diff --git a/services/identity/src/client_service.rs b/services/identity/src/client_service.rs
index 96c1ec015..7cb87403a 100644
--- a/services/identity/src/client_service.rs
+++ b/services/identity/src/client_service.rs
@@ -1,875 +1,875 @@
 use std::collections::HashMap;
 // Standard library imports
 use std::str::FromStr;
 
 // External crate imports
 use aws_sdk_dynamodb::Error as DynamoDBError;
 use comm_opaque2::grpc::protocol_error_to_grpc_status;
 use moka::future::Cache;
 use rand::rngs::OsRng;
 use siwe::eip55;
 use tonic::Response;
 use tracing::{debug, error};
 
 // Workspace crate imports
 use crate::client_service::client_proto::{
   inbound_keys_for_user_request, outbound_keys_for_user_request,
   AddReservedUsernamesRequest, Empty, GenerateNonceResponse, InboundKeyInfo,
   InboundKeysForUserRequest, InboundKeysForUserResponse,
   OpaqueLoginFinishRequest, OpaqueLoginFinishResponse, OpaqueLoginStartRequest,
   OpaqueLoginStartResponse, OutboundKeyInfo, OutboundKeysForUserRequest,
   OutboundKeysForUserResponse, RegistrationFinishRequest,
   RegistrationFinishResponse, RegistrationStartRequest,
   RegistrationStartResponse, RemoveReservedUsernameRequest,
   ReservedRegistrationStartRequest, ReservedWalletLoginRequest,
   VerifyUserAccessTokenRequest, VerifyUserAccessTokenResponse,
   WalletLoginRequest, WalletLoginResponse,
 };
 use crate::config::CONFIG;
 use crate::database::{
   DBDeviceTypeInt, DatabaseClient, DeviceType, KeyPayload,
 };
 use crate::error::Error as DBError;
 use crate::grpc_utils::{DeviceInfoWithAuth, DeviceKeyUploadActions};
 use crate::id::generate_uuid;
 use crate::nonce::generate_nonce_data;
 use crate::reserved_users::{
   validate_account_ownership_message_and_get_user_id,
   validate_add_reserved_usernames_message,
   validate_remove_reserved_username_message,
 };
 use crate::siwe::{is_valid_ethereum_address, parse_and_verify_siwe_message};
 use crate::token::{AccessTokenData, AuthType};
 pub use client_proto::identity_client_service_server::{
   IdentityClientService, IdentityClientServiceServer,
 };
 
 pub mod client_proto {
   tonic::include_proto!("identity.client");
 }
 
 #[derive(Clone)]
 pub enum WorkflowInProgress {
   Registration(Box<UserRegistrationInfo>),
   Login(Box<UserLoginInfo>),
   Update(UpdateState),
 }
 
 #[derive(Clone)]
 pub struct UserRegistrationInfo {
   pub username: String,
   pub flattened_device_key_upload: FlattenedDeviceKeyUpload,
   pub user_id: Option<String>,
 }
 
 #[derive(Clone)]
 pub struct UserLoginInfo {
   pub user_id: String,
   pub flattened_device_key_upload: FlattenedDeviceKeyUpload,
   pub opaque_server_login: comm_opaque2::server::Login,
 }
 
 #[derive(Clone)]
 pub struct UpdateState {
   pub user_id: String,
 }
 
 #[derive(Clone)]
 pub struct FlattenedDeviceKeyUpload {
   pub device_id_key: String,
   pub key_payload: String,
   pub key_payload_signature: String,
   pub content_prekey: String,
   pub content_prekey_signature: String,
   pub content_one_time_keys: Vec<String>,
   pub notif_prekey: String,
   pub notif_prekey_signature: String,
   pub notif_one_time_keys: Vec<String>,
   pub device_type: DeviceType,
 }
 
 #[derive(derive_more::Constructor)]
 pub struct ClientService {
   client: DatabaseClient,
   cache: Cache<String, WorkflowInProgress>,
 }
 
 #[tonic::async_trait]
 impl IdentityClientService for ClientService {
   async fn register_password_user_start(
     &self,
     request: tonic::Request<RegistrationStartRequest>,
   ) -> Result<tonic::Response<RegistrationStartResponse>, tonic::Status> {
     let message = request.into_inner();
     debug!("Received registration request for: {}", message.username);
 
     self.check_username_taken(&message.username).await?;
     let username_in_reserved_usernames_table = self
       .client
       .username_in_reserved_usernames_table(&message.username)
       .await
       .map_err(handle_db_error)?;
 
     if username_in_reserved_usernames_table {
       return Err(tonic::Status::already_exists("username already exists"));
     }
 
     if CONFIG.reserved_usernames.contains(&message.username)
       || is_valid_ethereum_address(&message.username)
     {
       return Err(tonic::Status::invalid_argument("username reserved"));
     }
 
     let registration_state = construct_user_registration_info(
       &message,
       None,
       message.username.clone(),
     )?;
     let server_registration = comm_opaque2::server::Registration::new();
     let server_message = server_registration
       .start(
         &CONFIG.server_setup,
         &message.opaque_registration_request,
         message.username.as_bytes(),
       )
       .map_err(protocol_error_to_grpc_status)?;
     let session_id = self
       .cache
       .insert_with_uuid_key(WorkflowInProgress::Registration(Box::new(
         registration_state,
       )))
       .await;
 
     let response = RegistrationStartResponse {
       session_id,
       opaque_registration_response: server_message,
     };
     Ok(Response::new(response))
   }
 
   async fn register_reserved_password_user_start(
     &self,
     request: tonic::Request<ReservedRegistrationStartRequest>,
   ) -> Result<tonic::Response<RegistrationStartResponse>, tonic::Status> {
     let message = request.into_inner();
     self.check_username_taken(&message.username).await?;
 
     if CONFIG.reserved_usernames.contains(&message.username) {
       return Err(tonic::Status::invalid_argument("username reserved"));
     }
 
     let username_in_reserved_usernames_table = self
       .client
       .username_in_reserved_usernames_table(&message.username)
       .await
       .map_err(handle_db_error)?;
     if !username_in_reserved_usernames_table {
       return Err(tonic::Status::permission_denied("username not reserved"));
     }
 
     let user_id = validate_account_ownership_message_and_get_user_id(
       &message.username,
       &message.keyserver_message,
       &message.keyserver_signature,
     )?;
 
     let registration_state = construct_user_registration_info(
       &message,
       Some(user_id),
       message.username.clone(),
     )?;
     let server_registration = comm_opaque2::server::Registration::new();
     let server_message = server_registration
       .start(
         &CONFIG.server_setup,
         &message.opaque_registration_request,
         message.username.as_bytes(),
       )
       .map_err(protocol_error_to_grpc_status)?;
 
     let session_id = self
       .cache
       .insert_with_uuid_key(WorkflowInProgress::Registration(Box::new(
         registration_state,
       )))
       .await;
 
     let response = RegistrationStartResponse {
       session_id,
       opaque_registration_response: server_message,
     };
     Ok(Response::new(response))
   }
 
   async fn register_password_user_finish(
     &self,
     request: tonic::Request<RegistrationFinishRequest>,
   ) -> Result<tonic::Response<RegistrationFinishResponse>, tonic::Status> {
     let message = request.into_inner();
 
     if let Some(WorkflowInProgress::Registration(state)) =
       self.cache.get(&message.session_id)
     {
       self.cache.invalidate(&message.session_id).await;
 
       let server_registration = comm_opaque2::server::Registration::new();
       let password_file = server_registration
         .finish(&message.opaque_registration_upload)
         .map_err(protocol_error_to_grpc_status)?;
 
       let device_id = state.flattened_device_key_upload.device_id_key.clone();
       let user_id = self
         .client
         .add_password_user_to_users_table(*state, password_file)
         .await
         .map_err(handle_db_error)?;
 
       // Create access token
       let token = AccessTokenData::new(
         user_id.clone(),
         device_id,
         crate::token::AuthType::Password,
         &mut OsRng,
       );
 
       let access_token = token.access_token.clone();
 
       self
         .client
         .put_access_token_data(token)
         .await
         .map_err(handle_db_error)?;
 
       let response = RegistrationFinishResponse {
         user_id,
         access_token,
       };
       Ok(Response::new(response))
     } else {
       Err(tonic::Status::not_found("session not found"))
     }
   }
 
   async fn login_password_user_start(
     &self,
     request: tonic::Request<OpaqueLoginStartRequest>,
   ) -> Result<tonic::Response<OpaqueLoginStartResponse>, tonic::Status> {
     let message = request.into_inner();
 
     debug!("Attempting to login user: {:?}", &message.username);
     let user_id_and_password_file = self
       .client
       .get_user_id_and_password_file_from_username(&message.username)
       .await
       .map_err(handle_db_error)?;
 
     let (user_id, password_file_bytes) =
       if let Some(data) = user_id_and_password_file {
         data
       } else {
         // It's possible that the user attempting login is already registered
         // on Ashoat's keyserver. If they are, we should send back a gRPC status
         // code instructing them to get a signed message from Ashoat's keyserver
         // in order to claim their username and register with the Identity
         // service.
         let username_in_reserved_usernames_table = self
           .client
           .username_in_reserved_usernames_table(&message.username)
           .await
           .map_err(handle_db_error)?;
 
         if username_in_reserved_usernames_table {
           return Err(tonic::Status::failed_precondition(
             "need keyserver message to claim username",
           ));
         }
 
         return Err(tonic::Status::not_found("user not found"));
       };
 
     let mut server_login = comm_opaque2::server::Login::new();
     let server_response = server_login
       .start(
         &CONFIG.server_setup,
         &password_file_bytes,
         &message.opaque_login_request,
         message.username.as_bytes(),
       )
       .map_err(protocol_error_to_grpc_status)?;
 
     let login_state =
       construct_user_login_info(&message, user_id, server_login)?;
 
     let session_id = self
       .cache
       .insert_with_uuid_key(WorkflowInProgress::Login(Box::new(login_state)))
       .await;
 
     let response = Response::new(OpaqueLoginStartResponse {
       session_id,
       opaque_login_response: server_response,
     });
     Ok(response)
   }
 
   async fn login_password_user_finish(
     &self,
     request: tonic::Request<OpaqueLoginFinishRequest>,
   ) -> Result<tonic::Response<OpaqueLoginFinishResponse>, tonic::Status> {
     let message = request.into_inner();
 
     if let Some(WorkflowInProgress::Login(state)) =
       self.cache.get(&message.session_id)
     {
       self.cache.invalidate(&message.session_id).await;
 
       let mut server_login = state.opaque_server_login.clone();
       server_login
         .finish(&message.opaque_login_upload)
         .map_err(protocol_error_to_grpc_status)?;
 
       self
         .client
         .add_password_user_device_to_users_table(
           state.user_id.clone(),
           state.flattened_device_key_upload.clone(),
         )
         .await
         .map_err(handle_db_error)?;
 
       // Create access token
       let token = AccessTokenData::new(
         state.user_id.clone(),
         state.flattened_device_key_upload.device_id_key,
         crate::token::AuthType::Password,
         &mut OsRng,
       );
 
       let access_token = token.access_token.clone();
 
       self
         .client
         .put_access_token_data(token)
         .await
         .map_err(handle_db_error)?;
 
       let response = OpaqueLoginFinishResponse {
         user_id: state.user_id,
         access_token,
       };
       Ok(Response::new(response))
     } else {
       Err(tonic::Status::not_found("session not found"))
     }
   }
 
   async fn login_wallet_user(
     &self,
     request: tonic::Request<WalletLoginRequest>,
   ) -> Result<tonic::Response<WalletLoginResponse>, tonic::Status> {
     let message = request.into_inner();
 
     let parsed_message = parse_and_verify_siwe_message(
       &message.siwe_message,
       &message.siwe_signature,
     )?;
 
     match self
       .client
       .get_nonce_from_nonces_table(&parsed_message.nonce)
       .await
       .map_err(handle_db_error)?
     {
       None => return Err(tonic::Status::invalid_argument("invalid nonce")),
       Some(_) => self
         .client
         .remove_nonce_from_nonces_table(&parsed_message.nonce)
         .await
         .map_err(handle_db_error)?,
     };
 
     let wallet_address = eip55(&parsed_message.address);
 
     let flattened_device_key_upload =
       construct_flattened_device_key_upload(&message)?;
 
     let social_proof = message
       .social_proof()?
       .ok_or_else(|| tonic::Status::invalid_argument("malformed payload"))?;
 
     let user_id = match self
       .client
       .get_user_id_from_user_info(wallet_address.clone(), &AuthType::Wallet)
       .await
       .map_err(handle_db_error)?
     {
       Some(id) => {
         // User already exists, so we should update the DDB item
         self
           .client
           .add_wallet_user_device_to_users_table(
             id.clone(),
             flattened_device_key_upload.clone(),
             social_proof,
           )
           .await
           .map_err(handle_db_error)?;
         id
       }
       None => {
         // It's possible that the user attempting login is already registered
         // on Ashoat's keyserver. If they are, we should send back a gRPC status
         // code instructing them to get a signed message from Ashoat's keyserver
         // in order to claim their wallet address and register with the Identity
         // service.
         let username_in_reserved_usernames_table = self
           .client
           .username_in_reserved_usernames_table(&wallet_address)
           .await
           .map_err(handle_db_error)?;
 
         if username_in_reserved_usernames_table {
           return Err(tonic::Status::failed_precondition(
             "need keyserver message to claim username",
           ));
         }
 
