diff --git a/scripts/source_development_defaults.sh b/scripts/source_development_defaults.sh
index 5f173364f..88abc6342 100644
--- a/scripts/source_development_defaults.sh
+++ b/scripts/source_development_defaults.sh
@@ -1,55 +1,55 @@
 #!/usr/bin/env bash
 
 if [[ "$OSTYPE" == 'linux'* ]]; then
   export MYSQL_UNIX_PORT="${XDG_RUNTIME_DIR:-/run/user/$UID}/mysql.sock"
   export ANDROID_HOME="${ANDROID_HOME:-$HOME/Android/Sdk}"
 fi
 
 if [[ "$OSTYPE" == 'darwin'* ]]; then
   MARIADB_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/MariaDB"
   export MYSQL_UNIX_PORT="$MARIADB_DIR"/mysql.sock
   export ANDROID_HOME="${ANDROID_HOME:-$HOME/Library/Android/sdk}"
 fi
 
 # User defaults of
 # https://www.rabbitmq.com/configure.html#supported-environment-variables
 export RABBITMQ_NODENAME=comm
 export RABBITMQ_DEFAULT_PASS=comm
 export RABBITMQ_DEFAULT_USER=comm
 export RABBITMQ_HOME=${XDG_DATA_HOME:-$HOME/.local/share}/RabbitMQ
 export RABBITMQ_MNESIA_BASE=${RABBITMQ_HOME}/mnesia
 export RABBITMQ_LOG_BASE=${RABBITMQ_HOME}/logs
 export RABBITMQ_LOGS=${RABBITMQ_LOG_BASE}/comm.log
 export RABBITMQ_PLUGINS_EXPAND_DIR=${RABBITMQ_HOME}/plugins_expand
 export RABBITMQ_PID_FILE=${RABBITMQ_HOME}/rabbitmq.pid
 
 export PATH="$PATH":"$ANDROID_HOME"/emulator:"$ANDROID_HOME"/tools
 export PATH="$PATH":"$ANDROID_HOME"/tools/bin:"$ANDROID_HOME"/platform-tools
 
 # ANDROID_SDK_ROOT is deprecated, but it's still used by some tooling
 # such as sdkmanager. ANDROID_HOME is the new prefered env var.
 export ANDROID_SDK_ROOT="${ANDROID_SDK_ROOT:-$ANDROID_HOME}"
 
 export PATH="$PATH":./node_modules/.bin
 
 # Development helpers
 PRJ_ROOT="$(git rev-parse --show-toplevel)"
 export PATH="$PATH":${PRJ_ROOT}/scripts/bin
 
 # mysql2 package wants stable prefixes for temporary directory paths
 # 'nix develop' will set TMP and related variables to something different each
 # invocation
 export TMP=/tmp/app.comm
 export TEMP="$TMP"
 export TMPDIR="$TMP"
 export TEMPDIR="$TMP"
 
 mkdir -p "$TMP"
 
 # For cargo + rustup applications, ensure cargo user bin directory is on path
 if [[ ! "$PATH" =~ \.cargo/bin ]]; then
   export PATH="$PATH":${HOME}/.cargo/bin
 fi
 
 # For development and local testing, point to localstack
-export AWS_ENDPOINT=http://localhost:4566
+export LOCALSTACK_ENDPOINT=http://localhost:4566
diff --git a/services/identity/src/config.rs b/services/identity/src/config.rs
index 066b450d4..df15e8768 100644
--- a/services/identity/src/config.rs
+++ b/services/identity/src/config.rs
@@ -1,66 +1,73 @@
 use curve25519_dalek::ristretto::RistrettoPoint;
 use once_cell::sync::Lazy;
 use opaque_ke::{errors::PakeError, keypair::KeyPair};
 use std::{env, fmt, fs, io, path::Path};
 
 use crate::constants::{
-  AUTH_TOKEN, SECRETS_DIRECTORY, SECRETS_FILE_EXTENSION, SECRETS_FILE_NAME,
+  AUTH_TOKEN, LOCALSTACK_ENDPOINT, SECRETS_DIRECTORY, SECRETS_FILE_EXTENSION,
+  SECRETS_FILE_NAME,
 };
 
 pub static CONFIG: Lazy<Config> =
   Lazy::new(|| Config::load().expect("failed to load config"));
 
 pub(super) fn load_config() {
   Lazy::force(&CONFIG);
 }
 
 #[derive(Clone)]
 pub struct Config {
   pub server_keypair: KeyPair<RistrettoPoint>,
   // this is temporary, while the only authorized caller is ashoat's keyserver
   pub keyserver_auth_token: String,
+  pub localstack_endpoint: Option<String>,
 }
 
