diff --git a/services/identity/src/grpc_services/authenticated.rs b/services/identity/src/grpc_services/authenticated.rs
index ef1f4663f..767f6b889 100644
--- a/services/identity/src/grpc_services/authenticated.rs
+++ b/services/identity/src/grpc_services/authenticated.rs
@@ -1,651 +1,659 @@
 use std::collections::HashMap;
 
 use crate::config::CONFIG;
 use crate::database::DeviceListUpdate;
 use crate::device_list::SignedDeviceList;
 use crate::{
   client_service::{handle_db_error, UpdateState, WorkflowInProgress},
   constants::{error_types, request_metadata},
   database::DatabaseClient,
   ddb_utils::DateTimeExt,
   grpc_services::shared::get_value,
 };
 use chrono::{DateTime, Utc};
 use comm_opaque2::grpc::protocol_error_to_grpc_status;
 use tonic::{Request, Response, Status};
 use tracing::{debug, error, trace, warn};
 
 use super::protos::auth::{
   identity_client_service_server::IdentityClientService,
   DeletePasswordUserFinishRequest, DeletePasswordUserStartRequest,
   DeletePasswordUserStartResponse, GetDeviceListRequest, GetDeviceListResponse,
   InboundKeyInfo, InboundKeysForUserRequest, InboundKeysForUserResponse,
   KeyserverKeysResponse, LinkFarcasterAccountRequest, OutboundKeyInfo,
   OutboundKeysForUserRequest, OutboundKeysForUserResponse,
   PeersDeviceListsRequest, PeersDeviceListsResponse, RefreshUserPrekeysRequest,
   UpdateDeviceListRequest, UpdateUserPasswordFinishRequest,
   UpdateUserPasswordStartRequest, UpdateUserPasswordStartResponse,
   UploadOneTimeKeysRequest, UserIdentitiesRequest, UserIdentitiesResponse,
 };
 use super::protos::unauth::Empty;
 
 #[derive(derive_more::Constructor)]
 pub struct AuthenticatedService {
   db_client: DatabaseClient,
 }
 
 fn get_auth_info(req: &Request<()>) -> Option<(String, String, String)> {
   trace!("Retrieving auth info for request: {:?}", req);
 
   let user_id = get_value(req, request_metadata::USER_ID)?;
   let device_id = get_value(req, request_metadata::DEVICE_ID)?;
   let access_token = get_value(req, request_metadata::ACCESS_TOKEN)?;
 
   Some((user_id, device_id, access_token))
 }
 
 pub fn auth_interceptor(
   req: Request<()>,
   db_client: &DatabaseClient,
 ) -> Result<Request<()>, Status> {
   trace!("Intercepting request to check auth info: {:?}", req);
 
   let (user_id, device_id, access_token) = get_auth_info(&req)
     .ok_or_else(|| Status::unauthenticated("Missing credentials"))?;
 
   let handle = tokio::runtime::Handle::current();
   let new_db_client = db_client.clone();
 
   // This function cannot be `async`, yet must call the async db call
   // Force tokio to resolve future in current thread without an explicit .await
   let valid_token = tokio::task::block_in_place(move || {
     handle
       .block_on(new_db_client.verify_access_token(
         user_id,
         device_id,
         access_token,
       ))
       .map_err(handle_db_error)
   })?;
 
   if !valid_token {
     return Err(Status::aborted("Bad Credentials"));
   }
 
   Ok(req)
 }
 
 pub fn get_user_and_device_id<T>(
   request: &Request<T>,
 ) -> Result<(String, String), Status> {
   let user_id = get_value(request, request_metadata::USER_ID)
     .ok_or_else(|| Status::unauthenticated("Missing user_id field"))?;
   let device_id = get_value(request, request_metadata::DEVICE_ID)
     .ok_or_else(|| Status::unauthenticated("Missing device_id field"))?;
 
   Ok((user_id, device_id))
 }
 
 #[tonic::async_trait]
 impl IdentityClientService for AuthenticatedService {
   #[tracing::instrument(skip_all)]
   async fn refresh_user_prekeys(
     &self,
     request: Request<RefreshUserPrekeysRequest>,
   ) -> Result<Response<Empty>, Status> {
     let (user_id, device_id) = get_user_and_device_id(&request)?;
     let message = request.into_inner();
 
     debug!("Refreshing prekeys for user: {}", user_id);
 
     let content_keys = message
       .new_content_prekeys
       .ok_or_else(|| Status::invalid_argument("Missing content keys"))?;
     let notif_keys = message
       .new_notif_prekeys
       .ok_or_else(|| Status::invalid_argument("Missing notification keys"))?;
 
     self
       .db_client
       .update_device_prekeys(
         user_id,
         device_id,
         content_keys.into(),
         notif_keys.into(),
       )
       .await
       .map_err(handle_db_error)?;
 
     let response = Response::new(Empty {});
     Ok(response)
   }
 
   #[tracing::instrument(skip_all)]
   async fn get_outbound_keys_for_user(
     &self,
     request: tonic::Request<OutboundKeysForUserRequest>,
   ) -> Result<tonic::Response<OutboundKeysForUserResponse>, tonic::Status> {
     let message = request.into_inner();
     let user_id = &message.user_id;
 
     let devices_map = self
       .db_client
       .get_keys_for_user(user_id, true)
       .await
       .map_err(handle_db_error)?
       .ok_or_else(|| tonic::Status::not_found("user not found"))?;
 
     let transformed_devices = devices_map
       .into_iter()
       .map(|(key, device_info)| (key, OutboundKeyInfo::from(device_info)))
       .collect::<HashMap<_, _>>();
 
     Ok(tonic::Response::new(OutboundKeysForUserResponse {
       devices: transformed_devices,
     }))
   }
 
   #[tracing::instrument(skip_all)]
   async fn get_inbound_keys_for_user(
     &self,
     request: tonic::Request<InboundKeysForUserRequest>,
   ) -> Result<tonic::Response<InboundKeysForUserResponse>, tonic::Status> {
     let message = request.into_inner();
     let user_id = &message.user_id;
 
     let devices_map = self
       .db_client
       .get_keys_for_user(user_id, false)
       .await
       .map_err(handle_db_error)?
       .ok_or_else(|| tonic::Status::not_found("user not found"))?;
 
     let transformed_devices = devices_map
       .into_iter()
       .map(|(key, device_info)| (key, InboundKeyInfo::from(device_info)))
       .collect::<HashMap<_, _>>();
 
     let identifier = self
       .db_client
       .get_user_identity(user_id)
       .await
       .map_err(handle_db_error)?
       .ok_or_else(|| tonic::Status::not_found("user not found"))?;
 
     Ok(tonic::Response::new(InboundKeysForUserResponse {
       devices: transformed_devices,
       identity: Some(identifier.into()),
     }))
   }
 