         // User doesn't exist yet and wallet address isn't reserved, so we
         // should add a new user in DDB
         self
           .client
           .add_wallet_user_to_users_table(
             flattened_device_key_upload.clone(),
             wallet_address,
             social_proof,
             None,
           )
           .await
           .map_err(handle_db_error)?
       }
     };
 
     // Create access token
     let token = AccessTokenData::new(
       user_id.clone(),
       flattened_device_key_upload.device_id_key,
       crate::token::AuthType::Password,
       &mut OsRng,
     );
 
     let access_token = token.access_token.clone();
 
     self
       .client
       .put_access_token_data(token)
       .await
       .map_err(handle_db_error)?;
 
     let response = WalletLoginResponse {
       user_id,
       access_token,
     };
     Ok(Response::new(response))
   }
 
   async fn login_reserved_wallet_user(
     &self,
     request: tonic::Request<ReservedWalletLoginRequest>,
   ) -> Result<tonic::Response<WalletLoginResponse>, tonic::Status> {
     let message = request.into_inner();
 
     let parsed_message = parse_and_verify_siwe_message(
       &message.siwe_message,
       &message.siwe_signature,
     )?;
 
     match self
       .client
       .get_nonce_from_nonces_table(&parsed_message.nonce)
       .await
       .map_err(handle_db_error)?
     {
       None => return Err(tonic::Status::invalid_argument("invalid nonce")),
       Some(_) => self
         .client
         .remove_nonce_from_nonces_table(&parsed_message.nonce)
         .await
         .map_err(handle_db_error)?,
     };
 
     let wallet_address = eip55(&parsed_message.address);
 
     self.check_wallet_address_taken(&wallet_address).await?;
 
     let wallet_address_in_reserved_usernames_table = self
       .client
       .username_in_reserved_usernames_table(&wallet_address)
       .await
       .map_err(handle_db_error)?;
     if !wallet_address_in_reserved_usernames_table {
       return Err(tonic::Status::permission_denied(
         "wallet address not reserved",
       ));
     }
 
     let user_id = validate_account_ownership_message_and_get_user_id(
       &wallet_address,
       &message.keyserver_message,
       &message.keyserver_signature,
     )?;
 
     let flattened_device_key_upload =
       construct_flattened_device_key_upload(&message)?;
 
     let social_proof = message
       .social_proof()?
       .ok_or_else(|| tonic::Status::invalid_argument("malformed payload"))?;
 
     self
       .client
       .add_wallet_user_to_users_table(
         flattened_device_key_upload.clone(),
         wallet_address,
         social_proof,
         Some(user_id.clone()),
       )
       .await
       .map_err(handle_db_error)?;
 
     let token = AccessTokenData::new(
       user_id.clone(),
       flattened_device_key_upload.device_id_key,
       crate::token::AuthType::Password,
       &mut OsRng,
     );
 
     let access_token = token.access_token.clone();
 
     self
       .client
       .put_access_token_data(token)
       .await
       .map_err(handle_db_error)?;
 
     let response = WalletLoginResponse {
       user_id,
       access_token,
     };
 
     Ok(Response::new(response))
   }
 
   async fn generate_nonce(
     &self,
     _request: tonic::Request<Empty>,
   ) -> Result<tonic::Response<GenerateNonceResponse>, tonic::Status> {
     let nonce_data = generate_nonce_data(&mut OsRng);
     match self
       .client
       .add_nonce_to_nonces_table(nonce_data.clone())
       .await
     {
       Ok(_) => Ok(Response::new(GenerateNonceResponse {
         nonce: nonce_data.nonce,
       })),
       Err(e) => Err(handle_db_error(e)),
     }
   }
 
   async fn get_outbound_keys_for_user(
     &self,
     request: tonic::Request<OutboundKeysForUserRequest>,
   ) -> Result<tonic::Response<OutboundKeysForUserResponse>, tonic::Status> {
     let message = request.into_inner();
 
     use outbound_keys_for_user_request::Identifier;
     let (user_ident, auth_type) = match message.identifier {
       None => {
         return Err(tonic::Status::invalid_argument("no identifier provided"))
       }
       Some(Identifier::Username(username)) => (username, AuthType::Password),
       Some(Identifier::WalletAddress(address)) => (address, AuthType::Wallet),
     };
 
     let devices_map = self
       .client
-      .get_keys_for_user(user_ident, &auth_type, true)
+      .get_keys_for_user_info(user_ident, &auth_type, true)
       .await
       .map_err(handle_db_error)?
       .ok_or_else(|| match auth_type {
         AuthType::Password => tonic::Status::not_found("username not found"),
         AuthType::Wallet => {
           tonic::Status::not_found("wallet address not found")
         }
       })?;
 
     let transformed_devices = devices_map
       .into_iter()
       .filter_map(|(key, device_info)| {
         let device_info_with_auth = DeviceInfoWithAuth {
           device_info,
-          auth_type: &auth_type,
+          auth_type: Some(&auth_type),
         };
         match OutboundKeyInfo::try_from(device_info_with_auth) {
           Ok(key_info) => Some((key, key_info)),
           Err(_) => {
             error!("Failed to transform device info for key {}", key);
             None
           }
         }
       })
       .collect::<HashMap<_, _>>();
 
     Ok(tonic::Response::new(OutboundKeysForUserResponse {
       devices: transformed_devices,
     }))
   }
 
   async fn get_inbound_keys_for_user(
     &self,
     request: tonic::Request<InboundKeysForUserRequest>,
   ) -> Result<tonic::Response<InboundKeysForUserResponse>, tonic::Status> {
     let message = request.into_inner();
 
     use inbound_keys_for_user_request::Identifier;
     let (user_ident, auth_type) = match message.identifier {
       None => {
         return Err(tonic::Status::invalid_argument("no identifier provided"))
       }
       Some(Identifier::Username(username)) => (username, AuthType::Password),
       Some(Identifier::WalletAddress(address)) => (address, AuthType::Wallet),
     };
 
     let devices_map = self
       .client
-      .get_keys_for_user(user_ident, &auth_type, false)
+      .get_keys_for_user_info(user_ident, &auth_type, false)
       .await
       .map_err(handle_db_error)?
       .ok_or_else(|| match auth_type {
         AuthType::Password => tonic::Status::not_found("username not found"),
         AuthType::Wallet => {
           tonic::Status::not_found("wallet address not found")
         }
       })?;
 
     let transformed_devices = devices_map
       .into_iter()
       .filter_map(|(key, device_info)| {
         let device_info_with_auth = DeviceInfoWithAuth {
           device_info,
-          auth_type: &auth_type,
+          auth_type: Some(&auth_type),
         };
         match InboundKeyInfo::try_from(device_info_with_auth) {
           Ok(key_info) => Some((key, key_info)),
           Err(_) => {
             error!("Failed to transform device info for key {}", key);
             None
           }
         }
       })
       .collect::<HashMap<_, _>>();
 
     Ok(tonic::Response::new(InboundKeysForUserResponse {
       devices: transformed_devices,
     }))
   }
 
   async fn verify_user_access_token(
     &self,
     request: tonic::Request<VerifyUserAccessTokenRequest>,
   ) -> Result<tonic::Response<VerifyUserAccessTokenResponse>, tonic::Status> {
     let message = request.into_inner();
     debug!("Verifying device: {}", &message.signing_public_key);
 
     let token_valid = self
       .client
       .verify_access_token(
         message.user_id,
         message.signing_public_key.clone(),
         message.access_token,
       )
       .await
       .map_err(handle_db_error)?;
 
     let response = Response::new(VerifyUserAccessTokenResponse { token_valid });
     debug!(
       "device {} was verified: {}",
       &message.signing_public_key, token_valid
     );
     Ok(response)
   }
 
   async fn add_reserved_usernames(
     &self,
     request: tonic::Request<AddReservedUsernamesRequest>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let message = request.into_inner();
 
     let usernames = validate_add_reserved_usernames_message(
       &message.message,
       &message.signature,
     )?;
 
     let filtered_usernames = self
       .client
       .filter_out_taken_usernames(usernames)
       .await
       .map_err(handle_db_error)?;
 
     self
       .client
       .add_usernames_to_reserved_usernames_table(filtered_usernames)
       .await
       .map_err(handle_db_error)?;
 
     let response = Response::new(Empty {});
     Ok(response)
   }
 
   async fn remove_reserved_username(
     &self,
     request: tonic::Request<RemoveReservedUsernameRequest>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let message = request.into_inner();
 
     let username = validate_remove_reserved_username_message(
       &message.message,
       &message.signature,
     )?;
 
     self
       .client
       .delete_username_from_reserved_usernames_table(username)
       .await
       .map_err(handle_db_error)?;
 
     let response = Response::new(Empty {});
     Ok(response)
   }
 
   async fn ping(
     &self,
     _request: tonic::Request<Empty>,
   ) -> Result<Response<Empty>, tonic::Status> {
     let response = Response::new(Empty {});
     Ok(response)
   }
 }
 
 impl ClientService {
   async fn check_username_taken(
     &self,
     username: &str,
   ) -> Result<(), tonic::Status> {
     let username_taken = self
       .client
       .username_taken(username.to_string())
       .await
       .map_err(handle_db_error)?;
     if username_taken {
       return Err(tonic::Status::already_exists("username already exists"));
     }
     Ok(())
   }
 
   async fn check_wallet_address_taken(
     &self,
     wallet_address: &str,
   ) -> Result<(), tonic::Status> {
     let wallet_address_taken = self
       .client
       .wallet_address_taken(wallet_address.to_string())
       .await
       .map_err(handle_db_error)?;
     if wallet_address_taken {
       return Err(tonic::Status::already_exists(
         "wallet address already exists",
       ));
     }
     Ok(())
   }
 }
 
 #[tonic::async_trait]
 pub trait CacheExt<T> {
   async fn insert_with_uuid_key(&self, value: T) -> String;
 }
 
 #[tonic::async_trait]
 impl<T> CacheExt<T> for Cache<String, T>
 where
   T: Clone + Send + Sync + 'static,
 {
   async fn insert_with_uuid_key(&self, value: T) -> String {
     let session_id = generate_uuid();
     self.insert(session_id.clone(), value).await;
     session_id
   }
 }
 
 pub fn handle_db_error(db_error: DBError) -> tonic::Status {
   match db_error {
     DBError::AwsSdk(DynamoDBError::InternalServerError(_))
     | DBError::AwsSdk(DynamoDBError::ProvisionedThroughputExceededException(
       _,
     ))
     | DBError::AwsSdk(DynamoDBError::RequestLimitExceeded(_)) => {
       tonic::Status::unavailable("please retry")
     }
     e => {
       error!("Encountered an unexpected error: {}", e);
       tonic::Status::failed_precondition("unexpected error")
     }
   }
 }
 
 fn construct_user_registration_info(
   message: &impl DeviceKeyUploadActions,
   user_id: Option<String>,
   username: String,
 ) -> Result<UserRegistrationInfo, tonic::Status> {
   Ok(UserRegistrationInfo {
     username,
     flattened_device_key_upload: construct_flattened_device_key_upload(
       message,
     )?,
     user_id,
   })
 }
 
 fn construct_user_login_info(
   message: &impl DeviceKeyUploadActions,
   user_id: String,
   opaque_server_login: comm_opaque2::server::Login,
 ) -> Result<UserLoginInfo, tonic::Status> {
   Ok(UserLoginInfo {
     user_id,
     flattened_device_key_upload: construct_flattened_device_key_upload(
       message,
     )?,
     opaque_server_login,
   })
 }
 
 fn construct_flattened_device_key_upload(
   message: &impl DeviceKeyUploadActions,
 ) -> Result<FlattenedDeviceKeyUpload, tonic::Status> {
   let key_info = KeyPayload::from_str(&message.payload()?)
     .map_err(|_| tonic::Status::invalid_argument("malformed payload"))?;
 
   let flattened_device_key_upload = FlattenedDeviceKeyUpload {
     device_id_key: key_info.primary_identity_public_keys.ed25519,
     key_payload: message.payload()?,
     key_payload_signature: message.payload_signature()?,
     content_prekey: message.content_prekey()?,
     content_prekey_signature: message.content_prekey_signature()?,
     content_one_time_keys: message.one_time_content_prekeys()?,
     notif_prekey: message.notif_prekey()?,
     notif_prekey_signature: message.notif_prekey_signature()?,
     notif_one_time_keys: message.one_time_notif_prekeys()?,
     device_type: DeviceType::try_from(DBDeviceTypeInt(message.device_type()?))
       .map_err(handle_db_error)?,
   };
 