 impl Config {
   fn load() -> Result<Self, Error> {
     let mut path = env::current_dir()?;
     path.push(SECRETS_DIRECTORY);
     path.push(SECRETS_FILE_NAME);
     path.set_extension(SECRETS_FILE_EXTENSION);
-    let keypair = get_keypair_from_file(path)?;
-    let auth_token =
+    let server_keypair = get_keypair_from_file(path)?;
+    let keyserver_auth_token =
       env::var(AUTH_TOKEN).unwrap_or_else(|_| String::from("test"));
+    let localstack_endpoint = env::var(LOCALSTACK_ENDPOINT).ok();
+
     Ok(Self {
-      server_keypair: keypair,
-      keyserver_auth_token: auth_token,
+      server_keypair,
+      keyserver_auth_token,
+      localstack_endpoint,
     })
   }
 }
 
 impl fmt::Debug for Config {
   fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
     f.debug_struct("Config")
-      .field("server_keypair", &"redacted")
+      .field("server_keypair", &"** redacted **")
+      .field("keyserver_auth_token", &"** redacted **")
+      .field("localstack_endpoint", &self.localstack_endpoint)
       .finish()
   }
 }
 
 #[derive(
   Debug, derive_more::Display, derive_more::From, derive_more::Error,
 )]
 pub enum Error {
   #[display(...)]
   Pake(PakeError),
   #[display(...)]
   IO(io::Error),
   #[display(...)]
   Env(env::VarError),
 }
 
 fn get_keypair_from_file<P: AsRef<Path>>(
   path: P,
 ) -> Result<KeyPair<RistrettoPoint>, Error> {
   let bytes = fs::read(path)?;
   KeyPair::from_private_key_slice(&bytes)
     .map_err(|e| Error::Pake(PakeError::CryptoError(e)))
 }
diff --git a/services/identity/src/constants.rs b/services/identity/src/constants.rs
index 988332618..52bb027db 100644
--- a/services/identity/src/constants.rs
+++ b/services/identity/src/constants.rs
@@ -1,106 +1,110 @@
 // Secrets
 
 pub const SECRETS_DIRECTORY: &str = "secrets";
 pub const SECRETS_FILE_NAME: &str = "secret_key";
 pub const SECRETS_FILE_EXTENSION: &str = "txt";
 
 // DynamoDB
 
 // User table information, supporting opaque_ke 2.0 and X3DH information
 pub mod opaque2 {
   // Users can sign in either through username+password or Eth wallet.
   //
   // This structure should be aligned with the messages defined in
   // shared/protos/identity_client.proto
   //
   // Structure for a user should be:
   // {
   //   userID: String,
   //   opaqueRegistrationData: Option<String>,
   //   username: Option<String>,
   //   walletAddress: Option<String>,
   //   devices: HashMap<String, Device>
   // }
   //
   // A device is defined as:
   // {
   //     deviceType: String, # client or keyserver
   //     keyPayload: String,
   //     identityPreKey: String,
   //     identityPreKeySignature: String,
   //     identityOneTimeKeys: Vec<String>,
   //     notifPreKey: String,
   //     notifPreKeySignature: String,
   //     notifOneTimeKeys: Vec<String>,
   //   }
   // }
   //
   // Additional context:
   // "devices" uses the signing public identity key of the device as a key for the devices map
   // "keyPayload" is a JSON encoded string containing identity and notif keys (both signature and verification)
   // if "deviceType" == "keyserver", then the device will not have any notif key information
 
   pub const USERS_TABLE: &str = "identity-users-opaque2";
   pub const USERS_TABLE_PARTITION_KEY: &str = "userID";
   pub const USERS_TABLE_REGISTRATION_ATTRIBUTE: &str = "opaqueRegistrationData";
   pub const USERS_TABLE_USERNAME_ATTRIBUTE: &str = "username";
   pub const USERS_TABLE_DEVICES_ATTRIBUTE: &str = "devices";
   pub const USERS_TABLE_DEVICES_MAP_KEY_PAYLOAD_ATTRIBUTE_NAME: &str =
     "keyPayload";
   pub const USERS_TABLE_DEVICES_MAP_IDENTITY_PREKEY_ATTRIBUTE_NAME: &str =
     "identityPreKey";
   pub const USERS_TABLE_DEVICES_MAP_IDENTITY_PREKEY_SIGNATURE_ATTRIBUTE_NAME:
     &str = "identityPreKeySignature";
   pub const USERS_TABLE_DEVICES_MAP_IDENTITY_ONETIME_KEYS_ATTRIBUTE_NAME: &str =
     "identityOneTimeKeys";
   pub const USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_ATTRIBUTE_NAME: &str =
     "preKey";
   pub const USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_SIGNATURE_ATTRIBUTE_NAME:
     &str = "preKeySignature";
   pub const USERS_TABLE_DEVICES_MAP_NOTIF_ONETIME_KEYS_ATTRIBUTE_NAME: &str =
     "notifOneTimeKeys";
   pub const USERS_TABLE_WALLET_ADDRESS_ATTRIBUTE: &str = "walletAddress";
   pub const USERS_TABLE_USERNAME_INDEX: &str = "username-index";
   pub const USERS_TABLE_WALLET_ADDRESS_INDEX: &str = "walletAddress-index";
 }
 
