diff --git a/services/identity/src/client_service.rs b/services/identity/src/client_service.rs
--- a/services/identity/src/client_service.rs
+++ b/services/identity/src/client_service.rs
@@ -27,6 +27,7 @@
   OpaqueLoginStartResponse, RegistrationFinishRequest, RegistrationStartRequest,
   RegistrationStartResponse, RemoveReservedUsernameRequest,
   ReservedRegistrationStartRequest,
+  RestorePasswordUserRequest, RestoreWalletUserRequest,
   SecondaryDeviceKeysUploadRequest, VerifyUserAccessTokenRequest,
   VerifyUserAccessTokenResponse, WalletAuthRequest, GetFarcasterUsersRequest,
   GetFarcasterUsersResponse
@@ -687,6 +688,20 @@
     Ok(Response::new(response))
   }
 
+  async fn restore_password_user(
+    &self,
+    request: tonic::Request<RestorePasswordUserRequest>,
+  ) -> Result<tonic::Response<AuthResponse>, tonic::Status> {
+    unimplemented!();
+  }
+
+  async fn restore_wallet_user(
+    &self,
+    request: tonic::Request<RestoreWalletUserRequest>,
+  ) -> Result<tonic::Response<AuthResponse>, tonic::Status> {
+    unimplemented!();
+  }
+
   #[tracing::instrument(skip_all)]
   async fn upload_keys_for_registered_device_and_log_in(
     &self,
diff --git a/services/identity/src/grpc_utils.rs b/services/identity/src/grpc_utils.rs
--- a/services/identity/src/grpc_utils.rs
+++ b/services/identity/src/grpc_utils.rs
@@ -14,6 +14,7 @@
     unauth::{
       DeviceKeyUpload, ExistingDeviceLoginRequest, OpaqueLoginStartRequest,
       RegistrationStartRequest, ReservedRegistrationStartRequest,
+      RestorePasswordUserRequest, RestoreWalletUserRequest,
       SecondaryDeviceKeysUploadRequest, WalletAuthRequest,
     },
   },
@@ -47,6 +48,16 @@
   }
 }
 
+impl TryFrom<&RestorePasswordUserRequest> for SignedNonce {
+  type Error = Status;
+  fn try_from(value: &RestorePasswordUserRequest) -> Result<Self, Self::Error> {
+    Ok(Self {
+      nonce: value.nonce.to_string(),
+      signature: value.nonce_signature.to_string(),
+    })
+  }
+}
+
 impl SignedNonce {
   pub fn verify_and_get_nonce(
     self,
@@ -171,6 +182,18 @@
   }
 }
 
+impl DeviceKeyUploadData for RestorePasswordUserRequest {
+  fn device_key_upload(&self) -> Option<&DeviceKeyUpload> {
+    self.device_key_upload.as_ref()
+  }
+}
+
+impl DeviceKeyUploadData for RestoreWalletUserRequest {
+  fn device_key_upload(&self) -> Option<&DeviceKeyUpload> {
+    self.device_key_upload.as_ref()
+  }
+}
+
 pub trait DeviceKeyUploadActions {
   fn payload(&self) -> Result<String, Status>;
   fn payload_signature(&self) -> Result<String, Status>;
diff --git a/shared/protos/identity_unauth.proto b/shared/protos/identity_unauth.proto
--- a/shared/protos/identity_unauth.proto
+++ b/shared/protos/identity_unauth.proto
@@ -30,6 +30,10 @@
     returns (AuthResponse) {}
   rpc LogInExistingDevice(ExistingDeviceLoginRequest) returns (AuthResponse) {}
 
+  // Called by primary device to during backup restore protocol
+  rpc RestorePasswordUser(RestorePasswordUserRequest) returns (AuthResponse) {}
+  rpc RestoreWalletUser(RestoreWalletUserRequest) returns (AuthResponse) {}
+
   /* Service actions */
 
   // Called by other services to verify a user's access token
@@ -230,6 +234,41 @@
   string initial_device_list = 5;
 }
 
+// Primary backup restore
+
+message RestorePasswordUserRequest {
+  string username = 1;
+  string nonce = 2;
+  string nonce_signature = 3;
+  DeviceKeyUpload device_key_upload = 4;
+  // A stringified JSON object of the following format:
+  // {
+  //   "rawDeviceList": JSON.stringify({
+  //     "devices": [<primary_device_id: string>]
+  //     "timestamp": <UTC timestamp in milliseconds: int>,
+  //   }),
+  //   "curPrimarySignature": "base64-encoded new primary device signature",
+  //   "lastPrimarySignature": "base64-encoded old primary device signature"
+  // }