   #[tracing::instrument(skip_all)]
   async fn get_keyserver_keys(
     &self,
     request: Request<OutboundKeysForUserRequest>,
   ) -> Result<Response<KeyserverKeysResponse>, Status> {
     let message = request.into_inner();
 
     let identifier = self
       .db_client
       .get_user_identity(&message.user_id)
       .await
       .map_err(handle_db_error)?
       .ok_or_else(|| tonic::Status::not_found("user not found"))?;
 
     let Some(keyserver_info) = self
       .db_client
       .get_keyserver_keys_for_user(&message.user_id)
       .await
       .map_err(handle_db_error)?
     else {
       return Err(Status::not_found("keyserver not found"));
     };
 
     let primary_device_data = self
       .db_client
       .get_primary_device_data(&message.user_id)
       .await
       .map_err(handle_db_error)?;
     let primary_device_keys = primary_device_data.device_key_info;
 
     let response = Response::new(KeyserverKeysResponse {
       keyserver_info: Some(keyserver_info.into()),
       identity: Some(identifier.into()),
       primary_device_identity_info: Some(primary_device_keys.into()),
     });
 
     return Ok(response);
   }
 
   #[tracing::instrument(skip_all)]
   async fn upload_one_time_keys(
     &self,
     request: tonic::Request<UploadOneTimeKeysRequest>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let (user_id, device_id) = get_user_and_device_id(&request)?;
     let message = request.into_inner();
 
     debug!("Attempting to update one time keys for user: {}", user_id);
     self
       .db_client
       .append_one_time_prekeys(
         &user_id,
         &device_id,
         &message.content_one_time_prekeys,
         &message.notif_one_time_prekeys,
       )
       .await
       .map_err(handle_db_error)?;
 
     Ok(tonic::Response::new(Empty {}))
   }
 
   #[tracing::instrument(skip_all)]
   async fn update_user_password_start(
     &self,
     request: tonic::Request<UpdateUserPasswordStartRequest>,
   ) -> Result<tonic::Response<UpdateUserPasswordStartResponse>, tonic::Status>
   {
     let (user_id, _) = get_user_and_device_id(&request)?;
     let message = request.into_inner();
 
     let server_registration = comm_opaque2::server::Registration::new();
     let server_message = server_registration
       .start(
         &CONFIG.server_setup,
         &message.opaque_registration_request,
         user_id.as_bytes(),
       )
       .map_err(protocol_error_to_grpc_status)?;
 
     let update_state = UpdateState { user_id };
     let session_id = self
       .db_client
       .insert_workflow(WorkflowInProgress::Update(update_state))
       .await
       .map_err(handle_db_error)?;
 
     let response = UpdateUserPasswordStartResponse {
       session_id,
       opaque_registration_response: server_message,
     };
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn update_user_password_finish(
     &self,
     request: tonic::Request<UpdateUserPasswordFinishRequest>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let message = request.into_inner();
 
     let Some(WorkflowInProgress::Update(state)) = self
       .db_client
       .get_workflow(message.session_id)
       .await
       .map_err(handle_db_error)?
     else {
       return Err(tonic::Status::not_found("session not found"));
     };
 
     let server_registration = comm_opaque2::server::Registration::new();
     let password_file = server_registration
       .finish(&message.opaque_registration_upload)
       .map_err(protocol_error_to_grpc_status)?;
 
     self
       .db_client
       .update_user_password(state.user_id, password_file)
       .await
       .map_err(handle_db_error)?;
 
     let response = Empty {};
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn log_out_user(
     &self,
     request: tonic::Request<Empty>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let (user_id, device_id) = get_user_and_device_id(&request)?;
 
     self
       .db_client
       .remove_device(&user_id, &device_id)
       .await
       .map_err(handle_db_error)?;
 
     self
       .db_client
       .delete_otks_table_rows_for_user_device(&user_id, &device_id)
       .await
       .map_err(handle_db_error)?;
 
     self
       .db_client
       .delete_access_token_data(user_id, device_id)
       .await
       .map_err(handle_db_error)?;
 
     let response = Empty {};
     Ok(Response::new(response))
   }
 
+  #[tracing::instrument(skip_all)]
+  async fn log_out_secondary_device(
+    &self,
+    request: tonic::Request<Empty>,
+  ) -> Result<tonic::Response<Empty>, tonic::Status> {
+    Err(tonic::Status::unimplemented(""))
+  }
+
   #[tracing::instrument(skip_all)]
   async fn delete_wallet_user(
     &self,
     request: tonic::Request<Empty>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let (user_id, _) = get_user_and_device_id(&request)?;
 
     debug!("Attempting to delete wallet user: {}", user_id);
 
     self
       .db_client
       .delete_user(user_id)
       .await
       .map_err(handle_db_error)?;
 
     let response = Empty {};
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn delete_password_user_start(
     &self,
     request: tonic::Request<DeletePasswordUserStartRequest>,
   ) -> Result<tonic::Response<DeletePasswordUserStartResponse>, tonic::Status>
   {
     let (user_id, _) = get_user_and_device_id(&request)?;
     let message = request.into_inner();
 
     debug!("Attempting to start deleting password user: {}", user_id);
     let maybe_username_and_password_file = self
       .db_client
       .get_username_and_password_file(&user_id)
       .await
       .map_err(handle_db_error)?;
 
     let Some((username, password_file_bytes)) =
       maybe_username_and_password_file
     else {
       return Err(tonic::Status::not_found("user not found"));
     };
 
     let mut server_login = comm_opaque2::server::Login::new();
     let server_response = server_login
       .start(
         &CONFIG.server_setup,
         &password_file_bytes,
         &message.opaque_login_request,
         username.as_bytes(),
       )
       .map_err(protocol_error_to_grpc_status)?;
 
     let delete_state = construct_delete_password_user_info(server_login);
 
     let session_id = self
       .db_client
       .insert_workflow(WorkflowInProgress::PasswordUserDeletion(Box::new(
         delete_state,
       )))
       .await
       .map_err(handle_db_error)?;
 
     let response = Response::new(DeletePasswordUserStartResponse {
       session_id,
       opaque_login_response: server_response,
     });
     Ok(response)
   }
 
   #[tracing::instrument(skip_all)]
   async fn delete_password_user_finish(
     &self,
     request: tonic::Request<DeletePasswordUserFinishRequest>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let (user_id, _) = get_user_and_device_id(&request)?;
     let message = request.into_inner();
 
     debug!("Attempting to finish deleting password user: {}", user_id);
     let Some(WorkflowInProgress::PasswordUserDeletion(state)) = self
       .db_client
       .get_workflow(message.session_id)
       .await
       .map_err(handle_db_error)?
     else {
       return Err(tonic::Status::not_found("session not found"));
     };
 
     let mut server_login = state.opaque_server_login;
     server_login
       .finish(&message.opaque_login_upload)
       .map_err(protocol_error_to_grpc_status)?;
 
     self
       .db_client
       .delete_user(user_id)
       .await
       .map_err(handle_db_error)?;
 
     let response = Empty {};
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn get_device_list_for_user(
     &self,
     request: tonic::Request<GetDeviceListRequest>,
   ) -> Result<tonic::Response<GetDeviceListResponse>, tonic::Status> {
     let GetDeviceListRequest {
       user_id,
       since_timestamp,
     } = request.into_inner();
 
     let since = since_timestamp
       .map(|timestamp| {
         DateTime::<Utc>::from_utc_timestamp_millis(timestamp)
           .ok_or_else(|| tonic::Status::invalid_argument("Invalid timestamp"))
       })
       .transpose()?;
 
     let mut db_result = self
       .db_client
       .get_device_list_history(user_id, since)
       .await
       .map_err(handle_db_error)?;
 
     // these should be sorted already, but just in case
     db_result.sort_by_key(|list| list.timestamp);
 
     let device_list_updates: Vec<SignedDeviceList> = db_result
       .into_iter()
       .map(SignedDeviceList::try_from)
       .collect::<Result<Vec<_>, _>>()?;
 
     let stringified_updates = device_list_updates
       .iter()
       .map(SignedDeviceList::as_json_string)
       .collect::<Result<Vec<_>, _>>()?;
 
