diff --git a/services/identity/proto/identity.proto b/services/identity/proto/identity.proto
--- a/services/identity/proto/identity.proto
+++ b/services/identity/proto/identity.proto
@@ -42,7 +42,7 @@
     // Answer sent to the user upon reception of the PAKE login attempt,
     // containing a sealed envelope with the user's private key (step 2)
     bytes pakeCredentialResponse = 1;
-    bytes token = 2;
+    string token = 2;
   }
 }
 
@@ -110,7 +110,7 @@
 message VerifyUserTokenRequest {
   string userID = 1;
   string deviceID = 2;
-  bytes token = 3;
+  string token = 3;
 }
 
 message VerifyUserTokenResponse {
diff --git a/services/identity/src/service.rs b/services/identity/src/service.rs
--- a/services/identity/src/service.rs
+++ b/services/identity/src/service.rs
@@ -67,8 +67,27 @@
     &self,
     request: Request<VerifyUserTokenRequest>,
   ) -> Result<Response<VerifyUserTokenResponse>, Status> {
-    println!("Got a lookup request: {:?}", request);
-    unimplemented!()
+    let message = request.into_inner();
+    match self
+      .client
+      .get_token(message.user_id, message.device_id)
+      .await
+    {
+      Ok(Some(access_token)) => {
+        if message.token == access_token.token {
+          Ok(Response::new(VerifyUserTokenResponse {
+            token_valid: access_token.valid,
+          }))
+        } else {
+          Ok(Response::new(VerifyUserTokenResponse {
+            token_valid: false,
+          }))
+        }
+      }
+      _ => Ok(Response::new(VerifyUserTokenResponse {
+        token_valid: false,
+      })),
+    }
   }
 }