+  string device_list = 5;
+}
+
+message RestoreWalletUserRequest {
+  string siwe_message = 1;
+  string siwe_signature = 2;
+  DeviceKeyUpload device_key_upload = 3;
+  // A stringified JSON object of the following format:
+  // {
+  //   "rawDeviceList": JSON.stringify({
+  //     "devices": [<primary_device_id: string>]
+  //     "timestamp": <UTC timestamp in milliseconds: int>,
+  //   }),
+  //   "curPrimarySignature": "base64-encoded new primary device signature",
+  //   "lastPrimarySignature": "base64-encoded old primary device signature"
+  // }
+  string device_list = 4;
+}
+
 // UploadKeysForRegisteredDeviceAndLogIn
 
 message SecondaryDeviceKeysUploadRequest {
diff --git a/web/protobufs/identity-unauth-structs.cjs b/web/protobufs/identity-unauth-structs.cjs
--- a/web/protobufs/identity-unauth-structs.cjs
+++ b/web/protobufs/identity-unauth-structs.cjs
@@ -45,6 +45,8 @@
 goog.exportSymbol('proto.identity.unauth.RegistrationStartResponse', null, global);
 goog.exportSymbol('proto.identity.unauth.RemoveReservedUsernameRequest', null, global);
 goog.exportSymbol('proto.identity.unauth.ReservedRegistrationStartRequest', null, global);
+goog.exportSymbol('proto.identity.unauth.RestorePasswordUserRequest', null, global);
+goog.exportSymbol('proto.identity.unauth.RestoreWalletUserRequest', null, global);
 goog.exportSymbol('proto.identity.unauth.SecondaryDeviceKeysUploadRequest', null, global);
 goog.exportSymbol('proto.identity.unauth.VerifyUserAccessTokenRequest', null, global);
 goog.exportSymbol('proto.identity.unauth.VerifyUserAccessTokenResponse', null, global);
@@ -322,6 +324,48 @@
    */
   proto.identity.unauth.WalletAuthRequest.displayName = 'proto.identity.unauth.WalletAuthRequest';
 }
+/**
+ * Generated by JsPbCodeGenerator.
+ * @param {Array=} opt_data Optional initial data array, typically from a
+ * server response, or constructed directly in Javascript. The array is used
+ * in place and becomes part of the constructed object. It is not cloned.
+ * If no data is provided, the constructed object will be empty, but still
+ * valid.
+ * @extends {jspb.Message}
+ * @constructor
+ */
+proto.identity.unauth.RestorePasswordUserRequest = function(opt_data) {
+  jspb.Message.initialize(this, opt_data, 0, -1, null, null);
+};
+goog.inherits(proto.identity.unauth.RestorePasswordUserRequest, jspb.Message);
+if (goog.DEBUG && !COMPILED) {
+  /**
+   * @public
+   * @override
+   */
+  proto.identity.unauth.RestorePasswordUserRequest.displayName = 'proto.identity.unauth.RestorePasswordUserRequest';
+}
+/**
+ * Generated by JsPbCodeGenerator.
+ * @param {Array=} opt_data Optional initial data array, typically from a
+ * server response, or constructed directly in Javascript. The array is used
+ * in place and becomes part of the constructed object. It is not cloned.
+ * If no data is provided, the constructed object will be empty, but still
+ * valid.
+ * @extends {jspb.Message}
+ * @constructor
+ */
+proto.identity.unauth.RestoreWalletUserRequest = function(opt_data) {
+  jspb.Message.initialize(this, opt_data, 0, -1, null, null);
+};
+goog.inherits(proto.identity.unauth.RestoreWalletUserRequest, jspb.Message);
+if (goog.DEBUG && !COMPILED) {
+  /**
+   * @public
+   * @override
+   */
+  proto.identity.unauth.RestoreWalletUserRequest.displayName = 'proto.identity.unauth.RestoreWalletUserRequest';
+}
 /**
  * Generated by JsPbCodeGenerator.
  * @param {Array=} opt_data Optional initial data array, typically from a
@@ -3522,6 +3566,518 @@
 
 
 
+if (jspb.Message.GENERATE_TO_OBJECT) {
+/**
+ * Creates an object representation of this proto.
+ * Field names that are reserved in JavaScript and will be renamed to pb_name.
+ * Optional fields that are not set will be set to undefined.
+ * To access a reserved field use, foo.pb_<name>, eg, foo.pb_default.