     Ok(Response::new(GetDeviceListResponse {
       device_list_updates: stringified_updates,
     }))
   }
 
   #[tracing::instrument(skip_all)]
   async fn get_device_lists_for_users(
     &self,
     request: tonic::Request<PeersDeviceListsRequest>,
   ) -> Result<tonic::Response<PeersDeviceListsResponse>, tonic::Status> {
     let PeersDeviceListsRequest { user_ids } = request.into_inner();
 
     // do all fetches concurrently
     let mut fetch_tasks = tokio::task::JoinSet::new();
     let mut device_lists = HashMap::with_capacity(user_ids.len());
     for user_id in user_ids {
       let db_client = self.db_client.clone();
       fetch_tasks.spawn(async move {
         let result = db_client.get_current_device_list(&user_id).await;
         (user_id, result)
       });
     }
 
     while let Some(task_result) = fetch_tasks.join_next().await {
       match task_result {
         Ok((user_id, Ok(Some(device_list_row)))) => {
           let signed_list = SignedDeviceList::try_from(device_list_row)?;
           let serialized_list = signed_list.as_json_string()?;
           device_lists.insert(user_id, serialized_list);
         }
         Ok((user_id, Ok(None))) => {
           warn!(user_id, "User has no device list, skipping!");
         }
         Ok((user_id, Err(err))) => {
           error!(
             user_id,
             errorType = error_types::GRPC_SERVICES_LOG,
             "Failed fetching device list: {err}"
           );
           // abort fetching other users
           fetch_tasks.abort_all();
           return Err(handle_db_error(err));
         }
         Err(join_error) => {
           error!(
             errorType = error_types::GRPC_SERVICES_LOG,
             "Failed to join device list task: {join_error}"
           );
           fetch_tasks.abort_all();
           return Err(Status::aborted("unexpected error"));
         }
       }
     }
 
     let response = PeersDeviceListsResponse {
       users_device_lists: device_lists,
     };
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn update_device_list(
     &self,
     request: tonic::Request<UpdateDeviceListRequest>,
   ) -> Result<Response<Empty>, tonic::Status> {
     let (user_id, _device_id) = get_user_and_device_id(&request)?;
     // TODO: when we stop doing "primary device rotation" (migration procedure)
     // we should verify if this RPC is called by primary device only
 
     let new_list = SignedDeviceList::try_from(request.into_inner())?;
     let update = DeviceListUpdate::try_from(new_list)?;
     self
       .db_client
       .apply_devicelist_update(
         &user_id,
         update,
         crate::device_list::validation::update_device_list_rpc_validator,
       )
       .await
       .map_err(handle_db_error)?;
 
     Ok(Response::new(Empty {}))
   }
 
   #[tracing::instrument(skip_all)]
   async fn link_farcaster_account(
     &self,
     request: tonic::Request<LinkFarcasterAccountRequest>,
   ) -> Result<Response<Empty>, tonic::Status> {
     let (user_id, _) = get_user_and_device_id(&request)?;
     let message = request.into_inner();
 
     let mut get_farcaster_users_response = self
       .db_client
       .get_farcaster_users(vec![message.farcaster_id.clone()])
       .await
       .map_err(handle_db_error)?;
 
     if get_farcaster_users_response.len() > 1 {
       error!(
         errorType = error_types::GRPC_SERVICES_LOG,
         "multiple users associated with the same Farcaster ID"
       );
       return Err(Status::failed_precondition("cannot link Farcaster ID"));
     }
 
     if let Some(u) = get_farcaster_users_response.pop() {
       if u.0.user_id == user_id {
         return Ok(Response::new(Empty {}));
       } else {
         return Err(Status::already_exists(
           "farcaster ID already associated with different user",
         ));
       }
     }
 
     self
       .db_client
       .add_farcaster_id(user_id, message.farcaster_id)
       .await
       .map_err(handle_db_error)?;
 
     let response = Empty {};
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn unlink_farcaster_account(
     &self,
     request: tonic::Request<Empty>,
   ) -> Result<Response<Empty>, tonic::Status> {
     let (user_id, _) = get_user_and_device_id(&request)?;
 
     self
       .db_client
       .remove_farcaster_id(user_id)
       .await
       .map_err(handle_db_error)?;
 
     let response = Empty {};
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn find_user_identities(
     &self,
     request: tonic::Request<UserIdentitiesRequest>,
   ) -> Result<Response<UserIdentitiesResponse>, tonic::Status> {
     let message = request.into_inner();
 
     let results = self
       .db_client
       .find_db_user_identities(message.user_ids)
       .await
       .map_err(handle_db_error)?;
 
     let mapped_results = results
       .into_iter()
       .map(|(user_id, identifier)| (user_id, identifier.into()))
       .collect();
 
     let response = UserIdentitiesResponse {
       identities: mapped_results,
     };
     return Ok(Response::new(response));
   }
 }
 
 #[derive(Clone, serde::Serialize, serde::Deserialize)]
 pub struct DeletePasswordUserInfo {
   pub opaque_server_login: comm_opaque2::server::Login,
 }
 
 fn construct_delete_password_user_info(
   opaque_server_login: comm_opaque2::server::Login,
 ) -> DeletePasswordUserInfo {
   DeletePasswordUserInfo {
     opaque_server_login,
   }
 }
diff --git a/shared/protos/identity_auth.proto b/shared/protos/identity_auth.proto
index c3e79103c..255816d69 100644
--- a/shared/protos/identity_auth.proto
+++ b/shared/protos/identity_auth.proto
@@ -1,271 +1,274 @@
 syntax = "proto3";
 
 import "identity_unauth.proto";
 
 package identity.auth;
 
 // RPCs from a client (iOS, Android, or web) to identity service
 //
 // This service will assert authenticity of a device by verifying the access
 // token through an interceptor, thus avoiding the need to explicitly pass
 // the credentials on every request
 service IdentityClientService {
 
   /* X3DH actions */
 
   // Replenish one-time preKeys
   rpc UploadOneTimeKeys(UploadOneTimeKeysRequest)
     returns (identity.unauth.Empty) {}
   // Rotate a device's prekey and prekey signature
   // Rotated for deniability of older messages
   rpc RefreshUserPrekeys(RefreshUserPrekeysRequest)
     returns (identity.unauth.Empty) {}
 
   // Called by clients to get all device keys associated with a user in order
   // to open a new channel of communication on any of their devices.
   // Specially, this will return the following per device:
   //   - Identity keys (both Content and Notif Keys)
   //   - Prekey (including prekey signature)
   //   - One-time Prekey
   rpc GetOutboundKeysForUser(OutboundKeysForUserRequest) returns
     (OutboundKeysForUserResponse) {}
   // Called by receivers of a communication request. The reponse will return
   // identity keys (both content and notif keys) and related prekeys per device,
   // but will not contain one-time keys. Additionally, the response will contain
   // the other user's username.
   rpc GetInboundKeysForUser(InboundKeysForUserRequest) returns
     (InboundKeysForUserResponse) {}
   // Called by clients to get required keys for opening a connection
   // to a user's keyserver
   rpc GetKeyserverKeys(OutboundKeysForUserRequest) returns
     (KeyserverKeysResponse) {}
 
