General question about (DevEUI, AppEUI, AppKey) for custom devices


i am planning to develop a custom lora device.
I am not really new into lora but i really dont understand where the keys are exactly coming from, and who should provide them to do it right.

I planned that the enduser can provide the AppEUI and AppKey by themself over wifi provisioning. So both values are empty if the device is shipped by factory.
(Is this right? Or should i predifine some keys, and how to generate them then?)

From what i know i should deliver every device with a fixed DevEUI? So i planned that the user can not change this value and i would print this on the back of the device (including a qr-code), thats what i seen often when i bought lora devices, so i assum its the right way?

But then i have the question: Is there any rules how to generate them (DevEUIs)?
Or can i do: 000000000000000001, 000000000000000002…

Thank you for your help.