   Ok(flattened_device_key_upload)
 }
diff --git a/services/identity/src/database.rs b/services/identity/src/database.rs
index 3106d9a1a..7f55d4585 100644
--- a/services/identity/src/database.rs
+++ b/services/identity/src/database.rs
@@ -1,1590 +1,1612 @@
 use constant_time_eq::constant_time_eq;
 use std::collections::{HashMap, HashSet};
 use std::str::FromStr;
 use std::sync::Arc;
 
 use crate::ddb_utils::{
   create_one_time_key_partition_key, into_one_time_put_requests, OlmAccountType,
 };
 use crate::error::{consume_error, DBItemAttributeError, DBItemError, Error};
 use aws_config::SdkConfig;
 use aws_sdk_dynamodb::model::{AttributeValue, PutRequest, WriteRequest};
 use aws_sdk_dynamodb::output::{
   DeleteItemOutput, GetItemOutput, PutItemOutput, QueryOutput,
 };
 use aws_sdk_dynamodb::{types::Blob, Client};
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use tracing::{debug, error, info, warn};
 
 use crate::client_service::{FlattenedDeviceKeyUpload, UserRegistrationInfo};
 use crate::config::CONFIG;
 use crate::constants::{
   ACCESS_TOKEN_SORT_KEY, ACCESS_TOKEN_TABLE,
   ACCESS_TOKEN_TABLE_AUTH_TYPE_ATTRIBUTE, ACCESS_TOKEN_TABLE_CREATED_ATTRIBUTE,
   ACCESS_TOKEN_TABLE_PARTITION_KEY, ACCESS_TOKEN_TABLE_TOKEN_ATTRIBUTE,
   ACCESS_TOKEN_TABLE_VALID_ATTRIBUTE, CONTENT_ONE_TIME_KEY, NONCE_TABLE,
   NONCE_TABLE_CREATED_ATTRIBUTE, NONCE_TABLE_EXPIRATION_TIME_ATTRIBUTE,
   NONCE_TABLE_EXPIRATION_TIME_UNIX_ATTRIBUTE, NONCE_TABLE_PARTITION_KEY,
   NOTIF_ONE_TIME_KEY, RESERVED_USERNAMES_TABLE,
   RESERVED_USERNAMES_TABLE_PARTITION_KEY, USERS_TABLE,
   USERS_TABLE_DEVICES_ATTRIBUTE,
   USERS_TABLE_DEVICES_MAP_CONTENT_ONE_TIME_KEYS_ATTRIBUTE_NAME,
   USERS_TABLE_DEVICES_MAP_CONTENT_PREKEY_ATTRIBUTE_NAME,
   USERS_TABLE_DEVICES_MAP_CONTENT_PREKEY_SIGNATURE_ATTRIBUTE_NAME,
   USERS_TABLE_DEVICES_MAP_DEVICE_TYPE_ATTRIBUTE_NAME,
   USERS_TABLE_DEVICES_MAP_KEY_PAYLOAD_ATTRIBUTE_NAME,
   USERS_TABLE_DEVICES_MAP_KEY_PAYLOAD_SIGNATURE_ATTRIBUTE_NAME,
   USERS_TABLE_DEVICES_MAP_NOTIF_ONE_TIME_KEYS_ATTRIBUTE_NAME,
   USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_ATTRIBUTE_NAME,
   USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_SIGNATURE_ATTRIBUTE_NAME,
   USERS_TABLE_DEVICES_MAP_SOCIAL_PROOF_ATTRIBUTE_NAME,
   USERS_TABLE_PARTITION_KEY, USERS_TABLE_REGISTRATION_ATTRIBUTE,
   USERS_TABLE_USERNAME_ATTRIBUTE, USERS_TABLE_USERNAME_INDEX,
   USERS_TABLE_WALLET_ADDRESS_ATTRIBUTE, USERS_TABLE_WALLET_ADDRESS_INDEX,
 };
 use crate::error::{AttributeValueFromHashMap, FromAttributeValue};
 use crate::id::generate_uuid;
 use crate::nonce::NonceData;
 use crate::token::{AccessTokenData, AuthType};
 pub use grpc_clients::identity::DeviceType;
 
 #[derive(Serialize, Deserialize)]
 pub struct OlmKeys {
   pub curve25519: String,
   pub ed25519: String,
 }
 
 #[derive(Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct KeyPayload {
   pub notification_identity_public_keys: OlmKeys,
   pub primary_identity_public_keys: OlmKeys,
 }
 
 impl FromStr for KeyPayload {
   type Err = serde_json::Error;
 
   // The payload is held in the database as an escaped JSON payload.
   // Escaped double quotes need to be trimmed before attempting to serialize
   fn from_str(payload: &str) -> Result<KeyPayload, Self::Err> {
     serde_json::from_str(&payload.replace(r#"\""#, r#"""#))
   }
 }
 
 pub struct DBDeviceTypeInt(pub i32);
 
 impl TryFrom<DBDeviceTypeInt> for DeviceType {
   type Error = crate::error::Error;
 
   fn try_from(value: DBDeviceTypeInt) -> Result<Self, Self::Error> {
     let device_result = DeviceType::try_from(value.0);
 
     device_result.map_err(|_| {
       Error::Attribute(DBItemError {
         attribute_name: USERS_TABLE_DEVICES_MAP_DEVICE_TYPE_ATTRIBUTE_NAME
           .to_string(),
         attribute_value: Some(AttributeValue::N(value.0.to_string())),
         attribute_error: DBItemAttributeError::InvalidValue,
       })
     })
   }
 }
 
 // This is very similar to the protobuf definitions, however,
 // coupling the protobuf schema to the database API should be avoided.
 pub struct PreKey {
   pub prekey: String,
   pub prekey_signature: String,
 }
 pub struct OutboundKeys {
   pub key_payload: String,
   pub key_payload_signature: String,
   pub social_proof: Option<String>,
   pub content_prekey: PreKey,
   pub notif_prekey: PreKey,
   pub content_one_time_key: Option<String>,
   pub notif_one_time_key: Option<String>,
 }
 
 #[derive(Clone)]
 pub struct DatabaseClient {
   client: Arc<Client>,
 }
 
 impl DatabaseClient {
   pub fn new(aws_config: &SdkConfig) -> Self {
     let client = match &CONFIG.localstack_endpoint {
       Some(endpoint) => {
         info!(
           "Configuring DynamoDB client to use LocalStack endpoint: {}",
           endpoint
         );
         let ddb_config_builder =
           aws_sdk_dynamodb::config::Builder::from(aws_config)
             .endpoint_url(endpoint);
         Client::from_conf(ddb_config_builder.build())
       }
       None => Client::new(aws_config),
     };
 
     DatabaseClient {
       client: Arc::new(client),
     }
   }
 
   pub async fn add_password_user_to_users_table(
     &self,
     registration_state: UserRegistrationInfo,
     password_file: Vec<u8>,
   ) -> Result<String, Error> {
     self
       .add_user_to_users_table(
         registration_state.flattened_device_key_upload,
         Some((registration_state.username, Blob::new(password_file))),
         None,
         None,
         registration_state.user_id,
       )
       .await
   }
 
   pub async fn add_wallet_user_to_users_table(
     &self,
     flattened_device_key_upload: FlattenedDeviceKeyUpload,
     wallet_address: String,
     social_proof: String,
     user_id: Option<String>,
   ) -> Result<String, Error> {
     self
       .add_user_to_users_table(
         flattened_device_key_upload,
         None,
         Some(wallet_address),
         Some(social_proof),
         user_id,
       )
       .await
   }
 
   async fn add_user_to_users_table(
     &self,
     flattened_device_key_upload: FlattenedDeviceKeyUpload,
     username_and_password_file: Option<(String, Blob)>,
     wallet_address: Option<String>,
     social_proof: Option<String>,
     user_id: Option<String>,
   ) -> Result<String, Error> {
     let user_id = user_id.unwrap_or_else(generate_uuid);
     let device_info =
       create_device_info(flattened_device_key_upload.clone(), social_proof);
     let devices = HashMap::from([(
       flattened_device_key_upload.device_id_key.clone(),
       AttributeValue::M(device_info),
     )]);
     let mut user = HashMap::from([
       (
         USERS_TABLE_PARTITION_KEY.to_string(),
         AttributeValue::S(user_id.clone()),
       ),
       (
         USERS_TABLE_DEVICES_ATTRIBUTE.to_string(),
         AttributeValue::M(devices),
       ),
     ]);
 
     if let Some((username, password_file)) = username_and_password_file {
       user.insert(
         USERS_TABLE_USERNAME_ATTRIBUTE.to_string(),
         AttributeValue::S(username),
       );
       user.insert(
         USERS_TABLE_REGISTRATION_ATTRIBUTE.to_string(),
         AttributeValue::B(password_file),
       );
     }
 
     if let Some(address) = wallet_address {
       user.insert(
         USERS_TABLE_WALLET_ADDRESS_ATTRIBUTE.to_string(),
         AttributeValue::S(address),
       );
     }
 
     self
       .client
       .put_item()
       .table_name(USERS_TABLE)
       .set_item(Some(user))
       // make sure we don't accidentaly overwrite existing row
       .condition_expression("attribute_not_exists(#pk)")
       .expression_attribute_names("#pk", USERS_TABLE_PARTITION_KEY)
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))?;
 
     self
       .append_one_time_prekeys(
         flattened_device_key_upload.device_id_key,
         flattened_device_key_upload.content_one_time_keys,
         flattened_device_key_upload.notif_one_time_keys,
       )
       .await?;
 
     Ok(user_id)
   }
 
   pub async fn add_password_user_device_to_users_table(
     &self,
     user_id: String,
     flattened_device_key_upload: FlattenedDeviceKeyUpload,
   ) -> Result<(), Error> {
     self
       .add_device_to_users_table(user_id, flattened_device_key_upload, None)
       .await
   }
 
   pub async fn add_wallet_user_device_to_users_table(
     &self,
     user_id: String,
     flattened_device_key_upload: FlattenedDeviceKeyUpload,
     social_proof: String,
   ) -> Result<(), Error> {
     self
       .add_device_to_users_table(
         user_id,
         flattened_device_key_upload,
         Some(social_proof),
       )
       .await
   }
 
   pub async fn get_keyserver_keys_for_user(
     &self,
     user_id: &str,
   ) -> Result<Option<OutboundKeys>, Error> {
     // DynamoDB doesn't have a way to "pop" a value from a list, so we must
     // first read in user info, then update one_time_keys with value we
     // gave to requester
     let user_info = self
       .get_item_from_users_table(user_id)
       .await?
       .item
       .ok_or(Error::MissingItem)?;
 
     let devices = user_info
       .get(USERS_TABLE_DEVICES_ATTRIBUTE)
       .ok_or(Error::MissingItem)?
       .to_hashmap(USERS_TABLE_DEVICES_ATTRIBUTE)?;
 
     let mut maybe_keyserver_id = None;
     for (device_id, device_info) in devices {
       let device_type = device_info
         .to_hashmap("device_id")?
         .get(USERS_TABLE_DEVICES_MAP_DEVICE_TYPE_ATTRIBUTE_NAME)
         .ok_or(Error::MissingItem)?
         .to_string(USERS_TABLE_DEVICES_MAP_DEVICE_TYPE_ATTRIBUTE_NAME)?;
 
       if device_type == "keyserver" {
         maybe_keyserver_id = Some(device_id);
         break;
       }
     }
 
     // Assert that the user has a keyserver, if they don't return None
     let keyserver_id = match maybe_keyserver_id {
       None => return Ok(None),
       Some(id) => id,
     };
 
     let keyserver = devices.get_map(keyserver_id)?;
     let notif_one_time_key: Option<String> = self
       .get_one_time_key(keyserver_id, OlmAccountType::Notification)
       .await?;
     let content_one_time_key: Option<String> = self
       .get_one_time_key(keyserver_id, OlmAccountType::Content)
       .await?;
 
     debug!(
       "Able to get notif one-time key for keyserver {}: {}",
       keyserver_id,
       notif_one_time_key.is_some()
     );
     debug!(
       "Able to get content one-time key for keyserver {}: {}",
       keyserver_id,
       content_one_time_key.is_some()
     );
 
     let content_prekey = keyserver
       .get_string(USERS_TABLE_DEVICES_MAP_CONTENT_PREKEY_ATTRIBUTE_NAME)?;
     let content_prekey_signature = keyserver.get_string(
       USERS_TABLE_DEVICES_MAP_CONTENT_PREKEY_SIGNATURE_ATTRIBUTE_NAME,
     )?;
     let notif_prekey = keyserver
       .get_string(USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_ATTRIBUTE_NAME)?;
     let notif_prekey_signature = keyserver.get_string(
       USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_SIGNATURE_ATTRIBUTE_NAME,
     )?;
     let key_payload = keyserver
       .get_string(USERS_TABLE_DEVICES_MAP_KEY_PAYLOAD_ATTRIBUTE_NAME)?
       .to_string();
     let key_payload_signature = keyserver
       .get_string(USERS_TABLE_DEVICES_MAP_KEY_PAYLOAD_SIGNATURE_ATTRIBUTE_NAME)?
       .to_string();
     let social_proof = keyserver
       .get(USERS_TABLE_DEVICES_MAP_SOCIAL_PROOF_ATTRIBUTE_NAME)
       .and_then(|s| {
         s.to_string(USERS_TABLE_DEVICES_MAP_SOCIAL_PROOF_ATTRIBUTE_NAME)
           .ok()
       })
       .map(|s| s.to_owned());
 
     let full_content_prekey = PreKey {
       prekey: content_prekey.to_string(),
       prekey_signature: content_prekey_signature.to_string(),
     };
 
     let full_notif_prekey = PreKey {
       prekey: notif_prekey.to_string(),
       prekey_signature: notif_prekey_signature.to_string(),
     };
 
     let outbound_payload = OutboundKeys {
       key_payload,
       key_payload_signature,
       social_proof,
       content_prekey: full_content_prekey,
       notif_prekey: full_notif_prekey,
       content_one_time_key,
       notif_one_time_key,
     };
 