   /* Account actions */
 
   // Called by user to update password and receive new access token
   rpc UpdateUserPasswordStart(UpdateUserPasswordStartRequest) returns
     (UpdateUserPasswordStartResponse) {}
   rpc UpdateUserPasswordFinish(UpdateUserPasswordFinishRequest) returns
     (identity.unauth.Empty) {}
 
   // Called by user to log out (clears device's keys and access token)
   rpc LogOutUser(identity.unauth.Empty) returns (identity.unauth.Empty) {}
+  // Called by a ssecondary device to log out (clear its keys and access token)
+  rpc LogOutSecondaryDevice(identity.unauth.Empty) returns
+    (identity.unauth.Empty) {}
   // Called by a user to delete their own account
   rpc DeletePasswordUserStart(DeletePasswordUserStartRequest) returns
     (DeletePasswordUserStartResponse) {}
   rpc DeletePasswordUserFinish(DeletePasswordUserFinishRequest) returns
     (identity.unauth.Empty) {}
   rpc DeleteWalletUser(identity.unauth.Empty) returns (identity.unauth.Empty) {}
 
   /* Device list actions */
 
   // Returns device list history
   rpc GetDeviceListForUser(GetDeviceListRequest) returns
     (GetDeviceListResponse) {}
   // Returns current device list for a set of users
   rpc GetDeviceListsForUsers (PeersDeviceListsRequest) returns
     (PeersDeviceListsResponse) {}
 
   rpc UpdateDeviceList(UpdateDeviceListRequest) returns
     (identity.unauth.Empty) {}
 
   /* Farcaster actions */
 
   // Called by an existing user to link their Farcaster account
   rpc LinkFarcasterAccount(LinkFarcasterAccountRequest) returns
     (identity.unauth.Empty) {}
   // Called by an existing user to unlink their Farcaster account
   rpc UnlinkFarcasterAccount(identity.unauth.Empty) returns
     (identity.unauth.Empty) {}
 
   /* Miscellaneous actions */
 
   rpc FindUserIdentities(UserIdentitiesRequest) returns (UserIdentitiesResponse) {}
 }
 
 // Helper types
 
 message EthereumIdentity {
   string wallet_address = 1;
   string siwe_message = 2;
   string siwe_signature = 3;
 }
 
 message Identity {
   // this is wallet address for Ethereum users
   string username = 1;
   optional EthereumIdentity eth_identity = 2;
   optional string farcaster_id = 3;
 }
 
 // UploadOneTimeKeys
 
 // As OPKs get exhausted, they need to be refreshed
 message UploadOneTimeKeysRequest {
   repeated string content_one_time_prekeys = 1;
   repeated string notif_one_time_prekeys = 2;
 }
 
 
 // RefreshUserPreKeys
 
 message RefreshUserPrekeysRequest {
   identity.unauth.Prekey new_content_prekeys = 1;
   identity.unauth.Prekey new_notif_prekeys = 2;
 }
 
 // Information needed when establishing communication to someone else's device
 message OutboundKeyInfo {
   identity.unauth.IdentityKeyInfo identity_info = 1;
   identity.unauth.Prekey content_prekey = 2;
   identity.unauth.Prekey notif_prekey = 3;
   optional string one_time_content_prekey = 4;
   optional string one_time_notif_prekey = 5;
 }
 
 message KeyserverKeysResponse {
   OutboundKeyInfo keyserver_info = 1;
   Identity identity = 2;
   identity.unauth.IdentityKeyInfo primary_device_identity_info = 3;
 }
 
 // GetOutboundKeysForUser
 
 message OutboundKeysForUserResponse {
   // Map is keyed on devices' public ed25519 key used for signing
   map<string, OutboundKeyInfo> devices = 1;
 }
 
 // Information needed by a device to establish communcation when responding
 // to a request.
 // The device receiving a request only needs the content key and prekey.
 message OutboundKeysForUserRequest {
   string user_id = 1;
 }
 
 // GetInboundKeysForUser
 
 message InboundKeyInfo {
   identity.unauth.IdentityKeyInfo identity_info = 1;
   identity.unauth.Prekey content_prekey = 2;
   identity.unauth.Prekey notif_prekey = 3;
 }
 
 message InboundKeysForUserResponse {
   // Map is keyed on devices' public ed25519 key used for signing
   map<string, InboundKeyInfo> devices = 1;
   Identity identity = 2;
 }
 
 message InboundKeysForUserRequest {
   string user_id = 1;
 }
 
 // UpdateUserPassword
 
 // Request for updating a user, similar to registration but need a
 // access token to validate user before updating password
 message UpdateUserPasswordStartRequest {
   // Message sent to initiate PAKE registration (step 1)
   bytes opaque_registration_request = 1;
 }
 
 // Do a user registration, but overwrite the existing credentials
 // after validation of user
 message UpdateUserPasswordFinishRequest {
   // Identifier used to correlate start and finish request
   string session_id = 1;
   // Opaque client registration upload (step 3)
   bytes opaque_registration_upload = 2;
 }
 
 message UpdateUserPasswordStartResponse {
   // Identifier used to correlate start request with finish request
   string session_id = 1;
   bytes opaque_registration_response = 2;
 }
 
 // DeletePasswordUser
 
 // First user must log in
 message DeletePasswordUserStartRequest {
   // Message sent to initiate PAKE login
   bytes opaque_login_request = 1;
 }
 
 // If login is successful, the user's account will be deleted
 message DeletePasswordUserFinishRequest {
   // Identifier used to correlate requests in the same workflow
   string session_id = 1;
   bytes opaque_login_upload = 2;
 }
 
 message DeletePasswordUserStartResponse {
   // Identifier used to correlate requests in the same workflow
   string session_id = 1;
   bytes opaque_login_response = 2;
 }
 
 // GetDeviceListForUser
 
 message GetDeviceListRequest {
   // User whose device lists we want to retrieve
   string user_id = 1;
   // UTC timestamp in milliseconds
   // If none, whole device list history will be retrieved
   optional int64 since_timestamp = 2;
 }
 
 message GetDeviceListResponse {
   // A list of stringified JSON objects of the following format:
   // {
   //   "rawDeviceList": JSON.stringify({
   //     "devices": [<device_id: string>, ...]
   //     "timestamp": <UTC timestamp in milliseconds: int>,
   //   })
   // }
   repeated string device_list_updates = 1;
 }
 
 // GetDeviceListsForUsers
 
 message PeersDeviceListsRequest {
   repeated string user_ids = 1;
 }
 
 message PeersDeviceListsResponse {
   // keys are user_id
   // values are JSON-stringified device list payloads
   // (see GetDeviceListResponse message for payload structure)
   map<string, string> users_device_lists = 1;
 }
 
 // UpdateDeviceListForUser
 
 message UpdateDeviceListRequest {
   // A stringified JSON object of the following format:
   // {
   //   "rawDeviceList": JSON.stringify({
   //     "devices": [<device_id: string>, ...]
   //     "timestamp": <UTC timestamp in milliseconds: int>,
   //   })
   // }
   string new_device_list = 1;
 }
 
 // LinkFarcasterAccount
 
 message LinkFarcasterAccountRequest {
   string farcaster_id = 1;
 }
 
 // FindUserIdentities
 
 message UserIdentitiesRequest {
   // user IDs for which we want to get the identity
   repeated string user_ids = 1;
 }
 
 message UserIdentitiesResponse {
   map<string, Identity> identities = 1;
 }
diff --git a/web/protobufs/identity-auth-client.cjs b/web/protobufs/identity-auth-client.cjs
index 497b652da..d4ef4fd71 100644
--- a/web/protobufs/identity-auth-client.cjs
+++ b/web/protobufs/identity-auth-client.cjs
@@ -1,1119 +1,1180 @@
 /**
  * @fileoverview gRPC-Web generated client stub for identity.auth
  * @enhanceable
  * @public
  * @generated
  */
 
