diff --git a/src/base_api_handler_unittest.cc b/src/base_api_handler_unittest.cc
index 23ef95e..cdb6151 100644
--- a/src/base_api_handler_unittest.cc
+++ b/src/base_api_handler_unittest.cc
@@ -57,7 +57,7 @@
     config->Load();
     dev_reg_.reset(new DeviceRegistrationInfo(&component_manager_,
                                               std::move(config), nullptr,
-                                              &http_client_, nullptr));
+                                              &http_client_, nullptr, nullptr));
 
     EXPECT_CALL(device_, GetSettings())
         .WillRepeatedly(ReturnRef(dev_reg_->GetSettings()));
diff --git a/src/device_manager.cc b/src/device_manager.cc
index 7a9021f..743f5bb 100644
--- a/src/device_manager.cc
+++ b/src/device_manager.cc
@@ -13,6 +13,7 @@
 #include "src/component_manager_impl.h"
 #include "src/config.h"
 #include "src/device_registration_info.h"
+#include "src/privet/auth_manager.h"
 #include "src/privet/privet_manager.h"
 #include "src/string_utils.h"
 #include "src/utils.h"
@@ -32,9 +33,21 @@
   std::unique_ptr<Config> config{new Config{config_store}};
   config->Load();
 
+  if (http_server) {
+    auth_manager_.reset(
+        new privet::AuthManager(config->GetSettings().secret,
+                                http_server->GetHttpsCertificateFingerprint()));
+
+    if (auth_manager_->GetSecret() != config->GetSettings().secret) {
+      // There is no Config::OnChangedCallback registered.
+      Config::Transaction transaction(config.get());
+      transaction.set_secret(auth_manager_->GetSecret());
+    }
+  }
+
   device_info_.reset(new DeviceRegistrationInfo(
       component_manager_.get(), std::move(config), task_runner, http_client,
-      network));
+      network, auth_manager_.get()));
   base_api_handler_.reset(new BaseApiHandler{device_info_.get(), this});
 
   device_info_->Start();
@@ -68,8 +81,8 @@
                                 provider::Wifi* wifi,
                                 provider::Bluetooth* bluetooth) {
   privet_.reset(new privet::Manager{task_runner});
-  privet_->Start(network, dns_sd, http_server, wifi, device_info_.get(),
-                 component_manager_.get());
+  privet_->Start(network, dns_sd, http_server, wifi, auth_manager_.get(),
+                 device_info_.get(), component_manager_.get());
 }
 
 GcdState DeviceManager::GetGcdState() const {
diff --git a/src/device_manager.h b/src/device_manager.h
index 3b042eb..9b03b05 100644
--- a/src/device_manager.h
+++ b/src/device_manager.h
@@ -16,6 +16,7 @@
 class DeviceRegistrationInfo;
 
 namespace privet {
+class AuthManager;
 class Manager;
 }  // namespace privet
 
@@ -99,6 +100,7 @@
                    provider::Wifi* wifi,
                    provider::Bluetooth* bluetooth);
 
+  std::unique_ptr<privet::AuthManager> auth_manager_;
   std::unique_ptr<ComponentManager> component_manager_;
   std::unique_ptr<DeviceRegistrationInfo> device_info_;
   std::unique_ptr<BaseApiHandler> base_api_handler_;
diff --git a/src/device_registration_info.cc b/src/device_registration_info.cc
index 110ba81..52d2515 100644
--- a/src/device_registration_info.cc
+++ b/src/device_registration_info.cc
@@ -238,15 +238,18 @@
 
 DeviceRegistrationInfo::DeviceRegistrationInfo(
     ComponentManager* component_manager,
-    std::unique_ptr<Config> config,
+    std::unique_ptr<Config>
+        config,
     provider::TaskRunner* task_runner,
     provider::HttpClient* http_client,
-    provider::Network* network)
+    provider::Network* network,
+    privet::AuthManager* auth_manager)
     : http_client_{http_client},
       task_runner_{task_runner},
       component_manager_{component_manager},
       config_{std::move(config)},
-      network_{network} {
+      network_{network},
+      auth_manager_{auth_manager} {
   cloud_backoff_policy_.reset(new BackoffEntry::Policy{});
   cloud_backoff_policy_->num_errors_to_ignore = 0;
   cloud_backoff_policy_->initial_delay_ms = 1000;
diff --git a/src/device_registration_info.h b/src/device_registration_info.h
index bacab48..b1b9293 100644
--- a/src/device_registration_info.h
+++ b/src/device_registration_info.h
@@ -41,6 +41,10 @@
 class TaskRunner;
 }
 
+namespace privet {
+class AuthManager;
+}
+
 extern const char kErrorDomainOAuth2[];
 extern const char kErrorDomainGCD[];
 extern const char kErrorDomainGCDServer[];
@@ -53,12 +57,13 @@
       base::Callback<void(const base::DictionaryValue& response,
                           ErrorPtr error)>;
 