 pub const USERS_TABLE: &str = "identity-users";
 pub const USERS_TABLE_PARTITION_KEY: &str = "userID";
 pub const USERS_TABLE_REGISTRATION_ATTRIBUTE: &str = "pakeRegistrationData";
 pub const USERS_TABLE_USERNAME_ATTRIBUTE: &str = "username";
 pub const USERS_TABLE_DEVICES_ATTRIBUTE: &str = "devices";
 pub const USERS_TABLE_DEVICE_ATTRIBUTE_NAME: &str = "device";
 pub const USERS_TABLE_DEVICES_MAP_ATTRIBUTE_NAME: &str = "signingPublicKey";
 pub const USERS_TABLE_WALLET_ADDRESS_ATTRIBUTE: &str = "walletAddress";
 pub const USERS_TABLE_USERNAME_INDEX: &str = "username-index";
 pub const USERS_TABLE_WALLET_ADDRESS_INDEX: &str = "walletAddress-index";
 pub const USERS_TABLE_INITIALIZATION_INFO: &str = "initializationInfo";
 
 pub const ACCESS_TOKEN_TABLE: &str = "identity-tokens";
 pub const ACCESS_TOKEN_TABLE_PARTITION_KEY: &str = "userID";
 pub const ACCESS_TOKEN_SORT_KEY: &str = "signingPublicKey";
 pub const ACCESS_TOKEN_TABLE_CREATED_ATTRIBUTE: &str = "created";
 pub const ACCESS_TOKEN_TABLE_AUTH_TYPE_ATTRIBUTE: &str = "authType";
 pub const ACCESS_TOKEN_TABLE_VALID_ATTRIBUTE: &str = "valid";
 pub const ACCESS_TOKEN_TABLE_TOKEN_ATTRIBUTE: &str = "token";
 
 pub const NONCE_TABLE: &str = "identity-nonces";
 pub const NONCE_TABLE_PARTITION_KEY: &str = "nonce";
 pub const NONCE_TABLE_CREATED_ATTRIBUTE: &str = "created";
 
 // Tokio
 
 pub const MPSC_CHANNEL_BUFFER_CAPACITY: usize = 1;
 pub const IDENTITY_SERVICE_SOCKET_ADDR: &str = "[::]:50054";
 
 // Token
 
 pub const ACCESS_TOKEN_LENGTH: usize = 512;
 
 // Temporary config
 
 pub const AUTH_TOKEN: &str = "COMM_IDENTITY_SERVICE_AUTH_TOKEN";
 
 // Nonce
 
 pub const NONCE_LENGTH: usize = 17;
+
+// LocalStack
+
+pub const LOCALSTACK_ENDPOINT: &str = "LOCALSTACK_ENDPOINT";
diff --git a/services/identity/src/database.rs b/services/identity/src/database.rs
index 4545f2d98..030d38d17 100644
--- a/services/identity/src/database.rs
+++ b/services/identity/src/database.rs
@@ -1,775 +1,790 @@
 use std::collections::HashMap;
 use std::fmt::{Display, Formatter, Result as FmtResult};
 use std::sync::Arc;
 
 use aws_config::SdkConfig;
 use aws_sdk_dynamodb::model::AttributeValue;
 use aws_sdk_dynamodb::output::{
   DeleteItemOutput, GetItemOutput, PutItemOutput, QueryOutput, UpdateItemOutput,
 };
 use aws_sdk_dynamodb::types::Blob;
 use aws_sdk_dynamodb::{Client, Error as DynamoDBError};
 use chrono::{DateTime, Utc};
 use opaque_ke::{errors::ProtocolError, ServerRegistration};
 use tracing::{debug, error, info, warn};
 
+use crate::config::CONFIG;
 use crate::constants::{
   ACCESS_TOKEN_SORT_KEY, ACCESS_TOKEN_TABLE,
   ACCESS_TOKEN_TABLE_AUTH_TYPE_ATTRIBUTE, ACCESS_TOKEN_TABLE_CREATED_ATTRIBUTE,
   ACCESS_TOKEN_TABLE_PARTITION_KEY, ACCESS_TOKEN_TABLE_TOKEN_ATTRIBUTE,
   ACCESS_TOKEN_TABLE_VALID_ATTRIBUTE, NONCE_TABLE,
   NONCE_TABLE_CREATED_ATTRIBUTE, NONCE_TABLE_PARTITION_KEY, USERS_TABLE,
   USERS_TABLE_DEVICES_ATTRIBUTE, USERS_TABLE_DEVICES_MAP_ATTRIBUTE_NAME,
   USERS_TABLE_DEVICE_ATTRIBUTE_NAME, USERS_TABLE_INITIALIZATION_INFO,
   USERS_TABLE_PARTITION_KEY, USERS_TABLE_REGISTRATION_ATTRIBUTE,
   USERS_TABLE_USERNAME_ATTRIBUTE, USERS_TABLE_USERNAME_INDEX,
   USERS_TABLE_WALLET_ADDRESS_ATTRIBUTE, USERS_TABLE_WALLET_ADDRESS_INDEX,
 };
 use crate::nonce::NonceData;
 use crate::token::{AccessTokenData, AuthType};
 use comm_opaque::Cipher;
 
