diff --git a/lib/types/identity-service-types.js b/lib/types/identity-service-types.js
index d86d59d9d..0bc1388b0 100644
--- a/lib/types/identity-service-types.js
+++ b/lib/types/identity-service-types.js
@@ -1,104 +1,123 @@
 // @flow
 
 import t, { type TInterface } from 'tcomb';
 
 import {
   identityKeysBlobValidator,
   type IdentityKeysBlob,
 } from './crypto-types.js';
 import {
   type OlmSessionInitializationInfo,
   olmSessionInitializationInfoValidator,
 } from './request-types.js';
 import { tShape } from '../utils/validation-utils.js';
 
 export type UserLoginResponse = {
   +userId: string,
   +accessToken: string,
 };
 
 // This type should not be altered without also updating
 // OutboundKeyInfoResponse in native/native_rust_library/src/lib.rs
 export type OutboundKeyInfoResponse = {
   +payload: string,
   +payloadSignature: string,
   +socialProof: ?string,
   +contentPrekey: string,
   +contentPrekeySignature: string,
   +notifPrekey: string,
   +notifPrekeySignature: string,
   +oneTimeContentPrekey: ?string,
   +oneTimeNotifPrekey: ?string,
 };
 
 export type DeviceOlmOutboundKeys = {
   +identityKeysBlob: IdentityKeysBlob,
   +contentInitializationInfo: OlmSessionInitializationInfo,
   +notifInitializationInfo: OlmSessionInitializationInfo,
   +payloadSignature: string,
   +socialProof: ?string,
 };
 export const deviceOlmOutboundKeysValidator: TInterface<DeviceOlmOutboundKeys> =
   tShape<DeviceOlmOutboundKeys>({
     identityKeysBlob: identityKeysBlobValidator,
     contentInitializationInfo: olmSessionInitializationInfoValidator,
     notifInitializationInfo: olmSessionInitializationInfoValidator,
     payloadSignature: t.String,
     socialProof: t.maybe(t.String),
   });
 
 export type UserDevicesOlmOutboundKeys = {
   +deviceID: string,
   +keys: ?DeviceOlmOutboundKeys,
 };
 
 export interface IdentityServiceClient {
   +deleteUser: () => Promise<void>;
   +getKeyserverKeys: string => Promise<DeviceOlmOutboundKeys>;
   +registerUser?: (
     username: string,
     password: string,
   ) => Promise<IdentityAuthResult>;
+  +logInPasswordUser: (
+    username: string,
+    password: string,
+  ) => Promise<IdentityAuthResult>;
   +getOutboundKeysForUser: (
     userID: string,
   ) => Promise<UserDevicesOlmOutboundKeys[]>;
 }
 
 export type IdentityServiceAuthLayer = {
   +userID: string,
   +deviceID: string,
   +commServicesAccessToken: string,
 };
 
 // This type should not be altered without also updating
 // InboundKeyInfoResponse in native/native_rust_library/src/lib.rs
 export type InboundKeyInfoResponse = {
   +payload: string,
   +payloadSignature: string,
   +socialProof?: ?string,
   +contentPrekey: string,
   +contentPrekeySignature: string,
   +notifPrekey: string,
   +notifPrekeySignature: string,
   +username?: ?string,
   +walletAddress?: ?string,
 };
 
 export type IdentityAuthResult = {
   +userID: string,
   +accessToken: string,
   +username: string,
 };
+export const identityAuthResultValidator: TInterface<IdentityAuthResult> =
+  tShape<IdentityAuthResult>({
+    userID: t.String,
+    accessToken: t.String,
+    username: t.String,
+  });
 
 export type IdentityDeviceKeyUpload = {
   +keyPayload: string,
   +keyPayloadSignature: string,
   +contentPrekey: string,
   +contentPrekeySignature: string,
   +notifPrekey: string,
   +notifPrekeySignature: string,
   +contentOneTimeKeys: $ReadOnlyArray<string>,
   +notifOneTimeKeys: $ReadOnlyArray<string>,
 };
 
 export const ONE_TIME_KEYS_NUMBER = 10;
+
+export const identityDeviceTypes = Object.freeze({
+  KEYSERVER: 0,
+  WEB: 1,
+  IOS: 2,
+  ANDROID: 3,
+  WINDOWS: 4,
+  MAC_OS: 5,
+});
diff --git a/native/identity-service/identity-service-context-provider.react.js b/native/identity-service/identity-service-context-provider.react.js
index 8637a5b27..6d31ad1be 100644
--- a/native/identity-service/identity-service-context-provider.react.js
+++ b/native/identity-service/identity-service-context-provider.react.js
@@ -1,245 +1,279 @@
 // @flow
 
 import * as React from 'react';
 
