How should factory provisioning inject secrets safely?

Inject unique device secrets at a controlled factory station with audited tooling, not through mobile apps on the line. Keep manufacturing credentials separate from user bonds and revoke them after enrollment. For example, a QR-code station can bind a sensor certificate once, while line logs never contain reusable keys.