 // Code generated by protoc-gen-grpc-web. DO NOT EDIT.
 // versions:
 // 	protoc-gen-grpc-web v1.4.2
 // 	protoc              v3.21.12
 // source: identity_auth.proto
 
 
 /* eslint-disable */
 // @ts-nocheck
 
 
 
 const grpc = {};
 grpc.web = require('grpc-web');
 
 
 var identity_unauth_pb = require('./identity-unauth-structs.cjs')
 const proto = {};
 proto.identity = {};
 proto.identity.auth = require('./identity-auth-structs.cjs');
 
 /**
  * @param {string} hostname
  * @param {?Object} credentials
  * @param {?grpc.web.ClientOptions} options
  * @constructor
  * @struct
  * @final
  */
 proto.identity.auth.IdentityClientServiceClient =
     function(hostname, credentials, options) {
   if (!options) options = {};
   options.format = 'text';
 
   /**
    * @private @const {!grpc.web.GrpcWebClientBase} The client
    */
   this.client_ = new grpc.web.GrpcWebClientBase(options);
 
   /**
    * @private @const {string} The hostname
    */
   this.hostname_ = hostname.replace(/\/+$/, '');
 
 };
 
 
 /**
  * @param {string} hostname
  * @param {?Object} credentials
  * @param {?grpc.web.ClientOptions} options
  * @constructor
  * @struct
  * @final
  */
 proto.identity.auth.IdentityClientServicePromiseClient =
     function(hostname, credentials, options) {
   if (!options) options = {};
   options.format = 'text';
 
   /**
    * @private @const {!grpc.web.GrpcWebClientBase} The client
    */
   this.client_ = new grpc.web.GrpcWebClientBase(options);
 
   /**
    * @private @const {string} The hostname
    */
   this.hostname_ = hostname.replace(/\/+$/, '');
 
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.auth.UploadOneTimeKeysRequest,
  *   !proto.identity.unauth.Empty>}
  */
 const methodDescriptor_IdentityClientService_UploadOneTimeKeys = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/UploadOneTimeKeys',
   grpc.web.MethodType.UNARY,
   proto.identity.auth.UploadOneTimeKeysRequest,
   identity_unauth_pb.Empty,
   /**
    * @param {!proto.identity.auth.UploadOneTimeKeysRequest} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   identity_unauth_pb.Empty.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.auth.UploadOneTimeKeysRequest} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.unauth.Empty)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.unauth.Empty>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.uploadOneTimeKeys =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/UploadOneTimeKeys',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_UploadOneTimeKeys,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.auth.UploadOneTimeKeysRequest} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.unauth.Empty>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.uploadOneTimeKeys =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/UploadOneTimeKeys',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_UploadOneTimeKeys);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.auth.RefreshUserPrekeysRequest,
  *   !proto.identity.unauth.Empty>}
  */
 const methodDescriptor_IdentityClientService_RefreshUserPrekeys = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/RefreshUserPrekeys',
   grpc.web.MethodType.UNARY,
   proto.identity.auth.RefreshUserPrekeysRequest,
   identity_unauth_pb.Empty,
   /**
    * @param {!proto.identity.auth.RefreshUserPrekeysRequest} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   identity_unauth_pb.Empty.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.auth.RefreshUserPrekeysRequest} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.unauth.Empty)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.unauth.Empty>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.refreshUserPrekeys =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/RefreshUserPrekeys',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_RefreshUserPrekeys,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.auth.RefreshUserPrekeysRequest} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.unauth.Empty>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.refreshUserPrekeys =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/RefreshUserPrekeys',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_RefreshUserPrekeys);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.auth.OutboundKeysForUserRequest,
  *   !proto.identity.auth.OutboundKeysForUserResponse>}
  */
 const methodDescriptor_IdentityClientService_GetOutboundKeysForUser = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/GetOutboundKeysForUser',
   grpc.web.MethodType.UNARY,
   proto.identity.auth.OutboundKeysForUserRequest,
   proto.identity.auth.OutboundKeysForUserResponse,
   /**
    * @param {!proto.identity.auth.OutboundKeysForUserRequest} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   proto.identity.auth.OutboundKeysForUserResponse.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.auth.OutboundKeysForUserRequest} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.auth.OutboundKeysForUserResponse)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.auth.OutboundKeysForUserResponse>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.getOutboundKeysForUser =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/GetOutboundKeysForUser',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_GetOutboundKeysForUser,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.auth.OutboundKeysForUserRequest} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.auth.OutboundKeysForUserResponse>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.getOutboundKeysForUser =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/GetOutboundKeysForUser',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_GetOutboundKeysForUser);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.auth.InboundKeysForUserRequest,
  *   !proto.identity.auth.InboundKeysForUserResponse>}
  */
 const methodDescriptor_IdentityClientService_GetInboundKeysForUser = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/GetInboundKeysForUser',
   grpc.web.MethodType.UNARY,
   proto.identity.auth.InboundKeysForUserRequest,
   proto.identity.auth.InboundKeysForUserResponse,
   /**
    * @param {!proto.identity.auth.InboundKeysForUserRequest} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   proto.identity.auth.InboundKeysForUserResponse.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.auth.InboundKeysForUserRequest} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.auth.InboundKeysForUserResponse)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.auth.InboundKeysForUserResponse>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.getInboundKeysForUser =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/GetInboundKeysForUser',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_GetInboundKeysForUser,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.auth.InboundKeysForUserRequest} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.auth.InboundKeysForUserResponse>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.getInboundKeysForUser =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/GetInboundKeysForUser',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_GetInboundKeysForUser);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.auth.OutboundKeysForUserRequest,
  *   !proto.identity.auth.KeyserverKeysResponse>}
  */
 const methodDescriptor_IdentityClientService_GetKeyserverKeys = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/GetKeyserverKeys',
   grpc.web.MethodType.UNARY,
   proto.identity.auth.OutboundKeysForUserRequest,
   proto.identity.auth.KeyserverKeysResponse,
   /**
    * @param {!proto.identity.auth.OutboundKeysForUserRequest} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   proto.identity.auth.KeyserverKeysResponse.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.auth.OutboundKeysForUserRequest} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.auth.KeyserverKeysResponse)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.auth.KeyserverKeysResponse>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.getKeyserverKeys =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/GetKeyserverKeys',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_GetKeyserverKeys,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.auth.OutboundKeysForUserRequest} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.auth.KeyserverKeysResponse>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.getKeyserverKeys =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/GetKeyserverKeys',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_GetKeyserverKeys);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.auth.UpdateUserPasswordStartRequest,
  *   !proto.identity.auth.UpdateUserPasswordStartResponse>}
  */
 const methodDescriptor_IdentityClientService_UpdateUserPasswordStart = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/UpdateUserPasswordStart',
   grpc.web.MethodType.UNARY,
   proto.identity.auth.UpdateUserPasswordStartRequest,
   proto.identity.auth.UpdateUserPasswordStartResponse,
   /**
    * @param {!proto.identity.auth.UpdateUserPasswordStartRequest} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   proto.identity.auth.UpdateUserPasswordStartResponse.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.auth.UpdateUserPasswordStartRequest} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.auth.UpdateUserPasswordStartResponse)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.auth.UpdateUserPasswordStartResponse>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.updateUserPasswordStart =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/UpdateUserPasswordStart',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_UpdateUserPasswordStart,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.auth.UpdateUserPasswordStartRequest} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.auth.UpdateUserPasswordStartResponse>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.updateUserPasswordStart =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/UpdateUserPasswordStart',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_UpdateUserPasswordStart);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.auth.UpdateUserPasswordFinishRequest,
  *   !proto.identity.unauth.Empty>}
  */
 const methodDescriptor_IdentityClientService_UpdateUserPasswordFinish = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/UpdateUserPasswordFinish',
   grpc.web.MethodType.UNARY,
   proto.identity.auth.UpdateUserPasswordFinishRequest,
   identity_unauth_pb.Empty,
   /**
    * @param {!proto.identity.auth.UpdateUserPasswordFinishRequest} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   identity_unauth_pb.Empty.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.auth.UpdateUserPasswordFinishRequest} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.unauth.Empty)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.unauth.Empty>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.updateUserPasswordFinish =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/UpdateUserPasswordFinish',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_UpdateUserPasswordFinish,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.auth.UpdateUserPasswordFinishRequest} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.unauth.Empty>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.updateUserPasswordFinish =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/UpdateUserPasswordFinish',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_UpdateUserPasswordFinish);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.unauth.Empty,
  *   !proto.identity.unauth.Empty>}
  */
 const methodDescriptor_IdentityClientService_LogOutUser = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/LogOutUser',
   grpc.web.MethodType.UNARY,
   identity_unauth_pb.Empty,
   identity_unauth_pb.Empty,
   /**
    * @param {!proto.identity.unauth.Empty} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   identity_unauth_pb.Empty.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.unauth.Empty} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.unauth.Empty)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.unauth.Empty>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.logOutUser =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/LogOutUser',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_LogOutUser,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.unauth.Empty} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.unauth.Empty>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.logOutUser =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/LogOutUser',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_LogOutUser);
 };
 
