diff --git a/lib/types/tunnelbroker/peer-to-peer-message-types.js b/lib/types/tunnelbroker/peer-to-peer-message-types.js
--- a/lib/types/tunnelbroker/peer-to-peer-message-types.js
+++ b/lib/types/tunnelbroker/peer-to-peer-message-types.js
@@ -27,6 +27,7 @@
   DEVICE_LIST_UPDATED: 'DeviceListUpdated',
   MESSAGE_PROCESSED: 'MessageProcessed',
   IDENTITY_DEVICE_LIST_UPDATED: 'IdentityDeviceListUpdated',
+  BAD_DEVICE_TOKEN: 'BadDeviceToken',
 });
 
 export type OutboundSessionCreation = {
@@ -109,6 +110,16 @@
     type: tString(peerToPeerMessageTypes.IDENTITY_DEVICE_LIST_UPDATED),
   });
 
+export type BadDeviceToken = {
+  +type: 'BadDeviceToken',
+  +invalidatedToken: string,
+};
+export const badDeviceTokenValidator: TInterface<BadDeviceToken> =
+  tShape<BadDeviceToken>({
+    type: tString('BadDeviceToken'),
+    invalidatedToken: t.String,
+  });
+
 export type PeerToPeerMessage =
   | OutboundSessionCreation
   | EncryptedMessage
@@ -116,7 +127,8 @@
   | QRCodeAuthMessage
   | DeviceListUpdated
   | MessageProcessed
-  | IdentityDeviceListUpdated;
+  | IdentityDeviceListUpdated
+  | BadDeviceToken;
 
 export const peerToPeerMessageValidator: TUnion<PeerToPeerMessage> = t.union([
   outboundSessionCreationValidator,
@@ -126,4 +138,5 @@
   deviceListUpdatedValidator,
   messageProcessedValidator,
   identityDeviceListUpdatedValidator,
+  badDeviceTokenValidator,
 ]);
diff --git a/shared/tunnelbroker_messages/src/messages/bad_device_token.rs b/shared/tunnelbroker_messages/src/messages/bad_device_token.rs
new file mode 100644
--- /dev/null
+++ b/shared/tunnelbroker_messages/src/messages/bad_device_token.rs
@@ -0,0 +1,9 @@
+//! Messages to client informing that device token is no longer working.
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, PartialEq, Debug)]
+#[serde(tag = "type", rename_all = "camelCase")]
+pub struct BadDeviceToken {
+  pub invalidated_token: String,
+}
diff --git a/shared/tunnelbroker_messages/src/messages/mod.rs b/shared/tunnelbroker_messages/src/messages/mod.rs
--- a/shared/tunnelbroker_messages/src/messages/mod.rs
+++ b/shared/tunnelbroker_messages/src/messages/mod.rs
@@ -1,5 +1,6 @@
 //! Messages sent between Tunnelbroker and a device.
 
+pub mod bad_device_token;
 pub mod device_list_updated;
 pub mod keys;
 pub mod message_receive_confirmation;
@@ -24,6 +25,7 @@
   ConnectionInitializationResponse, ConnectionInitializationStatus, Heartbeat,
 };
 
+use crate::bad_device_token::BadDeviceToken;
 use crate::notif::*;
 use serde::{Deserialize, Serialize};
 
@@ -56,6 +58,7 @@
   ConnectionInitializationResponse(ConnectionInitializationResponse),
   DeviceToTunnelbrokerRequestStatus(DeviceToTunnelbrokerRequestStatus),
   MessageToDevice(MessageToDevice),
+  BadDeviceToken(BadDeviceToken),
   Heartbeat(Heartbeat),
 }
 
@@ -66,6 +69,7 @@
 pub enum ServiceToDeviceMessages {
   RefreshKeysRequest(RefreshKeyRequest),
   IdentityDeviceListUpdated(IdentityDeviceListUpdated),
+  BadDeviceToken(BadDeviceToken),
 }
 
 // Messages sent from Device to Tunnelbroker which Tunnelbroker itself should handle.