Secure authentication over unencrypted connection

Without going into unnecessary details, we are developing a certain device which only uses Bluetooth for communication with user's phone. The device has to be calibrated from time to time, and in order to prevent unauthorized users from calibrating it (it should only be calibrated by authorized people), we need a mechanism of authentication. The phone of a trusted calibrator will make a call to our API, the API will then return some kind of access key, and then, calibration …

authentication bluetooth communication cybersecurity device order people phone unencrypted