diff --git a/services/identity/src/constants.rs b/services/identity/src/constants.rs
--- a/services/identity/src/constants.rs
+++ b/services/identity/src/constants.rs
@@ -85,6 +85,24 @@
 pub const RESERVED_USERNAMES_TABLE: &str = "identity-reserved-usernames";
 pub const RESERVED_USERNAMES_TABLE_PARTITION_KEY: &str = "username";
 
+// One time keys table, which need to exist in their own table to ensure
+// atomicity of additions and removals
+pub mod content_one_time_keys_table {
+  pub const NAME: &'static str = "identity-content-one-time-keys";
+  pub const PARTITION_KEY: &'static str = "deviceID";
+  pub const DEVICE_ID: &'static str = PARTITION_KEY;
+  pub const SORT_KEY: &'static str = "oneTimeKey";
+  pub const ONE_TIME_KEY: &'static str = SORT_KEY;
+}
+
+pub mod notif_one_time_keys_table {
+  pub const NAME: &'static str = "identity-notif-one-time-keys";
+  pub const PARTITION_KEY: &'static str = "deviceID";
+  pub const DEVICE_ID: &'static str = PARTITION_KEY;
+  pub const SORT_KEY: &'static str = "oneTimeKey";
+  pub const ONE_TIME_KEY: &'static str = SORT_KEY;
+}
+
 // Tokio
 
 pub const MPSC_CHANNEL_BUFFER_CAPACITY: usize = 1;
diff --git a/services/terraform/modules/shared/dynamodb.tf b/services/terraform/modules/shared/dynamodb.tf
--- a/services/terraform/modules/shared/dynamodb.tf
+++ b/services/terraform/modules/shared/dynamodb.tf
@@ -259,6 +259,40 @@
   }
 }
 
+resource "aws_dynamodb_table" "identity-content-onetime-keys" {
+  name           = "identity-content-onetime-keys"
+  hash_key       = "deviceID"
+  range_key      = "oneTimeKey"
+  billing_mode   = "PAY_PER_REQUEST"
+
+  attribute {
+    name = "deviceID"
+    type = "S"
+  }
+
+  attribute {
+    name = "oneTimeKey"
+    type = "S"
+  }
+}
+
+resource "aws_dynamodb_table" "identity-notif-onetime-keys" {
+  name           = "identity-notif-onetime-keys"
+  hash_key       = "deviceID"
+  range_key      = "oneTimeKey"
+  billing_mode   = "PAY_PER_REQUEST"
+
+  attribute {
+    name = "deviceID"
+    type = "S"
+  }
+
+  attribute {
+    name = "oneTimeKey"
+    type = "S"
+  }
+}
+
 resource "aws_dynamodb_table" "feature-flags" {
   name         = "feature-flags"
   hash_key     = "platform"