-import { getOneTimeKeyArray } from 'lib/shared/crypto-utils.js';
+import { getOneTimeKeyValues } from 'lib/shared/crypto-utils.js';
 import { IdentityClientContext } from 'lib/shared/identity-client-context.js';
 import {
   type IdentityKeysBlob,
   identityKeysBlobValidator,
 } from 'lib/types/crypto-types.js';
 import {
   type DeviceOlmOutboundKeys,
   deviceOlmOutboundKeysValidator,
   type IdentityServiceClient,
   type UserDevicesOlmOutboundKeys,
   type UserLoginResponse,
 } from 'lib/types/identity-service-types.js';
-import { ONE_TIME_KEYS_NUMBER } from 'lib/types/identity-service-types.js';
+import {
+  ONE_TIME_KEYS_NUMBER,
+  identityAuthResultValidator,
+} from 'lib/types/identity-service-types.js';
 import { assertWithValidator } from 'lib/utils/validation-utils.js';
 
 import { getCommServicesAuthMetadataEmitter } from '../event-emitters/csa-auth-metadata-emitter.js';
 import { commCoreModule, commRustModule } from '../native-modules.js';
 import { useSelector } from '../redux/redux-utils.js';
 import { getContentSigningKey } from '../utils/crypto-utils.js';
 
 type Props = {
   +children: React.Node,
 };
 function IdentityServiceContextProvider(props: Props): React.Node {
   const { children } = props;
 
   const userIDPromiseRef = React.useRef<?Promise<?string>>();
   if (!userIDPromiseRef.current) {
     userIDPromiseRef.current = (async () => {
       const { userID } = await commCoreModule.getCommServicesAuthMetadata();
       return userID;
     })();
   }
 
   React.useEffect(() => {
     const metadataEmitter = getCommServicesAuthMetadataEmitter();
     const subscription = metadataEmitter.addListener(
       'commServicesAuthMetadata',
       (authMetadata: UserLoginResponse) => {
         userIDPromiseRef.current = Promise.resolve(authMetadata.userId);
       },
     );
     return () => subscription.remove();
   }, []);
 
   const accessToken = useSelector(state => state.commServicesAccessToken);
 
   const getAuthMetadata = React.useCallback<
     () => Promise<{
       +deviceID: string,
       +userID: string,
       +accessToken: string,
     }>,
   >(async () => {
     const deviceID = await getContentSigningKey();
     const userID = await userIDPromiseRef.current;
     if (!deviceID || !userID || !accessToken) {
       throw new Error('Identity service client is not initialized');
     }
     return { deviceID, userID, accessToken };
   }, [accessToken]);
 
   const client = React.useMemo<IdentityServiceClient>(
     () => ({
       deleteUser: async () => {
         const {
           deviceID,
           userID,
           accessToken: token,
         } = await getAuthMetadata();
         return commRustModule.deleteUser(userID, deviceID, token);
       },
       getKeyserverKeys: async (
         keyserverID: string,
       ): Promise<DeviceOlmOutboundKeys> => {
         const {
           deviceID,
           userID,
           accessToken: token,
         } = await getAuthMetadata();
         const result = await commRustModule.getKeyserverKeys(
           userID,
           deviceID,
           token,
           keyserverID,
         );
         const resultObject = JSON.parse(result);
         const payload = resultObject?.payload;
 
