simultaneously by clicking the **☑** for each SIM you want to remove before proceeding with the steps below. The IMEI Lock will be removed for each selected SIM, regardless of its session status. 1. Sign in to the **[User Console](https://console.soracom.io/?coverage_type=g)**. From the **☰ Menu**, open the **SIM Management** screen. 2. From the list of subscribers, click the **☑** for the SIM you want to modify. 3. Click the **Actions ▾** menu, then select **Remove IMEI Lock**. ![Remove IMEI lock](https://docs.soracom.io/_astro/remove-imei-lock-2.DbXgc2Wk_Z2uWyg4.webp) 4. In the dialog, click **Remove Lock** to confirm that you want to remove the IMEI Lock. ![Remove the IMEI lock from your SIM via the dialog](https://docs.soracom.io/_astro/remove-imei-lock.B6fZOSzL_2wm45w.webp) ## Programmatic Usage You can also use the Soracom API, Soracom CLI, and Metadata Service to enable or disable IMEI Lock. ### Soracom API To access the Soracom API, first use the [**auth**](https://docs.soracom.io/en/api#!/Auth/auth) API to obtain an API Key and Token. Refer to the [**API Usage Guide**](https://docs.soracom.io/en/developers/soracom-api) for instructions on how to use the API Key and Token in API requests. Then, use the [setSimImeiLock](https://docs.soracom.io/en/api#!/Sim/setSimImeiLock) API to enable IMEI Lock on an IoT SIM: **Global** ```bash curl -X POST \ -H 'X-Soracom-API-Key: ' \ -H 'X-Soracom-Token: ' \ -H 'Content-Type: application/json' \ -d '{ "imei": "860000012345678" }' \ https://g.api.soracom.io/v1/sims//set_imei_lock ``` **Japan** ```bash curl -X POST \ -H 'X-Soracom-API-Key: ' \ -H 'X-Soracom-Token: ' \ -H 'Content-Type: application/json' \ -d '{ "imei": "860000012345678" }' \ https://jp.api.soracom.io/v1/sims//set_imei_lock ``` If the subscriber is online, you can omit the payload in order to lock the subscriber to the current IMEI. To remove the IMEI Lock from an IoT SIM, use the [unsetSimImeiLock](https://docs.soracom.io/en/api#!/Sim/unsetSimImeiLock) API: **Global** ```bash curl -X POST \ -H 'X-Soracom-API-Key: ' \ -H 'X-Soracom-Token: ' \ https://g.api.soracom.io/v1/sims//unset_imei_lock ``` **Japan** ```bash curl -X POST \ -H 'X-Soracom-API-Key: ' \ -H 'X-Soracom-Token: ' \ https://jp.api.soracom.io/v1/sims//unset_imei_lock ``` ### Soracom CLI To use the Soracom CLI, you must first configure it to authenticate with your account information, authorization key, or SAM user credentials. Run the following command to enable the IMEI lock on an IoT SIM: **Global** ```bash soracom sims set-imei-lock --sim-id --imei "860000012345678" --coverage-type g ``` **Japan** ```bash soracom sims set-imei-lock --sim-id --imei "860000012345678" --coverage-type jp ``` If the subscriber is online, you can omit the `--imei` flag in order to lock the subscriber to the current IMEI. To remove the IMEI Lock from an IoT SIM, use following command: **Global** ```bash soracom sims unset-imei-lock --sim-id --coverage-type g ``` **Japan** ```bash soracom sims unset-imei-lock --sim-id --coverage-type jp ``` ### Metadata Service The Metadata Service allows an Air SIM device to access and configure its own settings without the need for authentication. For more information, refer to the [**Metadata Service**](https://docs.soracom.io/en/services/air/metadata-service) documentation. Because the Metadata Service allows an IoT SIM to access its own subscriber settings, this can be used as part of an initialization script so that a device sets its own IMEI lock when it connects to a network for the first time. To enable the IMEI Lock on an IoT SIM, the Metadata Service **Readonly** option must be disabled. Then, from the IoT SIM device, use the [setImeiLock](https://docs.soracom.io/en/api#!/Subscriber/setImeiLock) API: ```bash curl -X POST \ -H 'Content-Type: application/json' \ -d '{ "imei": "860000012345678" }' \ http://metadata.soracom.io/v1/subscriber/set_imei_lock ``` Since the subscriber will be online, you can also omit the payload in order to lock the subscriber to its current IMEI. To remove the IMEI Lock from the IoT SIM, use the [unsetImeiLock](https://docs.soracom.io/en/api#!/Subscriber/unsetImeiLock) API: ```bash curl -X POST http://metadata.soracom.io/v1/subscriber/unset_imei_lock ```