 
+/**
+ * @const
+ * @type {!grpc.web.MethodDescriptor<
+ *   !proto.identity.unauth.Empty,
+ *   !proto.identity.unauth.Empty>}
+ */
+const methodDescriptor_IdentityClientService_LogOutSecondaryDevice = new grpc.web.MethodDescriptor(
+  '/identity.auth.IdentityClientService/LogOutSecondaryDevice',
+  grpc.web.MethodType.UNARY,
+  identity_unauth_pb.Empty,
+  identity_unauth_pb.Empty,
+  /**
+   * @param {!proto.identity.unauth.Empty} request
+   * @return {!Uint8Array}
+   */
+  function(request) {
+    return request.serializeBinary();
+  },
+  identity_unauth_pb.Empty.deserializeBinary
+);
+
+
+/**
+ * @param {!proto.identity.unauth.Empty} request The
+ *     request proto
+ * @param {?Object<string, string>} metadata User defined
+ *     call metadata
+ * @param {function(?grpc.web.RpcError, ?proto.identity.unauth.Empty)}
+ *     callback The callback function(error, response)
+ * @return {!grpc.web.ClientReadableStream<!proto.identity.unauth.Empty>|undefined}
+ *     The XHR Node Readable Stream
+ */
+proto.identity.auth.IdentityClientServiceClient.prototype.logOutSecondaryDevice =
+    function(request, metadata, callback) {
+  return this.client_.rpcCall(this.hostname_ +
+      '/identity.auth.IdentityClientService/LogOutSecondaryDevice',
+      request,
+      metadata || {},
+      methodDescriptor_IdentityClientService_LogOutSecondaryDevice,
+      callback);
+};
+
+
+/**
+ * @param {!proto.identity.unauth.Empty} request The
+ *     request proto
+ * @param {?Object<string, string>=} metadata User defined
+ *     call metadata
+ * @return {!Promise<!proto.identity.unauth.Empty>}
+ *     Promise that resolves to the response
+ */
+proto.identity.auth.IdentityClientServicePromiseClient.prototype.logOutSecondaryDevice =
+    function(request, metadata) {
+  return this.client_.unaryCall(this.hostname_ +
+      '/identity.auth.IdentityClientService/LogOutSecondaryDevice',
+      request,
+      metadata || {},
+      methodDescriptor_IdentityClientService_LogOutSecondaryDevice);
+};
+
+
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.auth.DeletePasswordUserStartRequest,
  *   !proto.identity.auth.DeletePasswordUserStartResponse>}
  */
 const methodDescriptor_IdentityClientService_DeletePasswordUserStart = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/DeletePasswordUserStart',
   grpc.web.MethodType.UNARY,
   proto.identity.auth.DeletePasswordUserStartRequest,
   proto.identity.auth.DeletePasswordUserStartResponse,
   /**
    * @param {!proto.identity.auth.DeletePasswordUserStartRequest} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   proto.identity.auth.DeletePasswordUserStartResponse.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.auth.DeletePasswordUserStartRequest} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.auth.DeletePasswordUserStartResponse)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.auth.DeletePasswordUserStartResponse>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.deletePasswordUserStart =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/DeletePasswordUserStart',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_DeletePasswordUserStart,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.auth.DeletePasswordUserStartRequest} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.auth.DeletePasswordUserStartResponse>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.deletePasswordUserStart =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/DeletePasswordUserStart',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_DeletePasswordUserStart);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.auth.DeletePasswordUserFinishRequest,
  *   !proto.identity.unauth.Empty>}
  */
 const methodDescriptor_IdentityClientService_DeletePasswordUserFinish = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/DeletePasswordUserFinish',
   grpc.web.MethodType.UNARY,
   proto.identity.auth.DeletePasswordUserFinishRequest,
   identity_unauth_pb.Empty,
   /**
    * @param {!proto.identity.auth.DeletePasswordUserFinishRequest} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   identity_unauth_pb.Empty.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.auth.DeletePasswordUserFinishRequest} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.unauth.Empty)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.unauth.Empty>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.deletePasswordUserFinish =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/DeletePasswordUserFinish',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_DeletePasswordUserFinish,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.auth.DeletePasswordUserFinishRequest} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.unauth.Empty>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.deletePasswordUserFinish =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/DeletePasswordUserFinish',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_DeletePasswordUserFinish);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.unauth.Empty,
  *   !proto.identity.unauth.Empty>}
  */
 const methodDescriptor_IdentityClientService_DeleteWalletUser = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/DeleteWalletUser',
   grpc.web.MethodType.UNARY,
   identity_unauth_pb.Empty,
   identity_unauth_pb.Empty,
   /**
    * @param {!proto.identity.unauth.Empty} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   identity_unauth_pb.Empty.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.unauth.Empty} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.unauth.Empty)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.unauth.Empty>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.deleteWalletUser =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/DeleteWalletUser',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_DeleteWalletUser,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.unauth.Empty} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.unauth.Empty>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.deleteWalletUser =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/DeleteWalletUser',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_DeleteWalletUser);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.auth.GetDeviceListRequest,
  *   !proto.identity.auth.GetDeviceListResponse>}
  */
 const methodDescriptor_IdentityClientService_GetDeviceListForUser = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/GetDeviceListForUser',
   grpc.web.MethodType.UNARY,
   proto.identity.auth.GetDeviceListRequest,
   proto.identity.auth.GetDeviceListResponse,
   /**
    * @param {!proto.identity.auth.GetDeviceListRequest} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   proto.identity.auth.GetDeviceListResponse.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.auth.GetDeviceListRequest} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.auth.GetDeviceListResponse)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.auth.GetDeviceListResponse>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.getDeviceListForUser =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/GetDeviceListForUser',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_GetDeviceListForUser,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.auth.GetDeviceListRequest} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.auth.GetDeviceListResponse>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.getDeviceListForUser =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/GetDeviceListForUser',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_GetDeviceListForUser);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.auth.PeersDeviceListsRequest,
  *   !proto.identity.auth.PeersDeviceListsResponse>}
  */
 const methodDescriptor_IdentityClientService_GetDeviceListsForUsers = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/GetDeviceListsForUsers',
   grpc.web.MethodType.UNARY,
   proto.identity.auth.PeersDeviceListsRequest,
   proto.identity.auth.PeersDeviceListsResponse,
   /**
    * @param {!proto.identity.auth.PeersDeviceListsRequest} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   proto.identity.auth.PeersDeviceListsResponse.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.auth.PeersDeviceListsRequest} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.auth.PeersDeviceListsResponse)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.auth.PeersDeviceListsResponse>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.getDeviceListsForUsers =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/GetDeviceListsForUsers',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_GetDeviceListsForUsers,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.auth.PeersDeviceListsRequest} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.auth.PeersDeviceListsResponse>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.getDeviceListsForUsers =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/GetDeviceListsForUsers',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_GetDeviceListsForUsers);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.auth.UpdateDeviceListRequest,
  *   !proto.identity.unauth.Empty>}
  */
 const methodDescriptor_IdentityClientService_UpdateDeviceList = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/UpdateDeviceList',
   grpc.web.MethodType.UNARY,
   proto.identity.auth.UpdateDeviceListRequest,
   identity_unauth_pb.Empty,
   /**
    * @param {!proto.identity.auth.UpdateDeviceListRequest} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   identity_unauth_pb.Empty.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.auth.UpdateDeviceListRequest} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.unauth.Empty)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.unauth.Empty>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.updateDeviceList =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/UpdateDeviceList',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_UpdateDeviceList,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.auth.UpdateDeviceListRequest} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.unauth.Empty>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.updateDeviceList =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/UpdateDeviceList',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_UpdateDeviceList);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.auth.LinkFarcasterAccountRequest,
  *   !proto.identity.unauth.Empty>}
  */
 const methodDescriptor_IdentityClientService_LinkFarcasterAccount = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/LinkFarcasterAccount',
   grpc.web.MethodType.UNARY,
   proto.identity.auth.LinkFarcasterAccountRequest,
   identity_unauth_pb.Empty,
   /**
    * @param {!proto.identity.auth.LinkFarcasterAccountRequest} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   identity_unauth_pb.Empty.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.auth.LinkFarcasterAccountRequest} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.unauth.Empty)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.unauth.Empty>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.linkFarcasterAccount =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/LinkFarcasterAccount',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_LinkFarcasterAccount,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.auth.LinkFarcasterAccountRequest} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.unauth.Empty>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.linkFarcasterAccount =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/LinkFarcasterAccount',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_LinkFarcasterAccount);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.unauth.Empty,
  *   !proto.identity.unauth.Empty>}
  */
 const methodDescriptor_IdentityClientService_UnlinkFarcasterAccount = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/UnlinkFarcasterAccount',
   grpc.web.MethodType.UNARY,
   identity_unauth_pb.Empty,
   identity_unauth_pb.Empty,
   /**
    * @param {!proto.identity.unauth.Empty} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   identity_unauth_pb.Empty.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.unauth.Empty} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.unauth.Empty)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.unauth.Empty>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.unlinkFarcasterAccount =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/UnlinkFarcasterAccount',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_UnlinkFarcasterAccount,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.unauth.Empty} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.unauth.Empty>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.unlinkFarcasterAccount =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/UnlinkFarcasterAccount',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_UnlinkFarcasterAccount);
 };
 