+ * For the list of reserved names please see:
+ *     net/proto2/compiler/js/internal/generator.cc#kKeyword.
+ * @param {boolean=} opt_includeInstance Deprecated. whether to include the
+ *     JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @return {!Object}
+ */
+proto.identity.unauth.RestorePasswordUserRequest.prototype.toObject = function(opt_includeInstance) {
+  return proto.identity.unauth.RestorePasswordUserRequest.toObject(opt_includeInstance, this);
+};
+
+
+/**
+ * Static version of the {@see toObject} method.
+ * @param {boolean|undefined} includeInstance Deprecated. Whether to include
+ *     the JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @param {!proto.identity.unauth.RestorePasswordUserRequest} msg The msg instance to transform.
+ * @return {!Object}
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.identity.unauth.RestorePasswordUserRequest.toObject = function(includeInstance, msg) {
+  var f, obj = {
+    username: jspb.Message.getFieldWithDefault(msg, 1, ""),
+    nonce: jspb.Message.getFieldWithDefault(msg, 2, ""),
+    nonceSignature: jspb.Message.getFieldWithDefault(msg, 3, ""),
+    deviceKeyUpload: (f = msg.getDeviceKeyUpload()) && proto.identity.unauth.DeviceKeyUpload.toObject(includeInstance, f),
+    deviceList: jspb.Message.getFieldWithDefault(msg, 5, "")
+  };
+
+  if (includeInstance) {
+    obj.$jspbMessageInstance = msg;
+  }
+  return obj;
+};
+}
+
+
+/**
+ * Deserializes binary data (in protobuf wire format).
+ * @param {jspb.ByteSource} bytes The bytes to deserialize.
+ * @return {!proto.identity.unauth.RestorePasswordUserRequest}
+ */
+proto.identity.unauth.RestorePasswordUserRequest.deserializeBinary = function(bytes) {
+  var reader = new jspb.BinaryReader(bytes);
+  var msg = new proto.identity.unauth.RestorePasswordUserRequest;
+  return proto.identity.unauth.RestorePasswordUserRequest.deserializeBinaryFromReader(msg, reader);
+};
+
+
+/**
+ * Deserializes binary data (in protobuf wire format) from the
+ * given reader into the given message object.
+ * @param {!proto.identity.unauth.RestorePasswordUserRequest} msg The message object to deserialize into.
+ * @param {!jspb.BinaryReader} reader The BinaryReader to use.
+ * @return {!proto.identity.unauth.RestorePasswordUserRequest}
+ */
+proto.identity.unauth.RestorePasswordUserRequest.deserializeBinaryFromReader = function(msg, reader) {
+  while (reader.nextField()) {
+    if (reader.isEndGroup()) {
+      break;
+    }
+    var field = reader.getFieldNumber();
+    switch (field) {
+    case 1:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setUsername(value);
+      break;
+    case 2:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setNonce(value);
+      break;
+    case 3:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setNonceSignature(value);
+      break;
+    case 4:
+      var value = new proto.identity.unauth.DeviceKeyUpload;
+      reader.readMessage(value,proto.identity.unauth.DeviceKeyUpload.deserializeBinaryFromReader);
+      msg.setDeviceKeyUpload(value);
+      break;
+    case 5:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setDeviceList(value);
+      break;
+    default:
+      reader.skipField();
+      break;
+    }
+  }
+  return msg;
+};
+
+
+/**
+ * Serializes the message to binary data (in protobuf wire format).
+ * @return {!Uint8Array}
+ */
+proto.identity.unauth.RestorePasswordUserRequest.prototype.serializeBinary = function() {
+  var writer = new jspb.BinaryWriter();
+  proto.identity.unauth.RestorePasswordUserRequest.serializeBinaryToWriter(this, writer);
+  return writer.getResultBuffer();
+};
+
+
+/**
+ * Serializes the given message to binary data (in protobuf wire
+ * format), writing to the given BinaryWriter.