 #[derive(Clone)]
 pub struct DatabaseClient {
   client: Arc<Client>,
 }
 
 impl DatabaseClient {
   pub fn new(aws_config: &SdkConfig) -> Self {
+    let client = match &CONFIG.localstack_endpoint {
+      Some(endpoint) => {
+        info!(
+          "Configuring DynamoDB client to use LocalStack endpoint: {}",
+          endpoint
+        );
+        let ddb_config_builder =
+          aws_sdk_dynamodb::config::Builder::from(aws_config)
+            .endpoint_url(endpoint);
+        Client::from_conf(ddb_config_builder.build())
+      }
+      None => Client::new(aws_config),
+    };
+
     DatabaseClient {
-      client: Arc::new(Client::new(aws_config)),
+      client: Arc::new(client),
     }
   }
 
   pub async fn get_pake_registration(
     &self,
     user_id: String,
   ) -> Result<Option<ServerRegistration<Cipher>>, Error> {
     match self.get_item_from_users_table(&user_id).await {
       Ok(GetItemOutput {
         item: Some(mut item),
         ..
       }) => parse_registration_data_attribute(
         item.remove(USERS_TABLE_REGISTRATION_ATTRIBUTE),
       )
       .map(Some)
       .map_err(Error::Attribute),
       Ok(_) => {
         info!(
           "No item found for user {} in PAKE registration table",
           user_id
         );
         Ok(None)
       }
       Err(e) => {
         error!(
           "DynamoDB client failed to get registration data for user {}: {}",
           user_id, e
         );
         Err(e)
       }
     }
   }
 
   pub async fn get_session_initialization_info(
     &self,
     user_id: &str,
   ) -> Result<Option<HashMap<String, HashMap<String, String>>>, Error> {
     match self.get_item_from_users_table(user_id).await {
       Ok(GetItemOutput {
         item: Some(mut item),
         ..
       }) => parse_devices_attribute(item.remove(USERS_TABLE_DEVICES_ATTRIBUTE))
         .map(Some)
         .map_err(Error::Attribute),
       Ok(_) => {
         info!("No item found for user {} in users table", user_id);
         Ok(None)
       }
       Err(e) => {
         error!(
           "DynamoDB client failed to get session initialization info for user {}: {}",
           user_id, e
         );
         Err(e)
       }
     }
   }
 
   pub async fn update_users_table(
     &self,
     user_id: String,
     signing_public_key: Option<String>,
     registration: Option<ServerRegistration<Cipher>>,
     username: Option<String>,
     session_initialization_info: Option<&HashMap<String, String>>,
   ) -> Result<UpdateItemOutput, Error> {
     let mut update_expression_parts = Vec::new();
     let mut expression_attribute_names = HashMap::new();
     let mut expression_attribute_values = HashMap::new();
     if let Some(reg) = registration {
       update_expression_parts
         .push(format!("{} = :r", USERS_TABLE_REGISTRATION_ATTRIBUTE));
       expression_attribute_values.insert(
         ":r".to_string(),
         AttributeValue::B(Blob::new(reg.serialize())),
       );
     };
     if let Some(username) = username {
       update_expression_parts
         .push(format!("{} = :u", USERS_TABLE_USERNAME_ATTRIBUTE));
       expression_attribute_values
         .insert(":u".to_string(), AttributeValue::S(username));
     };
     if let Some(public_key) = signing_public_key {
       let device_info = match session_initialization_info {
         Some(info) => info
           .iter()
           .map(|(k, v)| (k.to_string(), AttributeValue::S(v.to_string())))
           .collect(),
         None => HashMap::new(),
       };
 