     Ok(Some(outbound_payload))
   }
 
   /// Will "mint" a single one-time key by attempting to successfully delete a
   /// key
   pub async fn get_one_time_key(
     &self,
     device_id: &str,
     account_type: OlmAccountType,
   ) -> Result<Option<String>, Error> {
     use crate::constants::one_time_keys_table as otk_table;
     use crate::constants::ONE_TIME_KEY_MINIMUM_THRESHOLD;
 
     let query_result = self.get_one_time_keys(device_id, account_type).await?;
     let items = query_result.items();
 
     fn spawn_refresh_keys_task(device_id: &str) {
       // Clone the string slice to move into the async block
       let device_id = device_id.to_string();
       tokio::spawn(async move {
         debug!("Attempting to request more keys for device: {}", &device_id);
         let result =
           crate::tunnelbroker::send_refresh_keys_request(&device_id).await;
         consume_error(result);
       });
     }
 
     // If no one-time keys exist, or if there aren't enough, request more.
     // Additionally, if no one-time keys exist, return early.
     let item_vec = if let Some(items_list) = items {
       if items_list.len() < ONE_TIME_KEY_MINIMUM_THRESHOLD {
         spawn_refresh_keys_task(device_id);
       }
       items_list
     } else {
       debug!("Unable to find {:?} one-time key", account_type);
       spawn_refresh_keys_task(device_id);
       return Ok(None);
     };
 
     let mut result = None;
     // Attempt to delete the one-time keys individually, a successful delete
     // mints the one-time key to the requester
     for item in item_vec {
       let pk = item.get_string(otk_table::PARTITION_KEY)?;
       let otk = item.get_string(otk_table::SORT_KEY)?;
 
       let composite_key = HashMap::from([
         (
           otk_table::PARTITION_KEY.to_string(),
           AttributeValue::S(pk.to_string()),
         ),
         (
           otk_table::SORT_KEY.to_string(),
           AttributeValue::S(otk.to_string()),
         ),
       ]);
 
       debug!("Attempting to delete a {:?} one time key", account_type);
       match self
         .client
         .delete_item()
         .set_key(Some(composite_key))
         .table_name(otk_table::NAME)
         .send()
         .await
       {
         Ok(_) => {
           result = Some(otk.to_string());
           break;
         }
         // This err should only happen if a delete occurred between the read
         // above and this delete
         Err(e) => {
           debug!("Unable to delete key: {:?}", e);
           continue;
         }
       }
     }
 
     // Return deleted key
     Ok(result)
   }
 
   pub async fn get_one_time_keys(
     &self,
     device_id: &str,
     account_type: OlmAccountType,
   ) -> Result<QueryOutput, Error> {
     use crate::constants::one_time_keys_table::*;
 
     // Add related prefix to partition key to grab the correct result set
     let partition_key =
       create_one_time_key_partition_key(device_id, account_type);
 
     self
       .client
       .query()
       .table_name(NAME)
       .key_condition_expression(format!("{} = :pk", PARTITION_KEY))
       .expression_attribute_values(":pk", AttributeValue::S(partition_key))
       .return_consumed_capacity(
         aws_sdk_dynamodb::model::ReturnConsumedCapacity::Total,
       )
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))
       .map(|response| {
         let capacity_units = response
           .consumed_capacity()
           .and_then(|it| it.capacity_units());
         debug!("OTK read consumed capacity: {:?}", capacity_units);
         response
       })
   }
 
   pub async fn set_prekey(
     &self,
     user_id: String,
     device_id: String,
     content_prekey: String,
     content_prekey_signature: String,
     notif_prekey: String,
     notif_prekey_signature: String,
   ) -> Result<(), Error> {
     let notif_prekey_av = AttributeValue::S(notif_prekey);
     let notif_prekey_signature_av = AttributeValue::S(notif_prekey_signature);
     let content_prekey_av = AttributeValue::S(content_prekey);
     let content_prekey_signature_av =
       AttributeValue::S(content_prekey_signature);
 
     let update_expression =
       format!("SET {0}.#{1}.{2} = :n, {0}.#{1}.{3} = :p, {0}.#{1}.{4} = :c, {0}.#{1}.{5} = :d",
         USERS_TABLE_DEVICES_ATTRIBUTE,
         "deviceID",
         USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_ATTRIBUTE_NAME,
         USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_SIGNATURE_ATTRIBUTE_NAME,
         USERS_TABLE_DEVICES_MAP_CONTENT_PREKEY_ATTRIBUTE_NAME,
         USERS_TABLE_DEVICES_MAP_CONTENT_PREKEY_SIGNATURE_ATTRIBUTE_NAME,
       );
     let expression_attribute_names = HashMap::from([
       (format!("#{}", "deviceID"), device_id),
       (
         "#user_id".to_string(),
         USERS_TABLE_PARTITION_KEY.to_string(),
       ),
     ]);
     let expression_attribute_values = HashMap::from([
       (":n".to_string(), notif_prekey_av),
       (":p".to_string(), notif_prekey_signature_av),
       (":c".to_string(), content_prekey_av),
       (":d".to_string(), content_prekey_signature_av),
     ]);
 
     self
       .client
       .update_item()
       .table_name(USERS_TABLE)
       .key(USERS_TABLE_PARTITION_KEY, AttributeValue::S(user_id))
       .update_expression(update_expression)
       .condition_expression("attribute_exists(#user_id)")
       .set_expression_attribute_names(Some(expression_attribute_names))
       .set_expression_attribute_values(Some(expression_attribute_values))
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))?;
 
     Ok(())
   }
 
   pub async fn append_one_time_prekeys(
     &self,
     device_id: String,
     content_one_time_keys: Vec<String>,
     notif_one_time_keys: Vec<String>,
   ) -> Result<(), Error> {
     use crate::constants::one_time_keys_table;
 
     let mut otk_requests = into_one_time_put_requests(
       &device_id,
       content_one_time_keys,
       OlmAccountType::Content,
     );
     let notif_otk_requests: Vec<WriteRequest> = into_one_time_put_requests(
       &device_id,
       notif_one_time_keys,
       OlmAccountType::Notification,
     );
     otk_requests.extend(notif_otk_requests);
 
     // BatchWriteItem has a hard limit of 25 writes per call
     for requests in otk_requests.chunks(25) {
       self
         .client
         .batch_write_item()
         .request_items(one_time_keys_table::NAME, requests.to_vec())
         .send()
         .await
         .map_err(|e| Error::AwsSdk(e.into()))?;
     }
 
     Ok(())
   }
 
   async fn add_device_to_users_table(
     &self,
     user_id: String,
     flattened_device_key_upload: FlattenedDeviceKeyUpload,
     social_proof: Option<String>,
   ) -> Result<(), Error> {
     // Avoid borrowing from lifetime of flattened_device_key_upload
     let device_id = flattened_device_key_upload.device_id_key.clone();
     let content_one_time_keys =
       flattened_device_key_upload.content_one_time_keys.clone();
     let notif_one_time_keys =
       flattened_device_key_upload.notif_one_time_keys.clone();
 
     let device_info =
       create_device_info(flattened_device_key_upload, social_proof);
     let update_expression =
       format!("SET {}.#{} = :v", USERS_TABLE_DEVICES_ATTRIBUTE, "deviceID",);
     let expression_attribute_names =
       HashMap::from([(format!("#{}", "deviceID"), device_id.clone())]);
     let expression_attribute_values =
       HashMap::from([(":v".to_string(), AttributeValue::M(device_info))]);
 
     self
       .client
       .update_item()
       .table_name(USERS_TABLE)
       .key(USERS_TABLE_PARTITION_KEY, AttributeValue::S(user_id))
       .update_expression(update_expression)
       .set_expression_attribute_names(Some(expression_attribute_names))
       .set_expression_attribute_values(Some(expression_attribute_values))
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))?;
 
     self
       .append_one_time_prekeys(
         device_id,
         content_one_time_keys,
         notif_one_time_keys,
       )
       .await?;
 
     Ok(())
   }
 
   pub async fn remove_device_from_users_table(
     &self,
     user_id: String,
     device_id_key: String,
   ) -> Result<(), Error> {
     let update_expression =
       format!("REMOVE {}.{}", USERS_TABLE_DEVICES_ATTRIBUTE, ":deviceID");
 
     let expression_attribute_values = HashMap::from([(
       ":deviceID".to_string(),
       AttributeValue::S(device_id_key),
     )]);
 
     self
       .client
       .update_item()
       .table_name(USERS_TABLE)
       .key(USERS_TABLE_PARTITION_KEY, AttributeValue::S(user_id))
       .update_expression(update_expression)
       .set_expression_attribute_values(Some(expression_attribute_values))
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))?;
 
     Ok(())
   }
 
   pub async fn update_user_password(
     &self,
     user_id: String,
     password_file: Vec<u8>,
   ) -> Result<(), Error> {
     let update_expression =
       format!("SET {} = :p", USERS_TABLE_REGISTRATION_ATTRIBUTE);
     let expression_attribute_values = HashMap::from([(
       ":p".to_string(),
       AttributeValue::B(Blob::new(password_file)),
     )]);
 
     self
       .client
       .update_item()
       .table_name(USERS_TABLE)
       .key(USERS_TABLE_PARTITION_KEY, AttributeValue::S(user_id))
       .update_expression(update_expression)
       .set_expression_attribute_values(Some(expression_attribute_values))
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))?;
 
     Ok(())
   }
 
   pub async fn delete_user(
     &self,
     user_id: String,
   ) -> Result<DeleteItemOutput, Error> {
     debug!("Attempting to delete user: {}", user_id);
 
     match self
       .client
       .delete_item()
       .table_name(USERS_TABLE)
       .key(
         USERS_TABLE_PARTITION_KEY,
         AttributeValue::S(user_id.clone()),
       )
       .send()
       .await
     {
       Ok(out) => {
         info!("User has been deleted {}", user_id);
         Ok(out)
       }
       Err(e) => {
         error!("DynamoDB client failed to delete user {}", user_id);
         Err(Error::AwsSdk(e.into()))
       }
     }
   }
 
   pub async fn get_access_token_data(
     &self,
     user_id: String,
     signing_public_key: String,
   ) -> Result<Option<AccessTokenData>, Error> {
     let primary_key = create_composite_primary_key(
       (
         ACCESS_TOKEN_TABLE_PARTITION_KEY.to_string(),
         user_id.clone(),
       ),
       (
         ACCESS_TOKEN_SORT_KEY.to_string(),
         signing_public_key.clone(),
       ),
     );
     let get_item_result = self
       .client
       .get_item()
       .table_name(ACCESS_TOKEN_TABLE)
       .set_key(Some(primary_key))
       .consistent_read(true)
       .send()
       .await;
     match get_item_result {
       Ok(GetItemOutput {
         item: Some(mut item),
         ..
       }) => {
         let created = parse_date_time_attribute(
           ACCESS_TOKEN_TABLE_CREATED_ATTRIBUTE,
           item.remove(ACCESS_TOKEN_TABLE_CREATED_ATTRIBUTE),
         )?;
         let auth_type = parse_auth_type_attribute(
           item.remove(ACCESS_TOKEN_TABLE_AUTH_TYPE_ATTRIBUTE),
         )?;
         let valid = parse_valid_attribute(
           item.remove(ACCESS_TOKEN_TABLE_VALID_ATTRIBUTE),
         )?;
         let access_token = parse_token_attribute(
           item.remove(ACCESS_TOKEN_TABLE_TOKEN_ATTRIBUTE),
         )?;
         Ok(Some(AccessTokenData {
           user_id,
           signing_public_key,
           access_token,
           created,
           auth_type,
           valid,
         }))
       }
       Ok(_) => {
         info!(
           "No item found for user {} and signing public key {} in token table",
           user_id, signing_public_key
         );
         Ok(None)
       }
       Err(e) => {
         error!(
           "DynamoDB client failed to get token for user {} with signing public key {}: {}",
           user_id, signing_public_key, e
         );
         Err(Error::AwsSdk(e.into()))
       }
     }
   }
 
   pub async fn verify_access_token(
     &self,
     user_id: String,
     signing_public_key: String,
     access_token_to_verify: String,
   ) -> Result<bool, Error> {
     let is_valid = self
       .get_access_token_data(user_id, signing_public_key)
       .await?
       .map(|access_token_data| {
         constant_time_eq(
           access_token_data.access_token.as_bytes(),
           access_token_to_verify.as_bytes(),
         ) && access_token_data.is_valid()
       })
       .unwrap_or(false);
 
     Ok(is_valid)
   }
 
   pub async fn put_access_token_data(
     &self,
     access_token_data: AccessTokenData,
   ) -> Result<PutItemOutput, Error> {
     let item = HashMap::from([
       (
         ACCESS_TOKEN_TABLE_PARTITION_KEY.to_string(),
         AttributeValue::S(access_token_data.user_id),
       ),
       (
         ACCESS_TOKEN_SORT_KEY.to_string(),
         AttributeValue::S(access_token_data.signing_public_key),
       ),
       (
         ACCESS_TOKEN_TABLE_TOKEN_ATTRIBUTE.to_string(),
         AttributeValue::S(access_token_data.access_token),
       ),
       (
         ACCESS_TOKEN_TABLE_CREATED_ATTRIBUTE.to_string(),
         AttributeValue::S(access_token_data.created.to_rfc3339()),
       ),
       (
         ACCESS_TOKEN_TABLE_AUTH_TYPE_ATTRIBUTE.to_string(),
         AttributeValue::S(match access_token_data.auth_type {
           AuthType::Password => "password".to_string(),
           AuthType::Wallet => "wallet".to_string(),
         }),
       ),
       (
         ACCESS_TOKEN_TABLE_VALID_ATTRIBUTE.to_string(),
         AttributeValue::Bool(access_token_data.valid),
       ),
     ]);
     self
       .client
       .put_item()
       .table_name(ACCESS_TOKEN_TABLE)
       .set_item(Some(item))
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))
   }
 
   pub async fn delete_access_token_data(
     &self,
     user_id: String,
     device_id_key: String,
   ) -> Result<(), Error> {
     self
       .client
       .delete_item()
       .table_name(ACCESS_TOKEN_TABLE)
       .key(
         ACCESS_TOKEN_TABLE_PARTITION_KEY.to_string(),
         AttributeValue::S(user_id),
       )
       .key(
         ACCESS_TOKEN_SORT_KEY.to_string(),
         AttributeValue::S(device_id_key),
       )
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))?;
 