+ * @param {!proto.identity.unauth.RestorePasswordUserRequest} message
+ * @param {!jspb.BinaryWriter} writer
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.identity.unauth.RestorePasswordUserRequest.serializeBinaryToWriter = function(message, writer) {
+  var f = undefined;
+  f = message.getUsername();
+  if (f.length > 0) {
+    writer.writeString(
+      1,
+      f
+    );
+  }
+  f = message.getNonce();
+  if (f.length > 0) {
+    writer.writeString(
+      2,
+      f
+    );
+  }
+  f = message.getNonceSignature();
+  if (f.length > 0) {
+    writer.writeString(
+      3,
+      f
+    );
+  }
+  f = message.getDeviceKeyUpload();
+  if (f != null) {
+    writer.writeMessage(
+      4,
+      f,
+      proto.identity.unauth.DeviceKeyUpload.serializeBinaryToWriter
+    );
+  }
+  f = message.getDeviceList();
+  if (f.length > 0) {
+    writer.writeString(
+      5,
+      f
+    );
+  }
+};
+
+
+/**
+ * optional string username = 1;
+ * @return {string}
+ */
+proto.identity.unauth.RestorePasswordUserRequest.prototype.getUsername = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 1, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.identity.unauth.RestorePasswordUserRequest} returns this
+ */
+proto.identity.unauth.RestorePasswordUserRequest.prototype.setUsername = function(value) {
+  return jspb.Message.setProto3StringField(this, 1, value);
+};
+
+
+/**
+ * optional string nonce = 2;
+ * @return {string}
+ */
+proto.identity.unauth.RestorePasswordUserRequest.prototype.getNonce = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 2, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.identity.unauth.RestorePasswordUserRequest} returns this
+ */
+proto.identity.unauth.RestorePasswordUserRequest.prototype.setNonce = function(value) {
+  return jspb.Message.setProto3StringField(this, 2, value);
+};
+
+
+/**
+ * optional string nonce_signature = 3;
+ * @return {string}
+ */
+proto.identity.unauth.RestorePasswordUserRequest.prototype.getNonceSignature = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 3, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.identity.unauth.RestorePasswordUserRequest} returns this
+ */
+proto.identity.unauth.RestorePasswordUserRequest.prototype.setNonceSignature = function(value) {
+  return jspb.Message.setProto3StringField(this, 3, value);
+};
+
+
+/**
+ * optional DeviceKeyUpload device_key_upload = 4;
+ * @return {?proto.identity.unauth.DeviceKeyUpload}
+ */
+proto.identity.unauth.RestorePasswordUserRequest.prototype.getDeviceKeyUpload = function() {
+  return /** @type{?proto.identity.unauth.DeviceKeyUpload} */ (
+    jspb.Message.getWrapperField(this, proto.identity.unauth.DeviceKeyUpload, 4));
+};
+
+
+/**
+ * @param {?proto.identity.unauth.DeviceKeyUpload|undefined} value
+ * @return {!proto.identity.unauth.RestorePasswordUserRequest} returns this
+*/
+proto.identity.unauth.RestorePasswordUserRequest.prototype.setDeviceKeyUpload = function(value) {
+  return jspb.Message.setWrapperField(this, 4, value);
+};
+
+
+/**
+ * Clears the message field making it undefined.
+ * @return {!proto.identity.unauth.RestorePasswordUserRequest} returns this
+ */
+proto.identity.unauth.RestorePasswordUserRequest.prototype.clearDeviceKeyUpload = function() {
+  return this.setDeviceKeyUpload(undefined);
+};
+
+
+/**
+ * Returns whether this field is set.
+ * @return {boolean}
+ */
+proto.identity.unauth.RestorePasswordUserRequest.prototype.hasDeviceKeyUpload = function() {
+  return jspb.Message.getField(this, 4) != null;
+};
+
+
+/**
+ * optional string device_list = 5;
+ * @return {string}
+ */
+proto.identity.unauth.RestorePasswordUserRequest.prototype.getDeviceList = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 5, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.identity.unauth.RestorePasswordUserRequest} returns this
+ */
+proto.identity.unauth.RestorePasswordUserRequest.prototype.setDeviceList = function(value) {
+  return jspb.Message.setProto3StringField(this, 5, value);
+};
+
+
+
+
+
+if (jspb.Message.GENERATE_TO_OBJECT) {
+/**
+ * Creates an object representation of this proto.
+ * Field names that are reserved in JavaScript and will be renamed to pb_name.
+ * Optional fields that are not set will be set to undefined.
+ * To access a reserved field use, foo.pb_<name>, eg, foo.pb_default.
+ * For the list of reserved names please see:
+ *     net/proto2/compiler/js/internal/generator.cc#kKeyword.
+ * @param {boolean=} opt_includeInstance Deprecated. whether to include the
+ *     JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @return {!Object}
+ */
+proto.identity.unauth.RestoreWalletUserRequest.prototype.toObject = function(opt_includeInstance) {
+  return proto.identity.unauth.RestoreWalletUserRequest.toObject(opt_includeInstance, this);
+};
+
+
+/**
+ * Static version of the {@see toObject} method.