       // How we construct the update expression will depend on whether the user
       // already exists or not
       if let GetItemOutput { item: Some(_), .. } =
         self.get_item_from_users_table(&user_id).await?
       {
         update_expression_parts.push(format!(
           "{}.#{} = :k",
           USERS_TABLE_DEVICES_ATTRIBUTE, USERS_TABLE_DEVICES_MAP_ATTRIBUTE_NAME,
         ));
         expression_attribute_names.insert(
           format!("#{}", USERS_TABLE_DEVICES_MAP_ATTRIBUTE_NAME),
           public_key,
         );
         expression_attribute_values
           .insert(":k".to_string(), AttributeValue::M(device_info));
       } else {
         update_expression_parts
           .push(format!("{} = :k", USERS_TABLE_DEVICES_ATTRIBUTE));
         let mut devices = HashMap::new();
         devices.insert(public_key, AttributeValue::M(device_info));
         expression_attribute_values
           .insert(":k".to_string(), AttributeValue::M(devices));
       };
     };
 
     self
       .client
       .update_item()
       .table_name(USERS_TABLE)
       .key(USERS_TABLE_PARTITION_KEY, AttributeValue::S(user_id))
       .update_expression(format!("SET {}", update_expression_parts.join(",")))
       .set_expression_attribute_names(
         if expression_attribute_names.is_empty() {
           None
         } else {
           Some(expression_attribute_names)
         },
       )
       .set_expression_attribute_values(
         if expression_attribute_values.is_empty() {
           None
         } else {
           Some(expression_attribute_values)
         },
       )
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))
   }
 
   pub async fn add_user_to_users_table(
     &self,
     user_id: String,
     registration: ServerRegistration<Cipher>,
     username: String,
     signing_public_key: String,
     session_initialization_info: &HashMap<String, String>,
   ) -> Result<PutItemOutput, Error> {
     let device_info: HashMap<String, AttributeValue> =
       session_initialization_info
         .iter()
         .map(|(k, v)| (k.to_string(), AttributeValue::S(v.to_string())))
         .collect();
 
     let item = HashMap::from([
       (
         USERS_TABLE_PARTITION_KEY.to_string(),
         AttributeValue::S(user_id),
       ),
       (
         USERS_TABLE_USERNAME_ATTRIBUTE.to_string(),
         AttributeValue::S(username),
       ),
       (
         USERS_TABLE_REGISTRATION_ATTRIBUTE.to_string(),
         AttributeValue::B(Blob::new(registration.serialize())),
       ),
       (
         USERS_TABLE_DEVICES_ATTRIBUTE.to_string(),
         AttributeValue::M(HashMap::from([(
           signing_public_key,
           AttributeValue::M(device_info),
         )])),
       ),
     ]);
 
     self
       .client
       .put_item()
       .table_name(USERS_TABLE)
       .set_item(Some(item))
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))
   }
 
   pub async fn delete_user(
     &self,
     user_id: String,
   ) -> Result<DeleteItemOutput, Error> {
     debug!("Attempting to delete user: {}", user_id);
 
     match self
       .client
       .delete_item()
       .table_name(USERS_TABLE)
       .key(
         USERS_TABLE_PARTITION_KEY,
         AttributeValue::S(user_id.clone()),
       )
       .send()
       .await
     {
       Ok(out) => {
         info!("User has been deleted {}", user_id);
         Ok(out)
       }
       Err(e) => {
         error!("DynamoDB client failed to delete user {}", user_id);
         Err(Error::AwsSdk(e.into()))
       }
     }
   }
 
   pub async fn get_access_token_data(
     &self,
     user_id: String,
     signing_public_key: String,
   ) -> Result<Option<AccessTokenData>, Error> {
     let primary_key = create_composite_primary_key(
       (
         ACCESS_TOKEN_TABLE_PARTITION_KEY.to_string(),
         user_id.clone(),
       ),
       (
         ACCESS_TOKEN_SORT_KEY.to_string(),
         signing_public_key.clone(),
       ),
     );
     let get_item_result = self
       .client
       .get_item()
       .table_name(ACCESS_TOKEN_TABLE)
       .set_key(Some(primary_key))
       .consistent_read(true)
       .send()
       .await;
     match get_item_result {
       Ok(GetItemOutput {
         item: Some(mut item),
         ..
       }) => {
         let created = parse_created_attribute(
           item.remove(ACCESS_TOKEN_TABLE_CREATED_ATTRIBUTE),
         )?;
         let auth_type = parse_auth_type_attribute(
           item.remove(ACCESS_TOKEN_TABLE_AUTH_TYPE_ATTRIBUTE),
         )?;
         let valid = parse_valid_attribute(
           item.remove(ACCESS_TOKEN_TABLE_VALID_ATTRIBUTE),
         )?;
         let access_token = parse_token_attribute(
           item.remove(ACCESS_TOKEN_TABLE_TOKEN_ATTRIBUTE),
         )?;
         Ok(Some(AccessTokenData {
           user_id,
           signing_public_key,
           access_token,
           created,
           auth_type,
           valid,
         }))
       }
       Ok(_) => {
         info!(
           "No item found for user {} and signing public key {} in token table",
           user_id, signing_public_key
         );
         Ok(None)
       }
       Err(e) => {
         error!(
           "DynamoDB client failed to get token for user {} with signing public key {}: {}",
           user_id, signing_public_key, e
         );
         Err(Error::AwsSdk(e.into()))
       }
     }
   }
 