 
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.auth.UserIdentitiesRequest,
  *   !proto.identity.auth.UserIdentitiesResponse>}
  */
 const methodDescriptor_IdentityClientService_FindUserIdentities = new grpc.web.MethodDescriptor(
   '/identity.auth.IdentityClientService/FindUserIdentities',
   grpc.web.MethodType.UNARY,
   proto.identity.auth.UserIdentitiesRequest,
   proto.identity.auth.UserIdentitiesResponse,
   /**
    * @param {!proto.identity.auth.UserIdentitiesRequest} request
    * @return {!Uint8Array}
    */
   function(request) {
     return request.serializeBinary();
   },
   proto.identity.auth.UserIdentitiesResponse.deserializeBinary
 );
 
 
 /**
  * @param {!proto.identity.auth.UserIdentitiesRequest} request The
  *     request proto
  * @param {?Object<string, string>} metadata User defined
  *     call metadata
  * @param {function(?grpc.web.RpcError, ?proto.identity.auth.UserIdentitiesResponse)}
  *     callback The callback function(error, response)
  * @return {!grpc.web.ClientReadableStream<!proto.identity.auth.UserIdentitiesResponse>|undefined}
  *     The XHR Node Readable Stream
  */
 proto.identity.auth.IdentityClientServiceClient.prototype.findUserIdentities =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
       '/identity.auth.IdentityClientService/FindUserIdentities',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_FindUserIdentities,
       callback);
 };
 
 
 /**
  * @param {!proto.identity.auth.UserIdentitiesRequest} request The
  *     request proto
  * @param {?Object<string, string>=} metadata User defined
  *     call metadata
  * @return {!Promise<!proto.identity.auth.UserIdentitiesResponse>}
  *     Promise that resolves to the response
  */
 proto.identity.auth.IdentityClientServicePromiseClient.prototype.findUserIdentities =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
       '/identity.auth.IdentityClientService/FindUserIdentities',
       request,
       metadata || {},
       methodDescriptor_IdentityClientService_FindUserIdentities);
 };
 
 
 module.exports = proto.identity.auth;
 
diff --git a/web/protobufs/identity-auth-client.cjs.flow b/web/protobufs/identity-auth-client.cjs.flow
index 9103792c5..dbf7585c8 100644
--- a/web/protobufs/identity-auth-client.cjs.flow
+++ b/web/protobufs/identity-auth-client.cjs.flow
@@ -1,224 +1,236 @@
 // @flow
 
 import * as grpcWeb from 'grpc-web';
 
 import * as identityAuthStructs from './identity-auth-structs.cjs';
 import * as identityStructs from './identity-unauth-structs.cjs';
 
 
 declare export class IdentityClientServiceClient {
   constructor (hostname: string,
                credentials?: null | { +[index: string]: string; },
                options?: null | { +[index: string]: any; }): void;
 
   uploadOneTimeKeys(
     request: identityAuthStructs.UploadOneTimeKeysRequest,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityStructs.Empty) => void
   ): grpcWeb.ClientReadableStream<identityStructs.Empty>;
 
   refreshUserPrekeys(
     request: identityAuthStructs.RefreshUserPrekeysRequest,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityStructs.Empty) => void
   ): grpcWeb.ClientReadableStream<identityStructs.Empty>;
 
   getOutboundKeysForUser(
     request: identityAuthStructs.OutboundKeysForUserRequest,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityAuthStructs.OutboundKeysForUserResponse) => void
   ): grpcWeb.ClientReadableStream<identityAuthStructs.OutboundKeysForUserResponse>;
 
