A computer implemented method, comprising: receiving a first request to access a firmware-locked function of a secure device, wherein the first request includes a requestor token having requestor identification data and a channel identifier; in response to the receiving the first request, determining a first channel identification of the first request associated with a channel from which the first request is received by identifying a medium through which the first request is received; comparing the first channel identification with the channel identifier of the requestor token; determining that the first channel identification matches the channel identifier of the requestor token; retrieving authorization data stored in non-volatile memory of the secure device, wherein the authorization data includes a token identifier indicative of tokens authorized to access the firmware-locked function; determining that the requestor identification data of the requestor token matches the token identifier stored in the non-volatile memory; in response to determining that the requestor identification data matches the token identifier and determining that the first channel identification matches the channel identifier of the requestor token, enabling access to the firmware-locked function; receiving a second request to access the firmware-locked function, wherein the second request includes the requestor token; determining a second channel identification indicative of a channel from which the second request was received; determining that the second channel identification differs from the channel identifier of the requestor token by comparing the second channel identification with the channel identifier; and in response to determining that the second channel identification differs from the channel identifier of the requestor token, denying access to the firmware-locked function, wherein the first channel identification includes a first application programming interface, API, through which the first request is received, and wherein the second channel identification includes a second API through which the second request is received. receiving a first request to access a firmware-locked function of a secure device, wherein the first request includes a requestor token having requestor identification data and a channel identifier; in response to the receiving the first request, determining a first channel identification of the first request associated with a channel from which the first request is received by identifying a medium through which the first request is received; comparing the first channel identification with the channel identifier of the requestor token; determining that the first channel identification matches the channel identifier of the requestor token; retrieving authorization data stored in non-volatile memory of the secure device, wherein the authorization data includes a token identifier indicative of tokens authorized to access the firmware-locked function; determining that the requestor identification data of the requestor token matches the token identifier stored in the non-volatile memory; in response to determining that the requestor identification data matches the token identifier and determining that the first channel identification matches the channel identifier of the requestor token, enabling access to the firmware-locked function; receiving a second request to access the firmware-locked function, wherein the second request includes the requestor token; determining a second channel identification indicative of a channel from which the second request was received; determining that the second channel identification differs from the channel identifier of the requestor token by comparing the second channel identification with the channel identifier; and in response to determining that the second channel identification differs from the channel identifier of the requestor token, denying access to the firmware-locked function, wherein the first channel identification includes a first application programming interface, API, through which the first request is received, and wherein the second channel identification includes a second API through which the second request is received.