   pub async fn put_access_token_data(
     &self,
     access_token_data: AccessTokenData,
   ) -> Result<PutItemOutput, Error> {
     let item = HashMap::from([
       (
         ACCESS_TOKEN_TABLE_PARTITION_KEY.to_string(),
         AttributeValue::S(access_token_data.user_id),
       ),
       (
         ACCESS_TOKEN_SORT_KEY.to_string(),
         AttributeValue::S(access_token_data.signing_public_key),
       ),
       (
         ACCESS_TOKEN_TABLE_TOKEN_ATTRIBUTE.to_string(),
         AttributeValue::S(access_token_data.access_token),
       ),
       (
         ACCESS_TOKEN_TABLE_CREATED_ATTRIBUTE.to_string(),
         AttributeValue::S(access_token_data.created.to_rfc3339()),
       ),
       (
         ACCESS_TOKEN_TABLE_AUTH_TYPE_ATTRIBUTE.to_string(),
         AttributeValue::S(match access_token_data.auth_type {
           AuthType::Password => "password".to_string(),
           AuthType::Wallet => "wallet".to_string(),
         }),
       ),
       (
         ACCESS_TOKEN_TABLE_VALID_ATTRIBUTE.to_string(),
         AttributeValue::Bool(access_token_data.valid),
       ),
     ]);
     self
       .client
       .put_item()
       .table_name(ACCESS_TOKEN_TABLE)
       .set_item(Some(item))
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))
   }
 
   pub async fn get_user_id_from_user_info(
     &self,
     user_info: String,
     auth_type: AuthType,
   ) -> Result<Option<String>, Error> {
     let (index, attribute_name) = match auth_type {
       AuthType::Password => {
         (USERS_TABLE_USERNAME_INDEX, USERS_TABLE_USERNAME_ATTRIBUTE)
       }
       AuthType::Wallet => (
         USERS_TABLE_WALLET_ADDRESS_INDEX,
         USERS_TABLE_WALLET_ADDRESS_ATTRIBUTE,
       ),
     };
     match self
       .client
       .query()
       .table_name(USERS_TABLE)
       .index_name(index)
       .key_condition_expression(format!("{} = :u", attribute_name))
       .expression_attribute_values(":u", AttributeValue::S(user_info.clone()))
       .send()
       .await
     {
       Ok(QueryOutput {
         items: Some(mut items),
         ..
       }) => {
         let num_items = items.len();
         if num_items == 0 {
           return Ok(None);
         }
         if num_items > 1 {
           warn!(
             "{} user IDs associated with {} {}: {:?}",
             num_items, attribute_name, user_info, items
           );
         }
         parse_string_attribute(
           USERS_TABLE_PARTITION_KEY,
           items[0].remove(USERS_TABLE_PARTITION_KEY),
         )
         .map(Some)
         .map_err(Error::Attribute)
       }
       Ok(_) => {
         info!(
           "No item found for {} {} in users table",
           attribute_name, user_info
         );
         Ok(None)
       }
       Err(e) => {
         error!(
           "DynamoDB client failed to get user ID from {} {}: {}",
           attribute_name, user_info, e
         );
         Err(Error::AwsSdk(e.into()))
       }
     }
   }
 
   pub async fn get_item_from_users_table(
     &self,
     user_id: &str,
   ) -> Result<GetItemOutput, Error> {
     let primary_key = create_simple_primary_key((
       USERS_TABLE_PARTITION_KEY.to_string(),
       user_id.to_string(),
     ));
     self
       .client
       .get_item()
       .table_name(USERS_TABLE)
       .set_key(Some(primary_key))
       .consistent_read(true)
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))
   }
 
   pub async fn get_users(&self) -> Result<Vec<String>, Error> {
     let scan_output = self
       .client
       .scan()
       .table_name(USERS_TABLE)
       .projection_expression(USERS_TABLE_PARTITION_KEY)
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))?;
 
     let mut result = Vec::new();
     if let Some(attributes) = scan_output.items {
       for mut attribute in attributes {
         let id = parse_string_attribute(
           USERS_TABLE_PARTITION_KEY,
           attribute.remove(USERS_TABLE_PARTITION_KEY),
         )
         .map_err(Error::Attribute)?;
         result.push(id);
       }
     }
     Ok(result)
   }
 
   pub async fn add_nonce_to_nonces_table(
     &self,
     nonce_data: NonceData,
   ) -> Result<PutItemOutput, Error> {
     let item = HashMap::from([
       (
         NONCE_TABLE_PARTITION_KEY.to_string(),
         AttributeValue::S(nonce_data.nonce),
       ),
       (
         NONCE_TABLE_CREATED_ATTRIBUTE.to_string(),
         AttributeValue::S(nonce_data.created.to_rfc3339()),
       ),
     ]);
     self
       .client
       .put_item()
       .table_name(NONCE_TABLE)
       .set_item(Some(item))
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))
   }
 }
 