     Ok(())
   }
 
   pub async fn wallet_address_taken(
     &self,
     wallet_address: String,
   ) -> Result<bool, Error> {
     let result = self
       .get_user_id_from_user_info(wallet_address, &AuthType::Wallet)
       .await?;
 
     Ok(result.is_some())
   }
 
   pub async fn username_taken(&self, username: String) -> Result<bool, Error> {
     let result = self
       .get_user_id_from_user_info(username, &AuthType::Password)
       .await?;
 
     Ok(result.is_some())
   }
 
   pub async fn filter_out_taken_usernames(
     &self,
     usernames: Vec<String>,
   ) -> Result<Vec<String>, Error> {
     let db_usernames = self.get_all_usernames().await?;
 
     let db_usernames_set: HashSet<String> = db_usernames.into_iter().collect();
     let usernames_set: HashSet<String> = usernames.into_iter().collect();
 
     let available_usernames: Vec<String> = usernames_set
       .difference(&db_usernames_set)
       .cloned()
       .collect();
 
     Ok(available_usernames)
   }
 
   async fn get_user_from_user_info(
     &self,
     user_info: String,
     auth_type: &AuthType,
   ) -> Result<Option<HashMap<String, AttributeValue>>, Error> {
     let (index, attribute_name) = match auth_type {
       AuthType::Password => {
         (USERS_TABLE_USERNAME_INDEX, USERS_TABLE_USERNAME_ATTRIBUTE)
       }
       AuthType::Wallet => (
         USERS_TABLE_WALLET_ADDRESS_INDEX,
         USERS_TABLE_WALLET_ADDRESS_ATTRIBUTE,
       ),
     };
     match self
       .client
       .query()
       .table_name(USERS_TABLE)
       .index_name(index)
       .key_condition_expression(format!("{} = :u", attribute_name))
       .expression_attribute_values(":u", AttributeValue::S(user_info.clone()))
       .send()
       .await
     {
       Ok(QueryOutput {
         items: Some(items), ..
       }) => {
         let num_items = items.len();
         if num_items == 0 {
           return Ok(None);
         }
         if num_items > 1 {
           warn!(
             "{} user IDs associated with {} {}: {:?}",
             num_items, attribute_name, user_info, items
           );
         }
         let first_item = items[0].clone();
         let user_id = first_item
           .get(USERS_TABLE_PARTITION_KEY)
           .ok_or(DBItemError {
             attribute_name: USERS_TABLE_PARTITION_KEY.to_string(),
             attribute_value: None,
             attribute_error: DBItemAttributeError::Missing,
           })?
           .as_s()
           .map_err(|_| DBItemError {
             attribute_name: USERS_TABLE_PARTITION_KEY.to_string(),
             attribute_value: first_item.get(USERS_TABLE_PARTITION_KEY).cloned(),
             attribute_error: DBItemAttributeError::IncorrectType,
           })?;
         let result = self.get_item_from_users_table(user_id).await?;
         Ok(result.item)
       }
       Ok(_) => {
         info!(
           "No item found for {} {} in users table",
           attribute_name, user_info
         );
         Ok(None)
       }
       Err(e) => {
         error!(
           "DynamoDB client failed to get user from {} {}: {}",
           attribute_name, user_info, e
         );
         Err(Error::AwsSdk(e.into()))
       }
     }
   }
 
-  pub async fn get_keys_for_user(
+  pub async fn get_keys_for_user_info(
     &self,
     user_info: String,
     auth_type: &AuthType,
     get_one_time_keys: bool,
   ) -> Result<Option<Devices>, Error> {
-    let Some(mut user) =
+    let Some(user) =
       self.get_user_from_user_info(user_info, auth_type).await?
     else {
       return Ok(None);
     };
 
+    self.get_keys_for_user(user, get_one_time_keys).await
+  }
+
+  pub async fn get_keys_for_user_id(
+    &self,
+    user_id: &str,
+    get_one_time_keys: bool,
+  ) -> Result<Option<Devices>, Error> {
+    let Some(user) =
+      self.get_item_from_users_table(user_id).await?.item
+    else {
+      return Ok(None);
+    };
+
+    self.get_keys_for_user(user, get_one_time_keys).await
+  }
+
+  async fn get_keys_for_user(
+    &self,
+    mut user: HashMap<String, AttributeValue>,
+    get_one_time_keys: bool,
+  ) -> Result<Option<Devices>, Error> {
     let devices = parse_map_attribute(
       USERS_TABLE_DEVICES_ATTRIBUTE,
       user.remove(USERS_TABLE_DEVICES_ATTRIBUTE),
     )?;
 
     let mut devices_response = HashMap::with_capacity(devices.len());
     for (device_id_key, device_info) in devices {
       let device_info_map =
         parse_map_attribute(&device_id_key, Some(device_info))?;
 
       let mut device_info_string_map = HashMap::new();
       for (attribute_name, attribute_value) in device_info_map {
         // Excluding one-time keys since we're moving them to a separate table
         if attribute_name
           == USERS_TABLE_DEVICES_MAP_NOTIF_ONE_TIME_KEYS_ATTRIBUTE_NAME
           || attribute_name
             == USERS_TABLE_DEVICES_MAP_CONTENT_ONE_TIME_KEYS_ATTRIBUTE_NAME
         {
           continue;
         }
 
         let attribute_value_str =
           parse_string_attribute(&attribute_name, Some(attribute_value))?;
         device_info_string_map.insert(attribute_name, attribute_value_str);
       }
 
       if get_one_time_keys {
         if let Some(notif_one_time_key) = self
           .get_one_time_key(&device_id_key, OlmAccountType::Notification)
           .await?
         {
           device_info_string_map
             .insert(NOTIF_ONE_TIME_KEY.to_string(), notif_one_time_key);
         }
         if let Some(content_one_time_key) = self
           .get_one_time_key(&device_id_key, OlmAccountType::Content)
           .await?
         {
           device_info_string_map
             .insert(CONTENT_ONE_TIME_KEY.to_string(), content_one_time_key);
         }
       }
 
       devices_response.insert(device_id_key, device_info_string_map);
     }
 
     Ok(Some(devices_response))
   }
 
   pub async fn get_user_id_from_user_info(
     &self,
     user_info: String,
     auth_type: &AuthType,
   ) -> Result<Option<String>, Error> {
     match self
       .get_user_from_user_info(user_info.clone(), auth_type)
       .await
     {
       Ok(Some(mut user)) => parse_string_attribute(
         USERS_TABLE_PARTITION_KEY,
         user.remove(USERS_TABLE_PARTITION_KEY),
       )
       .map(Some)
       .map_err(Error::Attribute),
       Ok(_) => Ok(None),
       Err(e) => Err(e),
     }
   }
 
   pub async fn get_user_id_and_password_file_from_username(
     &self,
     username: &str,
   ) -> Result<Option<(String, Vec<u8>)>, Error> {
     match self
       .get_user_from_user_info(username.to_string(), &AuthType::Password)
       .await
     {
       Ok(Some(mut user)) => {
         let user_id = parse_string_attribute(
           USERS_TABLE_PARTITION_KEY,
           user.remove(USERS_TABLE_PARTITION_KEY),
         )?;
         let password_file = parse_registration_data_attribute(
           user.remove(USERS_TABLE_REGISTRATION_ATTRIBUTE),
         )?;
 
         Ok(Some((user_id, password_file)))
       }
       Ok(_) => {
         info!(
           "No item found for user {} in PAKE registration table",
           username
         );
         Ok(None)
       }
       Err(e) => {
         error!(
           "DynamoDB client failed to get registration data for user {}: {}",
           username, e
         );
         Err(e)
       }
     }
   }
 
   pub async fn get_item_from_users_table(
     &self,
     user_id: &str,
   ) -> Result<GetItemOutput, Error> {
     let primary_key = create_simple_primary_key((
       USERS_TABLE_PARTITION_KEY.to_string(),
       user_id.to_string(),
     ));
     self
       .client
       .get_item()
       .table_name(USERS_TABLE)
       .set_key(Some(primary_key))
       .consistent_read(true)
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))
   }
 
   async fn get_all_usernames(&self) -> Result<Vec<String>, Error> {
     let scan_output = self
       .client
       .scan()
       .table_name(USERS_TABLE)
       .projection_expression(USERS_TABLE_USERNAME_ATTRIBUTE)
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))?;
 
     let mut result = Vec::new();
     if let Some(attributes) = scan_output.items {
       for mut attribute in attributes {
         if let Ok(username) = parse_string_attribute(
           USERS_TABLE_USERNAME_ATTRIBUTE,
           attribute.remove(USERS_TABLE_USERNAME_ATTRIBUTE),
         ) {
           result.push(username);
         }
       }
     }
     Ok(result)
   }
 
   pub async fn add_nonce_to_nonces_table(
     &self,
     nonce_data: NonceData,
   ) -> Result<PutItemOutput, Error> {
     let item = HashMap::from([
       (
         NONCE_TABLE_PARTITION_KEY.to_string(),
         AttributeValue::S(nonce_data.nonce),
       ),
       (
         NONCE_TABLE_CREATED_ATTRIBUTE.to_string(),
         AttributeValue::S(nonce_data.created.to_rfc3339()),
       ),
       (
         NONCE_TABLE_EXPIRATION_TIME_ATTRIBUTE.to_string(),
         AttributeValue::S(nonce_data.expiration_time.to_rfc3339()),
       ),
       (
         NONCE_TABLE_EXPIRATION_TIME_UNIX_ATTRIBUTE.to_string(),
         AttributeValue::N(nonce_data.expiration_time.timestamp().to_string()),
       ),
     ]);
     self
       .client
       .put_item()
       .table_name(NONCE_TABLE)
       .set_item(Some(item))
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))
   }
 
   pub async fn get_nonce_from_nonces_table(
     &self,
     nonce_value: impl Into<String>,
   ) -> Result<Option<NonceData>, Error> {
     let get_response = self
       .client
       .get_item()
       .table_name(NONCE_TABLE)
       .key(
         NONCE_TABLE_PARTITION_KEY,
         AttributeValue::S(nonce_value.into()),
       )
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))?;
 
     let Some(mut item) = get_response.item else {
       return Ok(None);
     };
 
     let nonce = parse_string_attribute(
       NONCE_TABLE_PARTITION_KEY,
       item.remove(&NONCE_TABLE_PARTITION_KEY.to_string()),
     )?;
 
     let created = parse_date_time_attribute(
       NONCE_TABLE_CREATED_ATTRIBUTE,
       item.remove(&NONCE_TABLE_CREATED_ATTRIBUTE.to_string()),
     )?;
 
     let expiration_time = parse_date_time_attribute(
       NONCE_TABLE_EXPIRATION_TIME_ATTRIBUTE,
       item.remove(&NONCE_TABLE_EXPIRATION_TIME_ATTRIBUTE.to_string()),
     )?;
 
     Ok(Some(NonceData {
       nonce,
       created,
       expiration_time,
     }))
   }
 
   pub async fn remove_nonce_from_nonces_table(
     &self,
     nonce: impl Into<String>,
   ) -> Result<(), Error> {
     self
       .client
       .delete_item()
       .table_name(NONCE_TABLE)
       .key(NONCE_TABLE_PARTITION_KEY, AttributeValue::S(nonce.into()))
       .send()
       .await
       .map_err(|e| Error::AwsSdk(e.into()))?;
 
     Ok(())
   }
 
   pub async fn add_usernames_to_reserved_usernames_table(
     &self,
     usernames: Vec<String>,
   ) -> Result<(), Error> {
     // A single call to BatchWriteItem can consist of up to 25 operations
     for usernames_chunk in usernames.chunks(25) {
       let write_requests = usernames_chunk
         .iter()
         .map(|username| {
           let put_request = PutRequest::builder()
             .item(
               RESERVED_USERNAMES_TABLE_PARTITION_KEY,
               AttributeValue::S(username.to_string()),
             )
             .build();
 
           WriteRequest::builder().put_request(put_request).build()
         })
         .collect();
 
       self
         .client
         .batch_write_item()
         .request_items(RESERVED_USERNAMES_TABLE, write_requests)
         .send()
         .await
         .map_err(|e| Error::AwsSdk(e.into()))?;
     }
 
     info!("Batch write item to reserved usernames table succeeded");
 