         const keyserverKeys = {
           identityKeysBlob: payload ? JSON.parse(payload) : null,
           contentInitializationInfo: {
             prekey: resultObject?.contentPrekey,
             prekeySignature: resultObject?.contentPrekeySignature,
             oneTimeKey: resultObject?.oneTimeContentPrekey,
           },
           notifInitializationInfo: {
             prekey: resultObject?.notifPrekey,
             prekeySignature: resultObject?.notifPrekeySignature,
             oneTimeKey: resultObject?.oneTimeNotifPrekey,
           },
           payloadSignature: resultObject?.payloadSignature,
           socialProof: resultObject?.socialProof,
         };
 
         if (!keyserverKeys.contentInitializationInfo.oneTimeKey) {
           throw new Error('Missing content one time key');
         }
         if (!keyserverKeys.notifInitializationInfo.oneTimeKey) {
           throw new Error('Missing notif one time key');
         }
 
         return assertWithValidator(
           keyserverKeys,
           deviceOlmOutboundKeysValidator,
         );
       },
       getOutboundKeysForUser: async (
         targetUserID: string,
       ): Promise<UserDevicesOlmOutboundKeys[]> => {
         const {
           deviceID: authDeviceID,
           userID,
           accessToken: token,
         } = await getAuthMetadata();
         const result = await commRustModule.getOutboundKeysForUser(
           userID,
           authDeviceID,
           token,
           targetUserID,
         );
         const resultArray = JSON.parse(result);
 
         return resultArray
           .map(outboundKeysInfo => {
             try {
               const payload = outboundKeysInfo?.payload;
               const identityKeysBlob: IdentityKeysBlob = assertWithValidator(
                 payload ? JSON.parse(payload) : null,
                 identityKeysBlobValidator,
               );
               const deviceID =
                 identityKeysBlob.primaryIdentityPublicKeys.ed25519;
 
               if (
                 !outboundKeysInfo.oneTimeContentPrekey ||
                 !outboundKeysInfo.oneTimeNotifPrekey
               ) {
                 console.log(`Missing one time key for device ${deviceID}`);
                 return {
                   deviceID,
                   keys: null,
                 };
               }
 
               const deviceKeys = {
                 identityKeysBlob,
                 contentInitializationInfo: {
                   prekey: outboundKeysInfo?.contentPrekey,
                   prekeySignature: outboundKeysInfo?.contentPrekeySignature,
                   oneTimeKey: outboundKeysInfo?.oneTimeContentPrekey,
                 },
                 notifInitializationInfo: {
                   prekey: outboundKeysInfo?.notifPrekey,
                   prekeySignature: outboundKeysInfo?.notifPrekeySignature,
                   oneTimeKey: outboundKeysInfo?.oneTimeNotifPrekey,
                 },
                 payloadSignature: outboundKeysInfo?.payloadSignature,
                 socialProof: outboundKeysInfo?.socialProof,
               };
 
               try {
                 const validatedKeys = assertWithValidator(
                   deviceKeys,
                   deviceOlmOutboundKeysValidator,
                 );
                 return {
                   deviceID,
                   keys: validatedKeys,
                 };
               } catch (e) {
                 console.log(e);
                 return {
                   deviceID,
                   keys: null,
                 };
               }
             } catch (e) {
               console.log(e);
               return null;
             }
           })
           .filter(Boolean);
       },
       registerUser: async (username: string, password: string) => {
         await commCoreModule.initializeCryptoAccount();
         const [
           { blobPayload, signature },
           { contentOneTimeKeys, notificationsOneTimeKeys },
           prekeys,
         ] = await Promise.all([
           commCoreModule.getUserPublicKey(),
           commCoreModule.getOneTimeKeys(ONE_TIME_KEYS_NUMBER),
           commCoreModule.validateAndGetPrekeys(),
         ]);
         const registrationResult = await commRustModule.registerUser(
           username,
           password,
           blobPayload,
           signature,
           prekeys.contentPrekey,
           prekeys.contentPrekeySignature,
           prekeys.notifPrekey,
           prekeys.notifPrekeySignature,
-          getOneTimeKeyArray(contentOneTimeKeys),
-          getOneTimeKeyArray(notificationsOneTimeKeys),
+          getOneTimeKeyValues(contentOneTimeKeys),
+          getOneTimeKeyValues(notificationsOneTimeKeys),
         );
         const { userID, accessToken: token } = JSON.parse(registrationResult);
         return { accessToken: token, userID, username };
       },
+      logInPasswordUser: async (username: string, password: string) => {
+        await commCoreModule.initializeCryptoAccount();
+        const [
+          { blobPayload, signature },
+          { contentOneTimeKeys, notificationsOneTimeKeys },
+          prekeys,
+        ] = await Promise.all([
+          commCoreModule.getUserPublicKey(),
+          commCoreModule.getOneTimeKeys(ONE_TIME_KEYS_NUMBER),
+          commCoreModule.validateAndGetPrekeys(),
+        ]);
+        const loginResult = await commRustModule.logInPasswordUser(
+          username,
+          password,
+          blobPayload,
+          signature,
+          prekeys.contentPrekey,
+          prekeys.contentPrekeySignature,
+          prekeys.notifPrekey,
+          prekeys.notifPrekeySignature,
+          getOneTimeKeyValues(contentOneTimeKeys),
+          getOneTimeKeyValues(notificationsOneTimeKeys),
+        );
+        const { userID, accessToken: token } = JSON.parse(loginResult);
+        const identityAuthResult = { accessToken: token, userID, username };
+
+        return assertWithValidator(
+          identityAuthResult,
+          identityAuthResultValidator,
+        );
+      },
     }),
     [getAuthMetadata],
   );
 