 #[derive(
   Debug, derive_more::Display, derive_more::From, derive_more::Error,
 )]
 pub enum Error {
   #[display(...)]
   AwsSdk(DynamoDBError),
   #[display(...)]
   Attribute(DBItemError),
 }
 
 #[derive(Debug, derive_more::Error, derive_more::Constructor)]
 pub struct DBItemError {
   attribute_name: &'static str,
   attribute_value: Option<AttributeValue>,
   attribute_error: DBItemAttributeError,
 }
 
 impl Display for DBItemError {
   fn fmt(&self, f: &mut Formatter) -> FmtResult {
     match &self.attribute_error {
       DBItemAttributeError::Missing => {
         write!(f, "Attribute {} is missing", self.attribute_name)
       }
       DBItemAttributeError::IncorrectType => write!(
         f,
         "Value for attribute {} has incorrect type: {:?}",
         self.attribute_name, self.attribute_value
       ),
       error => write!(
         f,
         "Error regarding attribute {} with value {:?}: {}",
         self.attribute_name, self.attribute_value, error
       ),
     }
   }
 }
 
 #[derive(Debug, derive_more::Display, derive_more::Error)]
 pub enum DBItemAttributeError {
   #[display(...)]
   Missing,
   #[display(...)]
   IncorrectType,
   #[display(...)]
   InvalidTimestamp(chrono::ParseError),
   #[display(...)]
   Pake(ProtocolError),
 }
 
 type AttributeName = String;
 
 fn create_simple_primary_key(
   partition_key: (AttributeName, String),
 ) -> HashMap<AttributeName, AttributeValue> {
   HashMap::from([(partition_key.0, AttributeValue::S(partition_key.1))])
 }
 
 fn create_composite_primary_key(
   partition_key: (AttributeName, String),
   sort_key: (AttributeName, String),
 ) -> HashMap<AttributeName, AttributeValue> {
   let mut primary_key = create_simple_primary_key(partition_key);
   primary_key.insert(sort_key.0, AttributeValue::S(sort_key.1));
   primary_key
 }
 
 fn parse_created_attribute(
   attribute: Option<AttributeValue>,
 ) -> Result<DateTime<Utc>, DBItemError> {
   if let Some(AttributeValue::S(created)) = &attribute {
     created.parse().map_err(|e| {
       DBItemError::new(
         ACCESS_TOKEN_TABLE_CREATED_ATTRIBUTE,
         attribute,
         DBItemAttributeError::InvalidTimestamp(e),
       )
     })
   } else {
     Err(DBItemError::new(
       ACCESS_TOKEN_TABLE_CREATED_ATTRIBUTE,
       attribute,
       DBItemAttributeError::Missing,
     ))
   }
 }
 
 fn parse_auth_type_attribute(
   attribute: Option<AttributeValue>,
 ) -> Result<AuthType, DBItemError> {
   if let Some(AttributeValue::S(auth_type)) = &attribute {
     match auth_type.as_str() {
       "password" => Ok(AuthType::Password),
       "wallet" => Ok(AuthType::Wallet),
       _ => Err(DBItemError::new(
         ACCESS_TOKEN_TABLE_AUTH_TYPE_ATTRIBUTE,
         attribute,
         DBItemAttributeError::IncorrectType,
       )),
     }
   } else {
     Err(DBItemError::new(
       ACCESS_TOKEN_TABLE_AUTH_TYPE_ATTRIBUTE,
       attribute,
       DBItemAttributeError::Missing,
     ))
   }
 }
 
 fn parse_valid_attribute(
   attribute: Option<AttributeValue>,
 ) -> Result<bool, DBItemError> {
   match attribute {
     Some(AttributeValue::Bool(valid)) => Ok(valid),
     Some(_) => Err(DBItemError::new(
       ACCESS_TOKEN_TABLE_VALID_ATTRIBUTE,
       attribute,
       DBItemAttributeError::IncorrectType,
     )),
     None => Err(DBItemError::new(
       ACCESS_TOKEN_TABLE_VALID_ATTRIBUTE,
       attribute,
       DBItemAttributeError::Missing,
     )),
   }
 }
 
 fn parse_token_attribute(
   attribute: Option<AttributeValue>,
 ) -> Result<String, DBItemError> {
   match attribute {
     Some(AttributeValue::S(token)) => Ok(token),
     Some(_) => Err(DBItemError::new(
       ACCESS_TOKEN_TABLE_TOKEN_ATTRIBUTE,
       attribute,
       DBItemAttributeError::IncorrectType,
     )),
     None => Err(DBItemError::new(
       ACCESS_TOKEN_TABLE_TOKEN_ATTRIBUTE,
       attribute,
       DBItemAttributeError::Missing,
     )),
   }
 }
 
