A LoRaWAN architecture comprises four entities: End Devices (LoRa sensors and actuators), Gateways (bidirectional radio relays), a Network Server (which centralises traffic and handles ADR and security) and an Application Server (which carries the business logic and exposes the data to end users).

End Devices are battery-powered IoT nodes such as temperature sensors, GPS asset trackers or water meters, which transmit toward the gateways over LoRa. Gateways are radio receivers that backhaul received packets to the Network Server over Ethernet, Wi-Fi or cellular. The Network Server performs multi-gateway deduplication, manages Adaptive Data Rate (ADR) and owns the network session keys (FNwkSIntKey and others in 1.1). The Application Server decodes the application payload and exposes the data through APIs such as HTTP or MQTT. In practice the Network Server and Application Server are frequently co-located in the same software stack (ChirpStack, TTN Stack, etc.).

Remember that only the Network Server sees frame headers and MAC commands; the Application Server alone holds AppSKey and therefore alone can decrypt the user payload — this split is the foundation of LoRaWAN's privacy-by-design model.