+ * @param {boolean|undefined} includeInstance Deprecated. Whether to include
+ *     the JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @param {!proto.identity.unauth.RestoreWalletUserRequest} msg The msg instance to transform.
+ * @return {!Object}
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.identity.unauth.RestoreWalletUserRequest.toObject = function(includeInstance, msg) {
+  var f, obj = {
+    siweMessage: jspb.Message.getFieldWithDefault(msg, 1, ""),
+    siweSignature: jspb.Message.getFieldWithDefault(msg, 2, ""),
+    deviceKeyUpload: (f = msg.getDeviceKeyUpload()) && proto.identity.unauth.DeviceKeyUpload.toObject(includeInstance, f),
+    deviceList: jspb.Message.getFieldWithDefault(msg, 4, "")
+  };
+
+  if (includeInstance) {
+    obj.$jspbMessageInstance = msg;
+  }
+  return obj;
+};
+}
+
+
+/**
+ * Deserializes binary data (in protobuf wire format).
+ * @param {jspb.ByteSource} bytes The bytes to deserialize.
+ * @return {!proto.identity.unauth.RestoreWalletUserRequest}
+ */
+proto.identity.unauth.RestoreWalletUserRequest.deserializeBinary = function(bytes) {
+  var reader = new jspb.BinaryReader(bytes);
+  var msg = new proto.identity.unauth.RestoreWalletUserRequest;
+  return proto.identity.unauth.RestoreWalletUserRequest.deserializeBinaryFromReader(msg, reader);
+};
+
+
+/**
+ * Deserializes binary data (in protobuf wire format) from the
+ * given reader into the given message object.
+ * @param {!proto.identity.unauth.RestoreWalletUserRequest} msg The message object to deserialize into.
+ * @param {!jspb.BinaryReader} reader The BinaryReader to use.
+ * @return {!proto.identity.unauth.RestoreWalletUserRequest}
+ */
+proto.identity.unauth.RestoreWalletUserRequest.deserializeBinaryFromReader = function(msg, reader) {
+  while (reader.nextField()) {
+    if (reader.isEndGroup()) {
+      break;
+    }
+    var field = reader.getFieldNumber();
+    switch (field) {
+    case 1:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setSiweMessage(value);
+      break;
+    case 2:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setSiweSignature(value);
+      break;
+    case 3:
+      var value = new proto.identity.unauth.DeviceKeyUpload;
+      reader.readMessage(value,proto.identity.unauth.DeviceKeyUpload.deserializeBinaryFromReader);
+      msg.setDeviceKeyUpload(value);
+      break;
+    case 4:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setDeviceList(value);
+      break;
+    default:
+      reader.skipField();
+      break;
+    }
+  }
+  return msg;
+};
+
+
+/**
+ * Serializes the message to binary data (in protobuf wire format).
+ * @return {!Uint8Array}
+ */
+proto.identity.unauth.RestoreWalletUserRequest.prototype.serializeBinary = function() {
+  var writer = new jspb.BinaryWriter();
+  proto.identity.unauth.RestoreWalletUserRequest.serializeBinaryToWriter(this, writer);
+  return writer.getResultBuffer();
+};
+
+
+/**
+ * Serializes the given message to binary data (in protobuf wire
+ * format), writing to the given BinaryWriter.
