All keys used to generate Biometric TOTP tokens never leave the device. The keys are generated using a True Random Number Generator (TRNG) at provisioning time. The keys are not pre-generated by HYPR, are not modifiable on the device and cannot be retrieved from the device.