[API reference](https://evolu.dev/docs/api-reference) › [@evolu/common](https://evolu.dev/docs/api-reference/common) › [local‑first/Auth](https://evolu.dev/docs/api-reference/common/local-first/Auth) › DeviceSecret

```ts
type DeviceSecret = Uint8Array<ArrayBufferLike> &
  import("../Brand.ts").Brand<"Entropy"> &
  import("../Brand.ts").Brand<"Length32"> &
  import("../Brand.ts").Brand<"DeviceSecret">;
```

Defined in: [packages/common/src/local-first/Auth.ts:106](https://github.com/evoluhq/evolu/blob/aa223771feea747ffb1b0f5f3271574455633e37/packages/common/src/local-first/Auth.ts#L106)

The secret of an app's device database, which keeps the AppOwners the app can
open on this device. Keep it where only the user or the platform can unlock
it, as `loadDeviceSecret` of `@evolu/react-native` does, or in Electron's
`safeStorage`. It isn't an [OwnerSecret](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerSecret): [createEvoluApp](https://evolu.dev/docs/api-reference/common/local-first/Evolu/functions/createEvoluApp) derives
the device database's owner from it on paths no OwnerSecret reaches, so no
AppOwner's ID or keys name or open the device database. Create it with
[createDeviceSecret](https://evolu.dev/docs/api-reference/common/local-first/Auth/functions/createDeviceSecret) and never use its bytes as an OwnerSecret: an
AppOwner's mnemonic is its secret, so whoever holds it would derive the
device database's key. 32 zero bytes are instant start's public secret, so
the Type rejects them, also in [createEvoluApp](https://evolu.dev/docs/api-reference/common/local-first/Evolu/functions/createEvoluApp), which checks the secret
it gets with the Type.