# Understanding Device Auth
**URL:** https://hub.mender.io/t/understanding-device-auth/1266
**Category:** General Discussions
**Created:** [November 19, 2019, 2:29pm UTC](https://hub.mender.io/t/understanding-device-auth/1266 "2019-11-19T14:29:15Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@mvargasevans](https://hub.mender.io/u/mvargasevans)
#### Post date: [November 19, 2019, 2:29pm UTC](https://hub.mender.io/t/understanding-device-auth/1266/1 "2019-11-19T14:29:15Z")
Hello Mender Team,
I am trying to gain some understanding on the Device Authorization process.
The documentation is pretty good as shown here: [Device Authentication](https://docs.mender.io/2.1/architecture/device-authentication)
However, I am not able to grasp the part highlighted in bold about the device signing with a private key kept secretly on the device. I have provided to the device Identity Attributes, the public server.crt key and the artifact-verify-key.pem (for artifacts, and public). At which step is a private key provided/generated?
> To obtain an auth token, the device sends an **authentication request** containing the identity attributes and its current **public key**. **The request is signed with the respective private key (kept secret on the device)**, and the server uses the public key to verify the signature.
Would it be possible to explain this step?
By the way, thanks for the excellent support.
---
### Author:  [@mirzak](https://hub.mender.io/u/mirzak)
#### Post date: [November 19, 2019, 2:37pm UTC](https://hub.mender.io/t/understanding-device-auth/1266/2 "2019-11-19T14:37:40Z")
It can be found on your device `/data/mender/mender-agent.pem`. This file is automatically generated on first boot if not present and hence why you might not be aware of it.
You can also provide your own keys by following,
[https://docs.mender.io/2.2/server-integration/preauthorizing-devices](https://docs.mender.io/2.2/server-integration/preauthorizing-devices)
---
### Author:  [@mvargasevans](https://hub.mender.io/u/mvargasevans)
#### Post date: [November 19, 2019, 2:51pm UTC](https://hub.mender.io/t/understanding-device-auth/1266/3 "2019-11-19T14:51:01Z")
Well, that was straight to the point.
Very much appreciated!
As a follow up, if it is generated on boot, how does the server knows the public one?
---
### Author:  [@drewmoseley](https://hub.mender.io/u/drewmoseley)
#### Post date: [November 21, 2019, 11:25pm UTC](https://hub.mender.io/t/understanding-device-auth/1266/4 "2019-11-21T23:25:11Z")
It doesn’t which is why the initial connection is rejected until you explicit accept the device. If you use preauthorization, you are basically ensuring that the server knows the certificate ahead of time; usually by generating it offline and then copying into both the target filesystem and into the server.
---
### Author:  [@mvargasevans](https://hub.mender.io/u/mvargasevans)
#### Post date: [November 22, 2019, 9:45am UTC](https://hub.mender.io/t/understanding-device-auth/1266/5 "2019-11-22T09:45:15Z")
Hi Mirzak and Drew,
All clear and checked.
Thank you for the explanation!