+ * @param {!proto.identity.unauth.RestoreWalletUserRequest} message
+ * @param {!jspb.BinaryWriter} writer
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.identity.unauth.RestoreWalletUserRequest.serializeBinaryToWriter = function(message, writer) {
+  var f = undefined;
+  f = message.getSiweMessage();
+  if (f.length > 0) {
+    writer.writeString(
+      1,
+      f
+    );
+  }
+  f = message.getSiweSignature();
+  if (f.length > 0) {
+    writer.writeString(
+      2,
+      f
+    );
+  }
+  f = message.getDeviceKeyUpload();
+  if (f != null) {
+    writer.writeMessage(
+      3,
+      f,
+      proto.identity.unauth.DeviceKeyUpload.serializeBinaryToWriter
+    );
+  }
+  f = message.getDeviceList();
+  if (f.length > 0) {
+    writer.writeString(
+      4,
+      f
+    );
+  }
+};
+
+
+/**
+ * optional string siwe_message = 1;
+ * @return {string}
+ */
+proto.identity.unauth.RestoreWalletUserRequest.prototype.getSiweMessage = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 1, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.identity.unauth.RestoreWalletUserRequest} returns this
+ */
+proto.identity.unauth.RestoreWalletUserRequest.prototype.setSiweMessage = function(value) {
+  return jspb.Message.setProto3StringField(this, 1, value);
+};
+
+
+/**
+ * optional string siwe_signature = 2;
+ * @return {string}
+ */
+proto.identity.unauth.RestoreWalletUserRequest.prototype.getSiweSignature = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 2, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.identity.unauth.RestoreWalletUserRequest} returns this
+ */
+proto.identity.unauth.RestoreWalletUserRequest.prototype.setSiweSignature = function(value) {
+  return jspb.Message.setProto3StringField(this, 2, value);
+};
+
+
+/**
+ * optional DeviceKeyUpload device_key_upload = 3;
+ * @return {?proto.identity.unauth.DeviceKeyUpload}
+ */
+proto.identity.unauth.RestoreWalletUserRequest.prototype.getDeviceKeyUpload = function() {
+  return /** @type{?proto.identity.unauth.DeviceKeyUpload} */ (
+    jspb.Message.getWrapperField(this, proto.identity.unauth.DeviceKeyUpload, 3));
+};
+
+
+/**
+ * @param {?proto.identity.unauth.DeviceKeyUpload|undefined} value
+ * @return {!proto.identity.unauth.RestoreWalletUserRequest} returns this
+*/
+proto.identity.unauth.RestoreWalletUserRequest.prototype.setDeviceKeyUpload = function(value) {
+  return jspb.Message.setWrapperField(this, 3, value);
+};
+
+
+/**
+ * Clears the message field making it undefined.
+ * @return {!proto.identity.unauth.RestoreWalletUserRequest} returns this
+ */
+proto.identity.unauth.RestoreWalletUserRequest.prototype.clearDeviceKeyUpload = function() {
+  return this.setDeviceKeyUpload(undefined);
+};
+
+
+/**
+ * Returns whether this field is set.
+ * @return {boolean}
+ */
+proto.identity.unauth.RestoreWalletUserRequest.prototype.hasDeviceKeyUpload = function() {
+  return jspb.Message.getField(this, 3) != null;
+};
+
+
+/**
+ * optional string device_list = 4;
+ * @return {string}
+ */
+proto.identity.unauth.RestoreWalletUserRequest.prototype.getDeviceList = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 4, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.identity.unauth.RestoreWalletUserRequest} returns this
+ */
+proto.identity.unauth.RestoreWalletUserRequest.prototype.setDeviceList = function(value) {
+  return jspb.Message.setProto3StringField(this, 4, value);
+};
+
+
+
+
+
 if (jspb.Message.GENERATE_TO_OBJECT) {
 /**
  * Creates an object representation of this proto.
diff --git a/web/protobufs/identity-unauth-structs.cjs.flow b/web/protobufs/identity-unauth-structs.cjs.flow
--- a/web/protobufs/identity-unauth-structs.cjs.flow
+++ b/web/protobufs/identity-unauth-structs.cjs.flow
@@ -362,6 +362,70 @@
   initialDeviceList: string,
 };
 
+declare export class RestorePasswordUserRequest extends Message {
+  getUsername(): string;
+  setUsername(value: string): RestorePasswordUserRequest;
+
+  getNonce(): string;
+  setNonce(value: string): RestorePasswordUserRequest;
+
+  getNonceSignature(): string;
+  setNonceSignature(value: string): RestorePasswordUserRequest;
+
+  getDeviceKeyUpload(): DeviceKeyUpload | void;
+  setDeviceKeyUpload(value?: DeviceKeyUpload): RestorePasswordUserRequest;