     Ok(())
   }
 
   pub async fn delete_username_from_reserved_usernames_table(
     &self,
     username: String,
   ) -> Result<DeleteItemOutput, Error> {
     debug!(
       "Attempting to delete username {} from reserved usernames table",
       username
     );
 
     match self
       .client
       .delete_item()
       .table_name(RESERVED_USERNAMES_TABLE)
       .key(
         RESERVED_USERNAMES_TABLE_PARTITION_KEY,
         AttributeValue::S(username.clone()),
       )
       .send()
       .await
     {
       Ok(out) => {
         info!(
           "Username {} has been deleted from reserved usernames table",
           username
         );
         Ok(out)
       }
       Err(e) => {
         error!("DynamoDB client failed to delete username {} from reserved usernames table", username);
         Err(Error::AwsSdk(e.into()))
       }
     }
   }
 
   pub async fn username_in_reserved_usernames_table(
     &self,
     username: &str,
   ) -> Result<bool, Error> {
     match self
       .client
       .get_item()
       .table_name(RESERVED_USERNAMES_TABLE)
       .key(
         RESERVED_USERNAMES_TABLE_PARTITION_KEY.to_string(),
         AttributeValue::S(username.to_string()),
       )
       .consistent_read(true)
       .send()
       .await
     {
       Ok(GetItemOutput { item: Some(_), .. }) => Ok(true),
       Ok(_) => Ok(false),
       Err(e) => Err(Error::AwsSdk(e.into())),
     }
   }
 }
 
 type AttributeName = String;
 pub type DeviceKeys = HashMap<String, String>;
 type Devices = HashMap<String, DeviceKeys>;
 
 fn create_simple_primary_key(
   partition_key: (AttributeName, String),
 ) -> HashMap<AttributeName, AttributeValue> {
   HashMap::from([(partition_key.0, AttributeValue::S(partition_key.1))])
 }
 
 fn create_composite_primary_key(
   partition_key: (AttributeName, String),
   sort_key: (AttributeName, String),
 ) -> HashMap<AttributeName, AttributeValue> {
   let mut primary_key = create_simple_primary_key(partition_key);
   primary_key.insert(sort_key.0, AttributeValue::S(sort_key.1));
   primary_key
 }
 
 fn parse_date_time_attribute(
   attribute_name: &str,
   attribute: Option<AttributeValue>,
 ) -> Result<DateTime<Utc>, DBItemError> {
   if let Some(AttributeValue::S(created)) = &attribute {
     created.parse().map_err(|e| {
       DBItemError::new(
         attribute_name.to_string(),
         attribute,
         DBItemAttributeError::InvalidTimestamp(e),
       )
     })
   } else {
     Err(DBItemError::new(
       attribute_name.to_string(),
       attribute,
       DBItemAttributeError::Missing,
     ))
   }
 }
 
 fn parse_auth_type_attribute(
   attribute: Option<AttributeValue>,
 ) -> Result<AuthType, DBItemError> {
   if let Some(AttributeValue::S(auth_type)) = &attribute {
     match auth_type.as_str() {
       "password" => Ok(AuthType::Password),
       "wallet" => Ok(AuthType::Wallet),
       _ => Err(DBItemError::new(
         ACCESS_TOKEN_TABLE_AUTH_TYPE_ATTRIBUTE.to_string(),
         attribute,
         DBItemAttributeError::IncorrectType,
       )),
     }
   } else {
     Err(DBItemError::new(
       ACCESS_TOKEN_TABLE_AUTH_TYPE_ATTRIBUTE.to_string(),
       attribute,
       DBItemAttributeError::Missing,
     ))
   }
 }
 
 fn parse_valid_attribute(
   attribute: Option<AttributeValue>,
 ) -> Result<bool, DBItemError> {
   match attribute {
     Some(AttributeValue::Bool(valid)) => Ok(valid),
     Some(_) => Err(DBItemError::new(
       ACCESS_TOKEN_TABLE_VALID_ATTRIBUTE.to_string(),
       attribute,
       DBItemAttributeError::IncorrectType,
     )),
     None => Err(DBItemError::new(
       ACCESS_TOKEN_TABLE_VALID_ATTRIBUTE.to_string(),
       attribute,
       DBItemAttributeError::Missing,
     )),
   }
 }
 
 fn parse_token_attribute(
   attribute: Option<AttributeValue>,
 ) -> Result<String, DBItemError> {
   match attribute {
     Some(AttributeValue::S(token)) => Ok(token),
     Some(_) => Err(DBItemError::new(
       ACCESS_TOKEN_TABLE_TOKEN_ATTRIBUTE.to_string(),
       attribute,
       DBItemAttributeError::IncorrectType,
     )),
     None => Err(DBItemError::new(
       ACCESS_TOKEN_TABLE_TOKEN_ATTRIBUTE.to_string(),
       attribute,
       DBItemAttributeError::Missing,
     )),
   }
 }
 
 fn parse_registration_data_attribute(
   attribute: Option<AttributeValue>,
 ) -> Result<Vec<u8>, DBItemError> {
   match attribute {
     Some(AttributeValue::B(server_registration_bytes)) => {
       Ok(server_registration_bytes.into_inner())
     }
     Some(_) => Err(DBItemError::new(
       USERS_TABLE_REGISTRATION_ATTRIBUTE.to_string(),
       attribute,
       DBItemAttributeError::IncorrectType,
     )),
     None => Err(DBItemError::new(
       USERS_TABLE_REGISTRATION_ATTRIBUTE.to_string(),
       attribute,
       DBItemAttributeError::Missing,
     )),
   }
 }
 
 #[allow(dead_code)]
 fn parse_map_attribute(
   attribute_name: &str,
   attribute_value: Option<AttributeValue>,
 ) -> Result<HashMap<String, AttributeValue>, DBItemError> {
   match attribute_value {
     Some(AttributeValue::M(map)) => Ok(map),
     Some(_) => {
       error!(
           attribute = attribute_name,
           value = ?attribute_value,
           error_type = "IncorrectType",
           "Unexpected attribute type when parsing map attribute"
       );
       Err(DBItemError::new(
         attribute_name.to_string(),
         attribute_value,
         DBItemAttributeError::IncorrectType,
       ))
     }
     None => {
       error!(
         attribute = attribute_name,
         error_type = "Missing",
         "Attribute is missing"
       );
       Err(DBItemError::new(
         attribute_name.to_string(),
         attribute_value,
         DBItemAttributeError::Missing,
       ))
     }
   }
 }
 
 fn parse_string_attribute(
   attribute_name: &str,
   attribute_value: Option<AttributeValue>,
 ) -> Result<String, DBItemError> {
   match attribute_value {
     Some(AttributeValue::S(value)) => Ok(value),
     Some(_) => {
       error!(
           attribute = attribute_name,
           value = ?attribute_value,
           error_type = "IncorrectType",
           "Unexpected attribute type when parsing string attribute"
       );
       Err(DBItemError::new(
         attribute_name.to_string(),
         attribute_value,
         DBItemAttributeError::IncorrectType,
       ))
     }
     None => {
       error!(
         attribute = attribute_name,
         error_type = "Missing",
         "Attribute is missing"
       );
       Err(DBItemError::new(
         attribute_name.to_string(),
         attribute_value,
         DBItemAttributeError::Missing,
       ))
     }
   }
 }
 
 fn create_device_info(
   flattened_device_key_upload: FlattenedDeviceKeyUpload,
   social_proof: Option<String>,
 ) -> HashMap<String, AttributeValue> {
   let mut device_info = HashMap::from([
     (
       USERS_TABLE_DEVICES_MAP_DEVICE_TYPE_ATTRIBUTE_NAME.to_string(),
       AttributeValue::S(flattened_device_key_upload.device_type.to_string()),
     ),
     (
       USERS_TABLE_DEVICES_MAP_KEY_PAYLOAD_ATTRIBUTE_NAME.to_string(),
       AttributeValue::S(flattened_device_key_upload.key_payload),
     ),
     (
       USERS_TABLE_DEVICES_MAP_KEY_PAYLOAD_SIGNATURE_ATTRIBUTE_NAME.to_string(),
       AttributeValue::S(flattened_device_key_upload.key_payload_signature),
     ),
     (
       USERS_TABLE_DEVICES_MAP_CONTENT_PREKEY_ATTRIBUTE_NAME.to_string(),
       AttributeValue::S(flattened_device_key_upload.content_prekey),
     ),
     (
       USERS_TABLE_DEVICES_MAP_CONTENT_PREKEY_SIGNATURE_ATTRIBUTE_NAME
         .to_string(),
       AttributeValue::S(flattened_device_key_upload.content_prekey_signature),
     ),
     (
       USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_ATTRIBUTE_NAME.to_string(),
       AttributeValue::S(flattened_device_key_upload.notif_prekey),
     ),
     (
       USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_SIGNATURE_ATTRIBUTE_NAME.to_string(),
       AttributeValue::S(flattened_device_key_upload.notif_prekey_signature),
     ),
   ]);
 
   if let Some(social_proof) = social_proof {
     device_info.insert(
       USERS_TABLE_DEVICES_MAP_SOCIAL_PROOF_ATTRIBUTE_NAME.to_string(),
       AttributeValue::S(social_proof),
     );
   }
 
   device_info
 }
 
 #[cfg(test)]
 mod tests {
   use super::*;
 
   #[test]
   fn test_create_simple_primary_key() {
     let partition_key_name = "userID".to_string();
     let partition_key_value = "12345".to_string();
     let partition_key =
       (partition_key_name.clone(), partition_key_value.clone());
     let mut primary_key = create_simple_primary_key(partition_key);
     assert_eq!(primary_key.len(), 1);
     let attribute = primary_key.remove(&partition_key_name);
     assert!(attribute.is_some());
     assert_eq!(attribute, Some(AttributeValue::S(partition_key_value)));
   }
 
   #[test]
   fn test_create_composite_primary_key() {
     let partition_key_name = "userID".to_string();
     let partition_key_value = "12345".to_string();
     let partition_key =
       (partition_key_name.clone(), partition_key_value.clone());
     let sort_key_name = "deviceID".to_string();
     let sort_key_value = "54321".to_string();
     let sort_key = (sort_key_name.clone(), sort_key_value.clone());
     let mut primary_key = create_composite_primary_key(partition_key, sort_key);
     assert_eq!(primary_key.len(), 2);
     let partition_key_attribute = primary_key.remove(&partition_key_name);
     assert!(partition_key_attribute.is_some());
     assert_eq!(
       partition_key_attribute,
       Some(AttributeValue::S(partition_key_value))
     );
     let sort_key_attribute = primary_key.remove(&sort_key_name);
     assert!(sort_key_attribute.is_some());
     assert_eq!(sort_key_attribute, Some(AttributeValue::S(sort_key_value)))
   }
 
   #[test]
   fn validate_keys() {
     // Taken from test user
     let example_payload = r#"{\"notificationIdentityPublicKeys\":{\"curve25519\":\"DYmV8VdkjwG/VtC8C53morogNJhpTPT/4jzW0/cxzQo\",\"ed25519\":\"D0BV2Y7Qm36VUtjwyQTJJWYAycN7aMSJmhEsRJpW2mk\"},\"primaryIdentityPublicKeys\":{\"curve25519\":\"Y4ZIqzpE1nv83kKGfvFP6rifya0itRg2hifqYtsISnk\",\"ed25519\":\"cSlL+VLLJDgtKSPlIwoCZg0h0EmHlQoJC08uV/O+jvg\"}}"#;
     let serialized_payload = KeyPayload::from_str(&example_payload).unwrap();
 
     assert_eq!(
       serialized_payload
         .notification_identity_public_keys
         .curve25519,
       "DYmV8VdkjwG/VtC8C53morogNJhpTPT/4jzW0/cxzQo"
     );
   }
 
   #[test]
   fn test_int_to_device_type() {
     let valid_result = DeviceType::try_from(3);
     assert!(valid_result.is_ok());
     assert_eq!(valid_result.unwrap(), DeviceType::Android);
 
     let invalid_result = DeviceType::try_from(6);
     assert!(invalid_result.is_err());
   }
 }
diff --git a/services/identity/src/grpc_services/authenticated.rs b/services/identity/src/grpc_services/authenticated.rs
index 21bcf54f7..81a7bab95 100644
--- a/services/identity/src/grpc_services/authenticated.rs
+++ b/services/identity/src/grpc_services/authenticated.rs
@@ -1,407 +1,379 @@
 use std::collections::HashMap;
 
 use crate::config::CONFIG;
 use crate::grpc_utils::DeviceInfoWithAuth;
 use crate::{
   client_service::{
     handle_db_error, CacheExt, UpdateState, WorkflowInProgress,
   },
   constants::request_metadata,
   database::DatabaseClient,
   grpc_services::shared::get_value,
   token::AuthType,
 };
 use comm_opaque2::grpc::protocol_error_to_grpc_status;
 use moka::future::Cache;
 use tonic::{Request, Response, Status};
 
 // This must be named client, because generated code from the authenticated
 // protobuf file references message structs from the client protobuf file
 // with the client:: namespace
 use crate::client_service::client_proto as client;
 
 pub mod auth_proto {
   tonic::include_proto!("identity.authenticated");
 }
 use auth_proto::{
   find_user_id_request, identity_client_service_server::IdentityClientService,
   FindUserIdRequest, FindUserIdResponse, KeyserverKeysResponse,
   OutboundKeyInfo, OutboundKeysForUserRequest, RefreshUserPreKeysRequest,
   UploadOneTimeKeysRequest,
 };
 use client::{Empty, IdentityKeyInfo};
 use tracing::{debug, error};
 
 #[derive(derive_more::Constructor)]
 pub struct AuthenticatedService {
   db_client: DatabaseClient,
   cache: Cache<String, WorkflowInProgress>,
 }
 
 fn get_auth_info(req: &Request<()>) -> Option<(String, String, String)> {
   debug!("Retrieving auth info for request: {:?}", req);
 
   let user_id = get_value(req, request_metadata::USER_ID)?;
   let device_id = get_value(req, request_metadata::DEVICE_ID)?;
   let access_token = get_value(req, request_metadata::ACCESS_TOKEN)?;
 