   getInboundKeysForUser(
     request: identityAuthStructs.InboundKeysForUserRequest,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityAuthStructs.InboundKeysForUserResponse) => void
   ): grpcWeb.ClientReadableStream<identityAuthStructs.InboundKeysForUserResponse>;
 
   getKeyserverKeys(
     request: identityAuthStructs.OutboundKeysForUserRequest,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityAuthStructs.KeyserverKeysResponse) => void
   ): grpcWeb.ClientReadableStream<identityAuthStructs.KeyserverKeysResponse>;
 
   updateUserPasswordStart(
     request: identityAuthStructs.UpdateUserPasswordStartRequest,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityAuthStructs.UpdateUserPasswordStartResponse) => void
   ): grpcWeb.ClientReadableStream<identityAuthStructs.UpdateUserPasswordStartResponse>;
 
   updateUserPasswordFinish(
     request: identityAuthStructs.UpdateUserPasswordFinishRequest,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityStructs.Empty) => void
   ): grpcWeb.ClientReadableStream<identityStructs.Empty>;
 
   logOutUser(
     request: identityStructs.Empty,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityStructs.Empty) => void
   ): grpcWeb.ClientReadableStream<identityStructs.Empty>;
 
+  logOutSecondaryDevice(
+    request: identityStructs.Empty,
+    metadata: grpcWeb.Metadata | void,
+    callback: (err: grpcWeb.RpcError,
+               response: identityStructs.Empty) => void
+  ): grpcWeb.ClientReadableStream<identityStructs.Empty>;
+
   deletePasswordUserStart(
     request: identityAuthStructs.DeletePasswordUserStartRequest,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityAuthStructs.DeletePasswordUserStartResponse) => void
   ): grpcWeb.ClientReadableStream<identityAuthStructs.DeletePasswordUserStartResponse>;
 
   deletePasswordUserFinish(
     request: identityAuthStructs.DeletePasswordUserFinishRequest,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityStructs.Empty) => void
   ): grpcWeb.ClientReadableStream<identityStructs.Empty>;
 
   deleteWalletUser(
     request: identityStructs.Empty,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityStructs.Empty) => void
   ): grpcWeb.ClientReadableStream<identityStructs.Empty>;
 
   getDeviceListForUser(
     request: identityAuthStructs.GetDeviceListRequest,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityAuthStructs.GetDeviceListResponse) => void
   ): grpcWeb.ClientReadableStream<identityAuthStructs.GetDeviceListResponse>;
 
   getDeviceListsForUsers(
     request: identityAuthStructs.PeersDeviceListsRequest,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityAuthStructs.PeersDeviceListsResponse) => void
   ): grpcWeb.ClientReadableStream<identityAuthStructs.PeersDeviceListsResponse>;
 
   updateDeviceList(
     request: identityAuthStructs.UpdateDeviceListRequest,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityStructs.Empty) => void
   ): grpcWeb.ClientReadableStream<identityStructs.Empty>;
 
   linkFarcasterAccount(
     request: identityAuthStructs.LinkFarcasterAccountRequest,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityStructs.Empty) => void
   ): grpcWeb.ClientReadableStream<identityStructs.Empty>;
 
   unlinkFarcasterAccount(
     request: identityStructs.Empty,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityStructs.Empty) => void
   ): grpcWeb.ClientReadableStream<identityStructs.Empty>;
 
   findUserIdentities(
     request: identityAuthStructs.UserIdentitiesRequest,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
                response: identityAuthStructs.UserIdentitiesResponse) => void
   ): grpcWeb.ClientReadableStream<identityAuthStructs.UserIdentitiesResponse>;
 }
 
 declare export class IdentityClientServicePromiseClient {
   constructor (hostname: string,
                credentials?: null | { +[index: string]: string; },
                options?: null | { +[index: string]: any; }): void;
 
   uploadOneTimeKeys(
     request: identityAuthStructs.UploadOneTimeKeysRequest,
     metadata?: grpcWeb.Metadata
   ): Promise<identityStructs.Empty>;
 
   refreshUserPrekeys(
     request: identityAuthStructs.RefreshUserPrekeysRequest,
     metadata?: grpcWeb.Metadata
   ): Promise<identityStructs.Empty>;
 
   getOutboundKeysForUser(
     request: identityAuthStructs.OutboundKeysForUserRequest,
     metadata?: grpcWeb.Metadata
   ): Promise<identityAuthStructs.OutboundKeysForUserResponse>;
 
   getInboundKeysForUser(
     request: identityAuthStructs.InboundKeysForUserRequest,
     metadata?: grpcWeb.Metadata
   ): Promise<identityAuthStructs.InboundKeysForUserResponse>;
 
   getKeyserverKeys(
     request: identityAuthStructs.OutboundKeysForUserRequest,
     metadata?: grpcWeb.Metadata
   ): Promise<identityAuthStructs.KeyserverKeysResponse>;
 
   updateUserPasswordStart(
     request: identityAuthStructs.UpdateUserPasswordStartRequest,
     metadata?: grpcWeb.Metadata
   ): Promise<identityAuthStructs.UpdateUserPasswordStartResponse>;
 
   updateUserPasswordFinish(
     request: identityAuthStructs.UpdateUserPasswordFinishRequest,
     metadata?: grpcWeb.Metadata
   ): Promise<identityStructs.Empty>;
 
   logOutUser(
     request: identityStructs.Empty,
     metadata?: grpcWeb.Metadata
   ): Promise<identityStructs.Empty>;
 
+  logOutSecondaryDevice(
+    request: identityStructs.Empty,
+    metadata?: grpcWeb.Metadata
+  ): Promise<identityStructs.Empty>;
+
   deletePasswordUserStart(
     request: identityAuthStructs.DeletePasswordUserStartRequest,
     metadata?: grpcWeb.Metadata
   ): Promise<identityAuthStructs.DeletePasswordUserStartResponse>;
 
   deletePasswordUserFinish(
     request: identityAuthStructs.DeletePasswordUserFinishRequest,
     metadata?: grpcWeb.Metadata
   ): Promise<identityStructs.Empty>;
 
   deleteWalletUser(
     request: identityStructs.Empty,
     metadata?: grpcWeb.Metadata
   ): Promise<identityStructs.Empty>;
 
   getDeviceListForUser(
     request: identityAuthStructs.GetDeviceListRequest,
     metadata?: grpcWeb.Metadata
   ): Promise<identityAuthStructs.GetDeviceListResponse>;
 
   getDeviceListsForUsers(
     request: identityAuthStructs.PeersDeviceListsRequest,
     metadata?: grpcWeb.Metadata
   ): Promise<identityAuthStructs.PeersDeviceListsResponse>;
 
   updateDeviceList(
     request: identityAuthStructs.UpdateDeviceListRequest,
     metadata?: grpcWeb.Metadata
   ): Promise<identityStructs.Empty>;
 
   linkFarcasterAccount(
     request: identityAuthStructs.LinkFarcasterAccountRequest,
     metadata?: grpcWeb.Metadata
   ): Promise<identityStructs.Empty>;
 
   unlinkFarcasterAccount(
     request: identityStructs.Empty,
     metadata?: grpcWeb.Metadata
   ): Promise<identityStructs.Empty>;
 
   findUserIdentities(
     request: identityAuthStructs.UserIdentitiesRequest,
     metadata?: grpcWeb.Metadata
   ): Promise<identityAuthStructs.UserIdentitiesResponse>;
 }