Abstract Cryptography is one of the most widely employed means to ensure confidentiality in the Internet of Things (IoT). Establishing cryptographically secure links between IoT devices requires the prior consensus to a secret encryption key. Yet, IoT devices are resource-constrained and cannot employ traditional key distribution schemes. As a result, there is a growing interest in generating secret random keys locally, using the shared randomness of the communicating channel. This article presents a secret key generation scheme, named SKYGlow, which is targeted at resource-constrained IoT platforms and tested on devices that employ IEEE 802.15.4 radios. We first examine the practical upper bounds of the number of secret bits that can be extracted from a message exchange. We contrast these upper bounds with the current state-of-the-art, and elaborate on the workings of the proposed scheme. SKYGlow applies the Discrete Cosine Transform (DCT) on channel observations of exchanged messages to reduce mismatches and increase correlation between the generated secret bits. We validate the performance of SKYGlow in both indoor and outdoor scenarios, at 2.4 GHz and 868 MHz respectively. The results suggest that SKYGlow can create secret 128-bit keys of 0.9978 bits entropy with just 65 packet exchanges, outperforming the state-of-the-art in terms of energy efficiency.