import Image from "next/image";

# Add or Remove Devices

When a device is created, Firezone generates the WireGuard private key
ephemerally in the user's browser. This key is **never saved**, and cannot be
shown again once it is no longer displayed.

**We recommend asking end users to generate their own device configs so the
WireGuard private key is not exposed.** Users can follow instructions on the
[Client Instructions](/docs/user-guides/client-instructions) page to generate
their own WireGuard configs.

## Admin device config generation

Firezone admins can generate device configs for all users. This can be done by
clicking the "Add Device" button on the user profile page found in `/users`.

<Image className="mx-auto"
  alt="add device under user"
  src="/images/add-device-under-user.png"
  width={960}
  height={540}
/>

Once the device profile is created, the admin can download and send the
WireGuard configuration file to the user over a secure channel.

See [Add Users](/docs/user-guides/add-users) for more information on how to add
a user.

## Related guides

- [Client Instructions](/docs/user-guides/client-instructions)