-  DeviceRegistrationInfo(
-      ComponentManager* component_manager,
-      std::unique_ptr<Config> config,
-      provider::TaskRunner* task_runner,
-      provider::HttpClient* http_client,
-      provider::Network* network);
+  DeviceRegistrationInfo(ComponentManager* component_manager,
+                         std::unique_ptr<Config>
+                             config,
+                         provider::TaskRunner* task_runner,
+                         provider::HttpClient* http_client,
+                         provider::Network* network,
+                         privet::AuthManager* auth_manager);
 
   ~DeviceRegistrationInfo() override;
 
@@ -337,6 +342,7 @@
   bool notification_channel_starting_{false};
 
   provider::Network* network_{nullptr};
+  privet::AuthManager* auth_manager_{nullptr};
 
   // Tracks our GCD state.
   GcdState gcd_state_{GcdState::kUnconfigured};
diff --git a/src/device_registration_info_unittest.cc b/src/device_registration_info_unittest.cc
index 72405dc..029733e 100644
--- a/src/device_registration_info_unittest.cc
+++ b/src/device_registration_info_unittest.cc
@@ -117,7 +117,7 @@
     config_ = config.get();
     dev_reg_.reset(new DeviceRegistrationInfo{&component_manager_,
                                               std::move(config), &task_runner_,
-                                              &http_client_, nullptr});
+                                              &http_client_, nullptr, nullptr});
 
     ReloadDefaults();
   }
diff --git a/src/privet/privet_manager.cc b/src/privet/privet_manager.cc
index a308eec..16c552e 100644
--- a/src/privet/privet_manager.cc
+++ b/src/privet/privet_manager.cc
@@ -47,8 +47,12 @@
                     DnsServiceDiscovery* dns_sd,
                     HttpServer* http_server,
                     Wifi* wifi,
+                    AuthManager* auth_manager,
                     DeviceRegistrationInfo* device,
                     ComponentManager* component_manager) {
+  CHECK(auth_manager);
+  CHECK(device);
+
   disable_security_ = device->GetSettings().disable_security;
 
   device_ = DeviceDelegate::CreateDefault(
@@ -58,19 +62,9 @@
                                         component_manager);
   cloud_observer_.Add(cloud_.get());
 
-  auth_.reset(new AuthManager(device->GetSettings().secret,
-                              http_server->GetHttpsCertificateFingerprint()));
   security_.reset(new SecurityManager(
-      auth_.get(), device->GetSettings().pairing_modes,
+      auth_manager, device->GetSettings().pairing_modes,
       device->GetSettings().embedded_code, disable_security_, task_runner_));
-  if (device->GetSettings().secret.empty()) {
-    // TODO(vitalybuka): Post all Config::Transaction to avoid following.
-    task_runner_->PostDelayedTask(
-        FROM_HERE,
-        base::Bind(&Manager::SaveDeviceSecret, weak_ptr_factory_.GetWeakPtr(),
-                   base::Unretained(device->GetMutableConfig())),
-        {});
-  }
   network->AddConnectionChangedCallback(
       base::Bind(&Manager::OnConnectivityChanged, base::Unretained(this)));
 
@@ -174,10 +168,5 @@
   OnChanged();
 }
 
-void Manager::SaveDeviceSecret(Config* config) {
-  Config::Transaction transaction(config);
-  transaction.set_secret(auth_->GetSecret());
-}
-
 }  // namespace privet
 }  // namespace weave
diff --git a/src/privet/privet_manager.h b/src/privet/privet_manager.h
index 1342584..371d843 100644
--- a/src/privet/privet_manager.h
+++ b/src/privet/privet_manager.h
@@ -50,6 +50,7 @@
              provider::DnsServiceDiscovery* dns_sd,
              provider::HttpServer* http_server,
              provider::Wifi* wifi,
+             AuthManager* auth_manager,
              DeviceRegistrationInfo* device,
              ComponentManager* component_manager);
 
@@ -78,13 +79,10 @@
   void OnChanged();
   void OnConnectivityChanged();
 
-  void SaveDeviceSecret(Config* config);
-
   bool disable_security_{false};
   provider::TaskRunner* task_runner_{nullptr};
   std::unique_ptr<CloudDelegate> cloud_;
   std::unique_ptr<DeviceDelegate> device_;
-  std::unique_ptr<AuthManager> auth_;
   std::unique_ptr<SecurityManager> security_;
   std::unique_ptr<WifiBootstrapManager> wifi_bootstrap_manager_;
   std::unique_ptr<Publisher> publisher_;
diff --git a/src/privet/security_manager.h b/src/privet/security_manager.h
index 26a42d4..cab042a 100644
--- a/src/privet/security_manager.h
+++ b/src/privet/security_manager.h
@@ -84,6 +84,8 @@
   void RegisterPairingListeners(const PairingStartListener& on_start,
                                 const PairingEndListener& on_end);
 
+  const AuthManager* GetAuthManager() const { return auth_manager_; }
+
  private:
   FRIEND_TEST_ALL_PREFIXES(SecurityManagerTest, ThrottlePairing);
   // Allows limited number of new sessions without successful authorization.