# Devices

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F5ftStQCAmP0Ff6YRT1hO%2FDevices.jpg?alt=media&#x26;token=cc7439f2-e1e5-4755-be90-d4782bb1923f" alt=""><figcaption></figcaption></figure>

### What's a Device?

A Device can be any machine, application or endpoint that has the ability to communicate with the Keeper platform, authenticate and decrypt data that has been provisioned.

Applications have any number of devices associated. Each device has a unique identifier so that it can be tightly controlled and managed. Devices authenticate and decrypt data using a API and encryption model as defined in the Keeper Secrets Manager Security & Encryption model page.

* See the [Security & Encryption Model](https://docs.keeper.io/en/keeperpam/secrets-manager/about/security-encryption-model) of a Device

### Creating a Device

A device can be created through the Applications section of the vault user interface or through the Keeper Commander CLI.

From the Vault user interface, go to Secrets Manager and select the Application. Then select the Devices tab and click "Add Device".

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FvXs6AeY5tmdvIyzQ8gWv%2FScreenshot%202024-12-26%20at%207.59.36%E2%80%AFPM.png?alt=media&#x26;token=611bfb73-e966-40db-bd44-962eb1fcc59c" alt=""><figcaption><p>Create a Device</p></figcaption></figure>

### Device Initialization

A Keeper device can be initialized through either a One-Time Access Token or a pre-built configuration file in either base64 or JSON format.

#### One-Time Access Token Initialization

The One-Time Access Token is an encryption key used by a device for only one authentication to the cloud. After that, a local configuration is created with all of the necessary keys for subsequent authentications and decryption of the resulting vault ciphertext. The Keeper Secrets Manager SDKs and many out of the box integrations utilize this method.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F4W35bPtAymO4Sbx27Qwg%2FScreenshot%202024-12-26%20at%208.00.25%E2%80%AFPM.png?alt=media&#x26;token=4424ce27-486f-40eb-ad4c-ec67fa219354" alt=""><figcaption><p>Add a device using One-Time Access Token and IP Lockdown</p></figcaption></figure>

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FOuI8qji19fOvDvdMLAUI%2FScreenshot%202024-12-26%20at%208.01.32%E2%80%AFPM.png?alt=media&#x26;token=a06c0903-78ba-42a8-bb7c-e3970298b118" alt=""><figcaption><p>Access Token Generated</p></figcaption></figure>

One additional feature of this method is that you can optionally lock down API requests to a specific IP address. The IP address allowed to transact is based on the IP as seen by Keeper's cloud infrastructure.

* [One-Time Access Token details](https://docs.keeper.io/en/keeperpam/secrets-manager/about/one-time-token)

#### Configuration File Initialization

The Configuration file method of creating a device is useful for tools and integrations where all of the secrets need to be provided at runtime. Most of the CI/CD integration methods use this pre-built configuration file.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FpfSN89i3gEWOSpOMWCDS%2FScreenshot%202024-12-26%20at%208.00.36%E2%80%AFPM.png?alt=media&#x26;token=8d5dc364-f8f3-47a4-9e21-81ae4a006f38" alt=""><figcaption><p>Creating a new device with Configuration File method</p></figcaption></figure>

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F14KWP5B9HsqwWDW1GRIs%2FScreenshot%202024-12-26%20at%208.01.55%E2%80%AFPM.png?alt=media&#x26;token=9c104dad-d333-49ef-9491-a27af0e79423" alt=""><figcaption><p>Device created with Configuration method</p></figcaption></figure>

For more information about the contents of a Keeper Secrets Manager configuration:

* [Secrets Manager Configuration details](https://docs.keeper.io/en/keeperpam/secrets-manager/about/secrets-manager-configuration)

#### Commander CLI

The Keeper Commander CLI can create devices with some additional capabilities that are not available in the UI. For example, the CLI can create any number of devices in bulk, or set an expiration on the validity of the device.

Additional features of the Commander CLI device initialization method:

* Control over the device name
* Access expiration when the device can be initialized
* Access expiration of the device&#x20;
* Allow all IPs or restrict to the first requested IP
* Generate a number of device tokens or configurations in bulk
* Option to initialize with a on-time access token or configuration file

#### Command Help

secrets-manager client add --app \[APP NAME OR UID] --unlock-ip

&#x20;   Options:&#x20;

&#x20;     **--name** \[CLIENT NAME] : Name of the client (Default: Random 10 characters string)

&#x20;     **--first-access-expires-in-min** \[MIN] : First time access expiration (Default 60, Max 1440)

&#x20;     **--access-expire-in-min** \[MIN] : Client access expiration (Default: no expiration)

&#x20;     **--unlock-ip** : Does not lock IP address to first requesting device

&#x20;    **--count** \[NUM] : Number of tokens to generate (Default: 1)

&#x20;     **--config-init** \[json, b64 or k8s] : Initialize configuration string from a one-time token

Example:

{% code overflow="wrap" %}

```
secrets-manager client add --app "My Infrastructure App" --unlock-ip
```

{% endcode %}

* See more details on the [secrets-manager Commander CLI command](https://docs.keeper.io/en/keeperpam/commander-cli/command-reference/secrets-manager-commands)