   Some((user_id, device_id, access_token))
 }
 
 pub fn auth_interceptor(
   req: Request<()>,
   db_client: &DatabaseClient,
 ) -> Result<Request<()>, Status> {
   debug!("Intercepting request to check auth info: {:?}", req);
 
   let (user_id, device_id, access_token) = get_auth_info(&req)
     .ok_or_else(|| Status::unauthenticated("Missing credentials"))?;
 
   let handle = tokio::runtime::Handle::current();
   let new_db_client = db_client.clone();
 
   // This function cannot be `async`, yet must call the async db call
   // Force tokio to resolve future in current thread without an explicit .await
   let valid_token = tokio::task::block_in_place(move || {
     handle
       .block_on(new_db_client.verify_access_token(
         user_id,
         device_id,
         access_token,
       ))
       .map_err(handle_db_error)
   })?;
 
   if !valid_token {
     return Err(Status::aborted("Bad Credentials"));
   }
 
   Ok(req)
 }
 
 pub fn get_user_and_device_id<T>(
   request: &Request<T>,
 ) -> Result<(String, String), Status> {
   let user_id = get_value(request, request_metadata::USER_ID)
     .ok_or_else(|| Status::unauthenticated("Missing user_id field"))?;
   let device_id = get_value(request, request_metadata::DEVICE_ID)
     .ok_or_else(|| Status::unauthenticated("Missing device_id field"))?;
 
   Ok((user_id, device_id))
 }
 
 #[tonic::async_trait]
 impl IdentityClientService for AuthenticatedService {
   async fn refresh_user_pre_keys(
     &self,
     request: Request<RefreshUserPreKeysRequest>,
   ) -> Result<Response<Empty>, Status> {
     let (user_id, device_id) = get_user_and_device_id(&request)?;
     let message = request.into_inner();
 
     debug!("Refreshing prekeys for user: {}", user_id);
 
     let content_keys = message
       .new_content_pre_keys
       .ok_or_else(|| Status::invalid_argument("Missing content keys"))?;
     let notif_keys = message
       .new_notif_pre_keys
       .ok_or_else(|| Status::invalid_argument("Missing notification keys"))?;
 
     self
       .db_client
       .set_prekey(
         user_id,
         device_id,
         content_keys.pre_key,
         content_keys.pre_key_signature,
         notif_keys.pre_key,
         notif_keys.pre_key_signature,
       )
       .await
       .map_err(handle_db_error)?;
 
     let response = Response::new(Empty {});
     Ok(response)
   }
 
   async fn get_outbound_keys_for_user(
     &self,
-    request: tonic::Request<client::OutboundKeysForUserRequest>,
+    request: tonic::Request<auth_proto::OutboundKeysForUserRequest>,
   ) -> Result<tonic::Response<client::OutboundKeysForUserResponse>, tonic::Status>
   {
     let message = request.into_inner();
 
-    use client::outbound_keys_for_user_request::Identifier;
-    let (user_ident, auth_type) = match message.identifier {
-      None => {
-        return Err(tonic::Status::invalid_argument("no identifier provided"))
-      }
-      Some(Identifier::Username(username)) => (username, AuthType::Password),
-      Some(Identifier::WalletAddress(address)) => (address, AuthType::Wallet),
-    };
-
     let devices_map = self
       .db_client
-      .get_keys_for_user(user_ident, &auth_type, true)
+      .get_keys_for_user_id(&message.user_id, true)
       .await
       .map_err(handle_db_error)?
-      .ok_or_else(|| match auth_type {
-        AuthType::Password => tonic::Status::not_found("username not found"),
-        AuthType::Wallet => {
-          tonic::Status::not_found("wallet address not found")
-        }
-      })?;
+      .ok_or_else(|| tonic::Status::not_found("user not found"))?;
 
     let transformed_devices = devices_map
       .into_iter()
       .filter_map(|(key, device_info)| {
         let device_info_with_auth = DeviceInfoWithAuth {
           device_info,
-          auth_type: &auth_type,
+          auth_type: None,
         };
         match client::OutboundKeyInfo::try_from(device_info_with_auth) {
           Ok(key_info) => Some((key, key_info)),
           Err(_) => {
             error!("Failed to transform device info for key {}", key);
             None
           }
         }
       })
       .collect::<HashMap<_, _>>();
 
     Ok(tonic::Response::new(client::OutboundKeysForUserResponse {
       devices: transformed_devices,
     }))
   }
 
   async fn get_inbound_keys_for_user(
     &self,
-    request: tonic::Request<client::InboundKeysForUserRequest>,
+    request: tonic::Request<auth_proto::InboundKeysForUserRequest>,
   ) -> Result<tonic::Response<client::InboundKeysForUserResponse>, tonic::Status>
   {
     let message = request.into_inner();
 
-    use client::inbound_keys_for_user_request::Identifier;
-    let (user_ident, auth_type) = match message.identifier {
-      None => {
-        return Err(tonic::Status::invalid_argument("no identifier provided"))
-      }
-      Some(Identifier::Username(username)) => (username, AuthType::Password),
-      Some(Identifier::WalletAddress(address)) => (address, AuthType::Wallet),
-    };
-
     let devices_map = self
       .db_client
-      .get_keys_for_user(user_ident, &auth_type, false)
+      .get_keys_for_user_id(&message.user_id, false)
       .await
       .map_err(handle_db_error)?
-      .ok_or_else(|| match auth_type {
-        AuthType::Password => tonic::Status::not_found("username not found"),
-        AuthType::Wallet => {
-          tonic::Status::not_found("wallet address not found")
-        }
-      })?;
+      .ok_or_else(|| tonic::Status::not_found("user not found"))?;
 
     let transformed_devices = devices_map
       .into_iter()
       .filter_map(|(key, device_info)| {
         let device_info_with_auth = DeviceInfoWithAuth {
           device_info,
-          auth_type: &auth_type,
+          auth_type: None,
         };
         match client::InboundKeyInfo::try_from(device_info_with_auth) {
           Ok(key_info) => Some((key, key_info)),
           Err(_) => {
             error!("Failed to transform device info for key {}", key);
             None
           }
         }
       })
       .collect::<HashMap<_, _>>();
 
     Ok(tonic::Response::new(client::InboundKeysForUserResponse {
       devices: transformed_devices,
     }))
   }
 
   async fn get_keyserver_keys(
     &self,
     request: Request<OutboundKeysForUserRequest>,
   ) -> Result<Response<KeyserverKeysResponse>, Status> {
     let message = request.into_inner();
 
     let inner_response = self
       .db_client
       .get_keyserver_keys_for_user(&message.user_id)
       .await
       .map_err(handle_db_error)?
       .map(|db_keys| OutboundKeyInfo {
         identity_info: Some(IdentityKeyInfo {
           payload: db_keys.key_payload,
           payload_signature: db_keys.key_payload_signature,
           social_proof: db_keys.social_proof,
         }),
         content_prekey: Some(client::PreKey {
           pre_key: db_keys.content_prekey.prekey,
           pre_key_signature: db_keys.content_prekey.prekey_signature,
         }),
         notif_prekey: Some(client::PreKey {
           pre_key: db_keys.notif_prekey.prekey,
           pre_key_signature: db_keys.notif_prekey.prekey_signature,
         }),
         one_time_content_prekey: db_keys.content_one_time_key,
         one_time_notif_prekey: db_keys.notif_one_time_key,
       });
 
     let response = Response::new(KeyserverKeysResponse {
       keyserver_info: inner_response,
     });
 
     return Ok(response);
   }
 
   async fn upload_one_time_keys(
     &self,
     request: tonic::Request<UploadOneTimeKeysRequest>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let (user_id, device_id) = get_user_and_device_id(&request)?;
     let message = request.into_inner();
 
     debug!("Attempting to update one time keys for user: {}", user_id);
     self
       .db_client
       .append_one_time_prekeys(
         device_id,
         message.content_one_time_pre_keys,
         message.notif_one_time_pre_keys,
       )
       .await
       .map_err(handle_db_error)?;
 
     Ok(tonic::Response::new(Empty {}))
   }
 
   async fn find_user_id(
     &self,
     request: tonic::Request<FindUserIdRequest>,
   ) -> Result<tonic::Response<FindUserIdResponse>, tonic::Status> {
     let message = request.into_inner();
 
     use find_user_id_request::Identifier;
     let (user_ident, auth_type) = match message.identifier {
       None => {
         return Err(tonic::Status::invalid_argument("no identifier provided"))
       }
       Some(Identifier::Username(username)) => (username, AuthType::Password),
       Some(Identifier::WalletAddress(address)) => (address, AuthType::Wallet),
     };
 
     let user_id = self
       .db_client
       .get_user_id_from_user_info(user_ident, &auth_type)
       .await
       .map_err(handle_db_error)?;
 
     Ok(Response::new(FindUserIdResponse { user_id }))
   }
 
   async fn update_user_password_start(
     &self,
     request: tonic::Request<auth_proto::UpdateUserPasswordStartRequest>,
   ) -> Result<
     tonic::Response<auth_proto::UpdateUserPasswordStartResponse>,
     tonic::Status,
   > {
     let (user_id, _) = get_user_and_device_id(&request)?;
     let message = request.into_inner();
 
     let server_registration = comm_opaque2::server::Registration::new();
     let server_message = server_registration
       .start(
         &CONFIG.server_setup,
         &message.opaque_registration_request,
         user_id.as_bytes(),
       )
       .map_err(protocol_error_to_grpc_status)?;
 
     let update_state = UpdateState { user_id };
     let session_id = self
       .cache
       .insert_with_uuid_key(WorkflowInProgress::Update(update_state))
       .await;
 
     let response = auth_proto::UpdateUserPasswordStartResponse {
       session_id,
       opaque_registration_response: server_message,
     };
     Ok(Response::new(response))
   }
 
   async fn update_user_password_finish(
     &self,
     request: tonic::Request<auth_proto::UpdateUserPasswordFinishRequest>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let message = request.into_inner();
 
     let Some(WorkflowInProgress::Update(state)) =
       self.cache.get(&message.session_id)
     else {
       return Err(tonic::Status::not_found("session not found"));
     };
 
     self.cache.invalidate(&message.session_id).await;
 
     let server_registration = comm_opaque2::server::Registration::new();
     let password_file = server_registration
       .finish(&message.opaque_registration_upload)
       .map_err(protocol_error_to_grpc_status)?;
 
     self
       .db_client
       .update_user_password(state.user_id, password_file)
       .await
       .map_err(handle_db_error)?;
 
     let response = Empty {};
     Ok(Response::new(response))
   }
 
   async fn log_out_user(
     &self,
     request: tonic::Request<Empty>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let (user_id, device_id) = get_user_and_device_id(&request)?;
 
     self
       .db_client
       .remove_device_from_users_table(user_id.clone(), device_id.clone())
       .await
       .map_err(handle_db_error)?;
 
     self
       .db_client
       .delete_access_token_data(user_id, device_id)
       .await
       .map_err(handle_db_error)?;
 
     let response = Empty {};
     Ok(Response::new(response))
   }
 
   async fn delete_user(
     &self,
     request: tonic::Request<Empty>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let (user_id, _) = get_user_and_device_id(&request)?;
 
     self
       .db_client
       .delete_user(user_id)
       .await
       .map_err(handle_db_error)?;
 
     let response = Empty {};
     Ok(Response::new(response))
   }
 }
diff --git a/services/identity/src/grpc_utils.rs b/services/identity/src/grpc_utils.rs
index 98b57eb61..f618001c1 100644
--- a/services/identity/src/grpc_utils.rs
+++ b/services/identity/src/grpc_utils.rs
@@ -1,256 +1,256 @@
 use std::collections::HashMap;
 
 use tonic::Status;
 use tracing::error;
 
 use crate::{
   client_service::client_proto::{
     DeviceKeyUpload, IdentityKeyInfo, InboundKeyInfo, OpaqueLoginStartRequest,
     OutboundKeyInfo, PreKey, RegistrationStartRequest,
     ReservedRegistrationStartRequest, ReservedWalletLoginRequest,
     WalletLoginRequest,
   },
   constants::{
     CONTENT_ONE_TIME_KEY, NOTIF_ONE_TIME_KEY,
     USERS_TABLE_DEVICES_MAP_CONTENT_PREKEY_ATTRIBUTE_NAME,
     USERS_TABLE_DEVICES_MAP_CONTENT_PREKEY_SIGNATURE_ATTRIBUTE_NAME,
     USERS_TABLE_DEVICES_MAP_KEY_PAYLOAD_ATTRIBUTE_NAME,
     USERS_TABLE_DEVICES_MAP_KEY_PAYLOAD_SIGNATURE_ATTRIBUTE_NAME,
     USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_ATTRIBUTE_NAME,
     USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_SIGNATURE_ATTRIBUTE_NAME,
     USERS_TABLE_DEVICES_MAP_SOCIAL_PROOF_ATTRIBUTE_NAME,
   },
   database::DeviceKeys,
   token::AuthType,
 };
 
 pub struct DeviceInfoWithAuth<'a> {
   pub device_info: HashMap<String, String>,
-  pub auth_type: &'a AuthType,
+  pub auth_type: Option<&'a AuthType>,
 }
 
 impl TryFrom<DeviceInfoWithAuth<'_>> for InboundKeyInfo {
   type Error = Status;
 
   fn try_from(data: DeviceInfoWithAuth) -> Result<Self, Self::Error> {
     let mut device_info = data.device_info;
 
     let identity_info =
       extract_identity_info(&mut device_info, data.auth_type)?;
 
