diff --git a/src/app/api/machines/companies/route.ts b/src/app/api/machines/companies/route.ts
index 6826a24..9ffb6b9 100644
--- a/src/app/api/machines/companies/route.ts
+++ b/src/app/api/machines/companies/route.ts
@@ -1,3 +1,4 @@
+import { randomBytes } from "crypto"
 import { ConvexHttpClient } from "convex/browser"
 
 import { Prisma } from "@prisma/client"
@@ -31,7 +32,7 @@ function extractSecret(request: Request, url: URL): string | null {
   return null
 }
 
-async function ensureConvexCompany(params: { tenantId: string; slug: string; name: string }) {
+async function ensureConvexCompany(params: { tenantId: string; slug: string; name: string; provisioningCode: string }) {
   if (!env.NEXT_PUBLIC_CONVEX_URL) {
     throw new Error("Convex não configurado")
   }
@@ -147,6 +148,8 @@ export async function POST(request: Request) {
       where: { tenantId, slug: normalizedSlug },
     })
 
+    const provisioningCode = existing?.provisioningCode ?? randomBytes(32).toString("hex")
+
     const company =
       existing ??
       (await prisma.company.create({
@@ -154,10 +157,16 @@ export async function POST(request: Request) {
           tenantId,
           name,
           slug: normalizedSlug,
+          provisioningCode,
         },
       }))
 
-    await ensureConvexCompany({ tenantId, slug: company.slug, name: company.name })
+    await ensureConvexCompany({
+      tenantId,
+      slug: company.slug,
+      name: company.name,
+      provisioningCode: company.provisioningCode,
+    })
 
     return jsonWithCors(
       {
@@ -179,7 +188,12 @@ export async function POST(request: Request) {
       try {
         const fallback = await prisma.company.findFirst({ where: { tenantId, slug: normalizedSlug } })
         if (fallback) {
-          await ensureConvexCompany({ tenantId, slug: fallback.slug, name: fallback.name })
+          await ensureConvexCompany({
+            tenantId,
+            slug: fallback.slug,
+            name: fallback.name,
+            provisioningCode: fallback.provisioningCode,
+          })
           return jsonWithCors(
             {
               company: {