+  hasDeviceKeyUpload(): boolean;
+  clearDeviceKeyUpload(): RestorePasswordUserRequest;
+
+  getDeviceList(): string;
+  setDeviceList(value: string): RestorePasswordUserRequest;
+
+  serializeBinary(): Uint8Array;
+  toObject(includeInstance?: boolean): RestorePasswordUserRequestObject;
+  static toObject(includeInstance: boolean, msg: RestorePasswordUserRequest): RestorePasswordUserRequestObject;
+  static serializeBinaryToWriter(message: RestorePasswordUserRequest, writer: BinaryWriter): void;
+  static deserializeBinary(bytes: Uint8Array): RestorePasswordUserRequest;
+  static deserializeBinaryFromReader(message: RestorePasswordUserRequest, reader: BinaryReader): RestorePasswordUserRequest;
+}
+
+export type RestorePasswordUserRequestObject = {
+  username: string,
+  nonce: string,
+  nonceSignature: string,
+  deviceKeyUpload?: DeviceKeyUploadObject,
+  deviceList: string,
+}
+
+declare export class RestoreWalletUserRequest extends Message {
+  getSiweMessage(): string;
+  setSiweMessage(value: string): RestoreWalletUserRequest;
+
+  getSiweSignature(): string;
+  setSiweSignature(value: string): RestoreWalletUserRequest;
+
+  getDeviceKeyUpload(): DeviceKeyUpload | void;
+  setDeviceKeyUpload(value?: DeviceKeyUpload): RestoreWalletUserRequest;
+  hasDeviceKeyUpload(): boolean;
+  clearDeviceKeyUpload(): RestoreWalletUserRequest;
+
+  getDeviceList(): string;
+  setDeviceList(value: string): RestoreWalletUserRequest;
+
+  serializeBinary(): Uint8Array;
+  toObject(includeInstance?: boolean): RestoreWalletUserRequestObject;
+  static toObject(includeInstance: boolean, msg: RestoreWalletUserRequest): RestoreWalletUserRequestObject;
+  static serializeBinaryToWriter(message: RestoreWalletUserRequest, writer: BinaryWriter): void;
+  static deserializeBinary(bytes: Uint8Array): RestoreWalletUserRequest;
+  static deserializeBinaryFromReader(message: RestoreWalletUserRequest, reader: BinaryReader): RestoreWalletUserRequest;
+}
+
+export type RestoreWalletUserRequestObject = {
+  siweMessage: string,
+  siweSignature: string,
+  deviceKeyUpload?: DeviceKeyUploadObject,
+  deviceList: string,
+}
+
 declare export class SecondaryDeviceKeysUploadRequest extends Message {
   getUserId(): string;
   setUserId(value: string): SecondaryDeviceKeysUploadRequest;
diff --git a/web/protobufs/identity-unauth.cjs b/web/protobufs/identity-unauth.cjs
--- a/web/protobufs/identity-unauth.cjs
+++ b/web/protobufs/identity-unauth.cjs
@@ -625,6 +625,128 @@
 };
 
 
+/**
+ * @const
+ * @type {!grpc.web.MethodDescriptor<
+ *   !proto.identity.unauth.RestorePasswordUserRequest,
+ *   !proto.identity.unauth.AuthResponse>}
+ */
+const methodDescriptor_IdentityClientService_RestorePasswordUser = new grpc.web.MethodDescriptor(
+  '/identity.unauth.IdentityClientService/RestorePasswordUser',
+  grpc.web.MethodType.UNARY,
+  proto.identity.unauth.RestorePasswordUserRequest,
+  proto.identity.unauth.AuthResponse,
+  /**
+   * @param {!proto.identity.unauth.RestorePasswordUserRequest} request
+   * @return {!Uint8Array}
+   */
+  function(request) {
+    return request.serializeBinary();
+  },
+  proto.identity.unauth.AuthResponse.deserializeBinary
+);
+
+
+/**
+ * @param {!proto.identity.unauth.RestorePasswordUserRequest} request The
+ *     request proto
+ * @param {?Object<string, string>} metadata User defined
+ *     call metadata
+ * @param {function(?grpc.web.RpcError, ?proto.identity.unauth.AuthResponse)}
+ *     callback The callback function(error, response)
+ * @return {!grpc.web.ClientReadableStream<!proto.identity.unauth.AuthResponse>|undefined}
+ *     The XHR Node Readable Stream
+ */
+proto.identity.unauth.IdentityClientServiceClient.prototype.restorePasswordUser =
+    function(request, metadata, callback) {
+  return this.client_.rpcCall(this.hostname_ +
+      '/identity.unauth.IdentityClientService/RestorePasswordUser',
+      request,
+      metadata || {},
+      methodDescriptor_IdentityClientService_RestorePasswordUser,
+      callback);
+};
+
+
+/**
+ * @param {!proto.identity.unauth.RestorePasswordUserRequest} request The
+ *     request proto
+ * @param {?Object<string, string>=} metadata User defined
+ *     call metadata
+ * @return {!Promise<!proto.identity.unauth.AuthResponse>}
