Security Architecture Questions

Hi, i am trying to understand better the security architecture in TTN.
From the TTN Console in the App > Device screen i see:

App Key

Network Session Key

App Session Key

Now, according to the theory here my questions:
does TTN provide (in addition to Network Server, Application Server) the Join Server?
How can i share/install my own (device) AppKey in the Join Server in TTN?
Are there API to do that?

thanks.

:thinking:

I removed "under the hood ", makes you happy hopefully

well, I was thinking 'what does he want / mean ’ ??

So now I think… open source / code ??
Answer is yes… here you find everything https://github.com/TheThingsNetwork/ttn

and this webinair vid is interesting https://www.youtube.com/watch?v=6IDaUxhEgaI

ohh ok. The title is “Archtiecture Questions” so it is pure theory question. Just i want to know (if possible) if in TTN there is a Join Server and if yes, how i can provision key programatically?
Furthermore, i use SODAQ Explorer which i have registered in the console and for which the AppKey was auto-generated. Therefore I assume that by default i am not using any key provisioned in the device but only the session keys, right?

thanks for your response.

I think i have understood the following. The fact that i copy the AppKey (aka Root Key) in the code, it means that i use OOTA. It is a manual process but of course it can be automated with proper provisioning process. Am i right?