     Ok(InboundKeyInfo {
       identity_info: Some(identity_info),
       content_prekey: Some(create_prekey(
         &mut device_info,
         USERS_TABLE_DEVICES_MAP_CONTENT_PREKEY_ATTRIBUTE_NAME,
         USERS_TABLE_DEVICES_MAP_CONTENT_PREKEY_SIGNATURE_ATTRIBUTE_NAME,
       )?),
       notif_prekey: Some(create_prekey(
         &mut device_info,
         USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_ATTRIBUTE_NAME,
         USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_SIGNATURE_ATTRIBUTE_NAME,
       )?),
     })
   }
 }
 
 impl TryFrom<DeviceInfoWithAuth<'_>> for OutboundKeyInfo {
   type Error = Status;
 
   fn try_from(data: DeviceInfoWithAuth) -> Result<Self, Self::Error> {
     let mut device_info = data.device_info;
 
     let identity_info =
       extract_identity_info(&mut device_info, data.auth_type)?;
 
     let content_one_time_key = device_info.remove(CONTENT_ONE_TIME_KEY);
     let notif_one_time_key = device_info.remove(NOTIF_ONE_TIME_KEY);
 
     Ok(OutboundKeyInfo {
       identity_info: Some(identity_info),
       content_prekey: Some(create_prekey(
         &mut device_info,
         USERS_TABLE_DEVICES_MAP_CONTENT_PREKEY_ATTRIBUTE_NAME,
         USERS_TABLE_DEVICES_MAP_CONTENT_PREKEY_SIGNATURE_ATTRIBUTE_NAME,
       )?),
       notif_prekey: Some(create_prekey(
         &mut device_info,
         USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_ATTRIBUTE_NAME,
         USERS_TABLE_DEVICES_MAP_NOTIF_PREKEY_SIGNATURE_ATTRIBUTE_NAME,
       )?),
       one_time_content_prekey: content_one_time_key,
       one_time_notif_prekey: notif_one_time_key,
     })
   }
 }
 
 fn extract_key(
   device_info: &mut DeviceKeys,
   key: &str,
 ) -> Result<String, Status> {
   device_info.remove(key).ok_or_else(|| {
     error!("{} missing from device info", key);
     Status::failed_precondition("Database item malformed")
   })
 }
 
 fn extract_identity_info(
   device_info: &mut HashMap<String, String>,
-  auth_type: &AuthType,
+  auth_type: Option<&AuthType>,
 ) -> Result<IdentityKeyInfo, Status> {
   let payload = extract_key(
     device_info,
     USERS_TABLE_DEVICES_MAP_KEY_PAYLOAD_ATTRIBUTE_NAME,
   )?;
   let payload_signature = extract_key(
     device_info,
     USERS_TABLE_DEVICES_MAP_KEY_PAYLOAD_SIGNATURE_ATTRIBUTE_NAME,
   )?;
   let social_proof =
     device_info.remove(USERS_TABLE_DEVICES_MAP_SOCIAL_PROOF_ATTRIBUTE_NAME);
-  if social_proof.is_none() && auth_type == &AuthType::Wallet {
+  if social_proof.is_none() && auth_type == Some(&AuthType::Wallet) {
     error!("Social proof missing for wallet user");
     return Err(Status::failed_precondition("Database item malformed"));
   }
 
   Ok(IdentityKeyInfo {
     payload,
     payload_signature,
     social_proof,
   })
 }
 
 fn create_prekey(
   device_info: &mut HashMap<String, String>,
   key_attr: &str,
   signature_attr: &str,
 ) -> Result<PreKey, Status> {
   Ok(PreKey {
     pre_key: extract_key(device_info, key_attr)?,
     pre_key_signature: extract_key(device_info, signature_attr)?,
   })
 }
 
 pub trait DeviceKeyUploadData {
   fn device_key_upload(&self) -> Option<&DeviceKeyUpload>;
 }
 
 impl DeviceKeyUploadData for RegistrationStartRequest {
   fn device_key_upload(&self) -> Option<&DeviceKeyUpload> {
     self.device_key_upload.as_ref()
   }
 }
 
 impl DeviceKeyUploadData for ReservedRegistrationStartRequest {
   fn device_key_upload(&self) -> Option<&DeviceKeyUpload> {
     self.device_key_upload.as_ref()
   }
 }
 
 impl DeviceKeyUploadData for OpaqueLoginStartRequest {
   fn device_key_upload(&self) -> Option<&DeviceKeyUpload> {
     self.device_key_upload.as_ref()
   }
 }
 
 impl DeviceKeyUploadData for WalletLoginRequest {
   fn device_key_upload(&self) -> Option<&DeviceKeyUpload> {
     self.device_key_upload.as_ref()
   }
 }
 
 impl DeviceKeyUploadData for ReservedWalletLoginRequest {
   fn device_key_upload(&self) -> Option<&DeviceKeyUpload> {
     self.device_key_upload.as_ref()
   }
 }
 
 pub trait DeviceKeyUploadActions {
   fn payload(&self) -> Result<String, Status>;
   fn payload_signature(&self) -> Result<String, Status>;
   fn content_prekey(&self) -> Result<String, Status>;
   fn content_prekey_signature(&self) -> Result<String, Status>;
   fn notif_prekey(&self) -> Result<String, Status>;
   fn notif_prekey_signature(&self) -> Result<String, Status>;
   fn one_time_content_prekeys(&self) -> Result<Vec<String>, Status>;
   fn one_time_notif_prekeys(&self) -> Result<Vec<String>, Status>;
   fn device_type(&self) -> Result<i32, Status>;
   fn social_proof(&self) -> Result<Option<String>, Status>;
 }
 
 impl<T: DeviceKeyUploadData> DeviceKeyUploadActions for T {
   fn payload(&self) -> Result<String, Status> {
     self
       .device_key_upload()
       .and_then(|upload| upload.device_key_info.as_ref())
       .map(|info| info.payload.clone())
       .ok_or_else(|| Status::invalid_argument("unexpected message data"))
   }
 
   fn payload_signature(&self) -> Result<String, Status> {
     self
       .device_key_upload()
       .and_then(|upload| upload.device_key_info.as_ref())
       .map(|info| info.payload_signature.clone())
       .ok_or_else(|| Status::invalid_argument("unexpected message data"))
   }
 
   fn content_prekey(&self) -> Result<String, Status> {
     self
       .device_key_upload()
       .and_then(|upload| upload.content_upload.as_ref())
       .map(|prekey| prekey.pre_key.clone())
       .ok_or_else(|| Status::invalid_argument("unexpected message data"))
   }
 
   fn content_prekey_signature(&self) -> Result<String, Status> {
     self
       .device_key_upload()
       .and_then(|upload| upload.content_upload.as_ref())
       .map(|prekey| prekey.pre_key_signature.clone())
       .ok_or_else(|| Status::invalid_argument("unexpected message data"))
   }
 
   fn notif_prekey(&self) -> Result<String, Status> {
     self
       .device_key_upload()
       .and_then(|upload| upload.notif_upload.as_ref())
       .map(|prekey| prekey.pre_key.clone())
       .ok_or_else(|| Status::invalid_argument("unexpected message data"))
   }
 
   fn notif_prekey_signature(&self) -> Result<String, Status> {
     self
       .device_key_upload()
       .and_then(|upload| upload.notif_upload.as_ref())
       .map(|prekey| prekey.pre_key_signature.clone())
       .ok_or_else(|| Status::invalid_argument("unexpected message data"))
   }
 
   fn one_time_content_prekeys(&self) -> Result<Vec<String>, Status> {
     self
       .device_key_upload()
       .map(|upload| upload.one_time_content_prekeys.clone())
       .ok_or_else(|| Status::invalid_argument("unexpected message data"))
   }
 
   fn one_time_notif_prekeys(&self) -> Result<Vec<String>, Status> {
     self
       .device_key_upload()
       .map(|upload| upload.one_time_notif_prekeys.clone())
       .ok_or_else(|| Status::invalid_argument("unexpected message data"))
   }
   fn device_type(&self) -> Result<i32, Status> {
     self
       .device_key_upload()
       .map(|upload| upload.device_type)
       .ok_or_else(|| Status::invalid_argument("unexpected message data"))
   }
   fn social_proof(&self) -> Result<Option<String>, Status> {
     self
       .device_key_upload()
       .and_then(|upload| upload.device_key_info.as_ref())
       .map(|info| info.social_proof.clone())
       .ok_or_else(|| Status::invalid_argument("unexpected message data"))
   }
 }
diff --git a/shared/protos/identity_authenticated.proto b/shared/protos/identity_authenticated.proto
index cf55e9774..449ee3895 100644
--- a/shared/protos/identity_authenticated.proto
+++ b/shared/protos/identity_authenticated.proto
@@ -1,130 +1,134 @@
 syntax = "proto3";
 
 import "identity_client.proto";
 
 package identity.authenticated;
 
 // RPCs from a client (iOS, Android, or web) to identity service
 //
 // This service will assert authenticity of a device by verifying the access
 // token through an interceptor, thus avoiding the need to explicitly pass
 // the credentials on every request
 service IdentityClientService {
 
   // Replenish one-time preKeys
   rpc UploadOneTimeKeys(UploadOneTimeKeysRequest)
     returns (identity.client.Empty) {}
   // Rotate a device's preKey and preKey signature
   // Rotated for deniability of older messages
   rpc RefreshUserPreKeys(RefreshUserPreKeysRequest)
     returns (identity.client.Empty) {}
 
   // Called by clients to get all device keys associated with a user in order
   // to open a new channel of communication on any of their devices.
   // Specially, this will return the following per device:
   //   - Identity keys (both Content and Notif Keys)
   //   - PreKey (including preKey signature)
   //   - One-time PreKey
-  rpc GetOutboundKeysForUser(identity.client.OutboundKeysForUserRequest)
+  rpc GetOutboundKeysForUser(OutboundKeysForUserRequest)
     returns (identity.client.OutboundKeysForUserResponse) {}
   // Called by receivers of a communication request. The reponse will only
   // return identity keys (both content and notif keys) and related prekeys per
   // device, but will not contain one-time keys.
-  rpc GetInboundKeysForUser(identity.client.InboundKeysForUserRequest)
+  rpc GetInboundKeysForUser(InboundKeysForUserRequest)
     returns (identity.client.InboundKeysForUserResponse) {}
 
   // Called by user to update password and receive new access token
   rpc UpdateUserPasswordStart(UpdateUserPasswordStartRequest) returns
     (UpdateUserPasswordStartResponse) {}
   rpc UpdateUserPasswordFinish(UpdateUserPasswordFinishRequest) returns
     (identity.client.Empty) {}
 
   // Called by user to log out (clears device's keys and access token)
   rpc LogOutUser(identity.client.Empty) returns (identity.client.Empty) {}
   // Called by a user to delete their own account
   rpc DeleteUser(identity.client.Empty) returns (identity.client.Empty) {}
 
   // Called by clients to get required keys for opening a connection
   // to a user's keyserver
   rpc GetKeyserverKeys(OutboundKeysForUserRequest) returns
     (KeyserverKeysResponse) {}
 
   // Returns userID for given username or wallet address
   rpc FindUserID(FindUserIDRequest) returns (FindUserIDResponse) {}
 }
 
 // Helper types
 
 // UploadOneTimeKeys
 
 // As OPKs get exhausted, they need to be refreshed
 message UploadOneTimeKeysRequest {
   repeated string contentOneTimePreKeys = 1;
   repeated string notifOneTimePreKeys = 2;
 }
 
 
 // RefreshUserPreKeys
 
 message RefreshUserPreKeysRequest {
   identity.client.PreKey newContentPreKeys = 1;
   identity.client.PreKey newNotifPreKeys = 2;
 }
 
 // Information needed when establishing communication to someone else's device
 message OutboundKeyInfo {
   identity.client.IdentityKeyInfo identityInfo = 1;
   identity.client.PreKey contentPrekey = 2;
   identity.client.PreKey notifPrekey = 3;
   optional string oneTimeContentPrekey = 4;
   optional string oneTimeNotifPrekey = 5;
 }
 
 message KeyserverKeysResponse {
   optional OutboundKeyInfo keyserverInfo = 1;
 }
 
 // Information needed by a device to establish communcation when responding
 // to a request.
 // The device receiving a request only needs the content key and prekey.
 message OutboundKeysForUserRequest {
   string userID = 1;
 }
 
+message InboundKeysForUserRequest {
+  string userID = 1;
+}
+
 // FindUserID
 
 message FindUserIDRequest {
   oneof identifier {
     string username = 1;
     string walletAddress = 2;
   }
 }
 
 message FindUserIDResponse {
   // none if user not found
   optional string userID = 1;
 }
 
 // UpdateUserPassword
 
 // Request for updating a user, similar to registration but need a
 // access token to validate user before updating password
 message UpdateUserPasswordStartRequest {
   // Message sent to initiate PAKE registration (step 1)
   bytes opaqueRegistrationRequest = 1;
 }
 
 // Do a user registration, but overwrite the existing credentials
 // after validation of user
 message UpdateUserPasswordFinishRequest {
   // Identifier used to correlate start and finish request
   string sessionID = 1;
   // Opaque client registration upload (step 3)
   bytes opaqueRegistrationUpload = 2;
 }
 
 message UpdateUserPasswordStartResponse {
   // Identifier used to correlate start request with finish request
   string sessionID = 1;
   bytes opaqueRegistrationResponse = 2;
 }