+ *     Promise that resolves to the response
+ */
+proto.identity.unauth.IdentityClientServicePromiseClient.prototype.restorePasswordUser =
+    function(request, metadata) {
+  return this.client_.unaryCall(this.hostname_ +
+      '/identity.unauth.IdentityClientService/RestorePasswordUser',
+      request,
+      metadata || {},
+      methodDescriptor_IdentityClientService_RestorePasswordUser);
+};
+
+
+/**
+ * @const
+ * @type {!grpc.web.MethodDescriptor<
+ *   !proto.identity.unauth.RestoreWalletUserRequest,
+ *   !proto.identity.unauth.AuthResponse>}
+ */
+const methodDescriptor_IdentityClientService_RestoreWalletUser = new grpc.web.MethodDescriptor(
+  '/identity.unauth.IdentityClientService/RestoreWalletUser',
+  grpc.web.MethodType.UNARY,
+  proto.identity.unauth.RestoreWalletUserRequest,
+  proto.identity.unauth.AuthResponse,
+  /**
+   * @param {!proto.identity.unauth.RestoreWalletUserRequest} request
+   * @return {!Uint8Array}
+   */
+  function(request) {
+    return request.serializeBinary();
+  },
+  proto.identity.unauth.AuthResponse.deserializeBinary
+);
+
+
+/**
+ * @param {!proto.identity.unauth.RestoreWalletUserRequest} request The
+ *     request proto
+ * @param {?Object<string, string>} metadata User defined
+ *     call metadata
+ * @param {function(?grpc.web.RpcError, ?proto.identity.unauth.AuthResponse)}
+ *     callback The callback function(error, response)
+ * @return {!grpc.web.ClientReadableStream<!proto.identity.unauth.AuthResponse>|undefined}
+ *     The XHR Node Readable Stream
+ */
+proto.identity.unauth.IdentityClientServiceClient.prototype.restoreWalletUser =
+    function(request, metadata, callback) {
+  return this.client_.rpcCall(this.hostname_ +
+      '/identity.unauth.IdentityClientService/RestoreWalletUser',
+      request,
+      metadata || {},
+      methodDescriptor_IdentityClientService_RestoreWalletUser,
+      callback);
+};
+
+
+/**
+ * @param {!proto.identity.unauth.RestoreWalletUserRequest} request The
+ *     request proto
+ * @param {?Object<string, string>=} metadata User defined
+ *     call metadata
+ * @return {!Promise<!proto.identity.unauth.AuthResponse>}
+ *     Promise that resolves to the response
+ */
+proto.identity.unauth.IdentityClientServicePromiseClient.prototype.restoreWalletUser =
+    function(request, metadata) {
+  return this.client_.unaryCall(this.hostname_ +
+      '/identity.unauth.IdentityClientService/RestoreWalletUser',
+      request,
+      metadata || {},
+      methodDescriptor_IdentityClientService_RestoreWalletUser);
+};
+
+
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
@@ -1053,3 +1175,4 @@
 
 
 module.exports = proto.identity.unauth;
+
diff --git a/web/protobufs/identity-unauth.cjs.flow b/web/protobufs/identity-unauth.cjs.flow
--- a/web/protobufs/identity-unauth.cjs.flow
+++ b/web/protobufs/identity-unauth.cjs.flow
@@ -72,6 +72,20 @@
                response: identityStructs.AuthResponse) => void
   ): grpcWeb.ClientReadableStream<identityStructs.AuthResponse>;
 
+  restorePasswordUser(
+    request: identityStructs.RestorePasswordUserRequest,
+    metadata: grpcWeb.Metadata | void,
+    callback: (err: grpcWeb.RpcError,
+               response: identityStructs.AuthResponse) => void
+  ): grpcWeb.ClientReadableStream<identityStructs.AuthResponse>;
+
+  restoreWalletUser(
+    request: identityStructs.RestoreWalletUserRequest,
+    metadata: grpcWeb.Metadata | void,
+    callback: (err: grpcWeb.RpcError,
+               response: identityStructs.AuthResponse) => void
+  ): grpcWeb.ClientReadableStream<identityStructs.AuthResponse>;
+
   verifyUserAccessToken(
     request: identityStructs.VerifyUserAccessTokenRequest,
     metadata: grpcWeb.Metadata | void,
@@ -172,6 +186,16 @@
     metadata?: grpcWeb.Metadata
   ): Promise<identityStructs.AuthResponse>;
 
+  restorePasswordUser(
+    request: identityStructs.RestorePasswordUserRequest,
+    metadata?: grpcWeb.Metadata
+  ): Promise<identityStructs.AuthResponse>;
+
+  restoreWalletUser(
+    request: identityStructs.RestoreWalletUserRequest,
+    metadata?: grpcWeb.Metadata
+  ): Promise<identityStructs.AuthResponse>;
+
   verifyUserAccessToken(
     request: identityStructs.VerifyUserAccessTokenRequest,
     metadata?: grpcWeb.Metadata