A heating ventilation and air conditioning (HVAC) system for a building space includes an HVAC device including a processing circuit. The processing circuit is configured to generate an encrypted dynamic key based on a manifest stored on the device. The manifest includes a set of entitlements for the HVAC device based on relationships between the HVAC device and entities. The processing circuit is further configured to transmit the stored manifest to an authentication server by sending the encrypted dynamic key to the authentication server and receive an updated manifest from the authentication server based on the encrypted dynamic key. The processing circuit is further configured to send a payload request to the authentication server based on the updated manifest, the payload request including a software update request.