 fn parse_registration_data_attribute(
   attribute: Option<AttributeValue>,
 ) -> Result<ServerRegistration<Cipher>, DBItemError> {
   match &attribute {
     Some(AttributeValue::B(server_registration_bytes)) => {
       match ServerRegistration::<Cipher>::deserialize(
         server_registration_bytes.as_ref(),
       ) {
         Ok(server_registration) => Ok(server_registration),
         Err(e) => Err(DBItemError::new(
           USERS_TABLE_REGISTRATION_ATTRIBUTE,
           attribute,
           DBItemAttributeError::Pake(e),
         )),
       }
     }
     Some(_) => Err(DBItemError::new(
       USERS_TABLE_REGISTRATION_ATTRIBUTE,
       attribute,
       DBItemAttributeError::IncorrectType,
     )),
     None => Err(DBItemError::new(
       USERS_TABLE_REGISTRATION_ATTRIBUTE,
       attribute,
       DBItemAttributeError::Missing,
     )),
   }
 }
 
 fn parse_devices_attribute(
   attribute: Option<AttributeValue>,
 ) -> Result<HashMap<String, HashMap<String, String>>, DBItemError> {
   let mut devices = HashMap::new();
   let ddb_devices =
     parse_map_attribute(USERS_TABLE_DEVICES_ATTRIBUTE, attribute)?;
 
   for (signing_public_key, session_initialization_info) in ddb_devices {
     let session_initialization_info_map = parse_map_attribute(
       USERS_TABLE_DEVICE_ATTRIBUTE_NAME,
       Some(session_initialization_info),
     )?;
     let mut inner_hash_map = HashMap::new();
     for (initialization_component_name, initialization_component_value) in
       session_initialization_info_map
     {
       let initialization_piece_value_string = parse_string_attribute(
         USERS_TABLE_INITIALIZATION_INFO,
         Some(initialization_component_value),
       )?;
       inner_hash_map.insert(
         initialization_component_name,
         initialization_piece_value_string,
       );
     }
     devices.insert(signing_public_key, inner_hash_map);
   }
   Ok(devices)
 }
 
 fn parse_map_attribute(
   attribute_name: &'static str,
   attribute_value: Option<AttributeValue>,
 ) -> Result<HashMap<String, AttributeValue>, DBItemError> {
   match attribute_value {
     Some(AttributeValue::M(map)) => Ok(map),
     Some(_) => Err(DBItemError::new(
       attribute_name,
       attribute_value,
       DBItemAttributeError::IncorrectType,
     )),
     None => Err(DBItemError::new(
       attribute_name,
       attribute_value,
       DBItemAttributeError::Missing,
     )),
   }
 }
 
 fn parse_string_attribute(
   attribute_name: &'static str,
   attribute_value: Option<AttributeValue>,
 ) -> Result<String, DBItemError> {
   match attribute_value {
     Some(AttributeValue::S(value)) => Ok(value),
     Some(_) => Err(DBItemError::new(
       attribute_name,
       attribute_value,
       DBItemAttributeError::IncorrectType,
     )),
     None => Err(DBItemError::new(
       attribute_name,
       attribute_value,
       DBItemAttributeError::Missing,
     )),
   }
 }
 
 #[cfg(test)]
 mod tests {
   use super::*;
 
   #[test]
   fn test_create_simple_primary_key() {
     let partition_key_name = "userID".to_string();
     let partition_key_value = "12345".to_string();
     let partition_key =
       (partition_key_name.clone(), partition_key_value.clone());
     let mut primary_key = create_simple_primary_key(partition_key);
     assert_eq!(primary_key.len(), 1);
     let attribute = primary_key.remove(&partition_key_name);
     assert!(attribute.is_some());
     assert_eq!(attribute, Some(AttributeValue::S(partition_key_value)));
   }
 
   #[test]
   fn test_create_composite_primary_key() {
     let partition_key_name = "userID".to_string();
     let partition_key_value = "12345".to_string();
     let partition_key =
       (partition_key_name.clone(), partition_key_value.clone());
     let sort_key_name = "deviceID".to_string();
     let sort_key_value = "54321".to_string();
     let sort_key = (sort_key_name.clone(), sort_key_value.clone());
     let mut primary_key = create_composite_primary_key(partition_key, sort_key);
     assert_eq!(primary_key.len(), 2);
     let partition_key_attribute = primary_key.remove(&partition_key_name);
     assert!(partition_key_attribute.is_some());
     assert_eq!(
       partition_key_attribute,
       Some(AttributeValue::S(partition_key_value))
     );
     let sort_key_attribute = primary_key.remove(&sort_key_name);
     assert!(sort_key_attribute.is_some());
     assert_eq!(sort_key_attribute, Some(AttributeValue::S(sort_key_value)))
   }
 }