   const value = React.useMemo(
     () => ({
       identityClient: client,
       getAuthMetadata,
     }),
     [client, getAuthMetadata],
   );
 
   return (
     <IdentityClientContext.Provider value={value}>
       {children}
     </IdentityClientContext.Provider>
   );
 }
 
 export default IdentityServiceContextProvider;
diff --git a/web/grpc/identity-service-client-wrapper.js b/web/grpc/identity-service-client-wrapper.js
index 20b0dbd1f..204708243 100644
--- a/web/grpc/identity-service-client-wrapper.js
+++ b/web/grpc/identity-service-client-wrapper.js
@@ -1,207 +1,326 @@
 // @flow
 
+import { Login } from '@commapp/opaque-ke-wasm';
+
 import identityServiceConfig from 'lib/facts/identity-service.js';
 import {
   type IdentityServiceAuthLayer,
   type IdentityServiceClient,
   type DeviceOlmOutboundKeys,
   deviceOlmOutboundKeysValidator,
   type UserDevicesOlmOutboundKeys,
+  type IdentityAuthResult,
+  type IdentityDeviceKeyUpload,
+  identityDeviceTypes,
+  identityAuthResultValidator,
 } from 'lib/types/identity-service-types.js';
+import { getMessageForException } from 'lib/utils/errors.js';
 import { assertWithValidator } from 'lib/utils/validation-utils.js';
 
 import { VersionInterceptor, AuthInterceptor } from './interceptor.js';
+import { initOpaque } from '../crypto/opaque-utils.js';
 import * as IdentityAuthClient from '../protobufs/identity-auth-client.cjs';
 import * as IdentityAuthStructs from '../protobufs/identity-auth-structs.cjs';
-import { Empty } from '../protobufs/identity-unauth-structs.cjs';
+import {
+  DeviceKeyUpload,
+  Empty,
+  IdentityKeyInfo,
+  OpaqueLoginFinishRequest,
+  OpaqueLoginStartRequest,
+  Prekey,
+} from '../protobufs/identity-unauth-structs.cjs';
 import * as IdentityUnauthClient from '../protobufs/identity-unauth.cjs';
 
 class IdentityServiceClientWrapper implements IdentityServiceClient {
   authClient: ?IdentityAuthClient.IdentityClientServicePromiseClient;
   unauthClient: IdentityUnauthClient.IdentityClientServicePromiseClient;
+  getDeviceKeyUpload: () => Promise<IdentityDeviceKeyUpload>;
 
-  constructor(authLayer: ?IdentityServiceAuthLayer) {
+  constructor(
+    authLayer: ?IdentityServiceAuthLayer,
+    getDeviceKeyUpload: () => Promise<IdentityDeviceKeyUpload>,
+  ) {
     if (authLayer) {
       this.authClient =
         IdentityServiceClientWrapper.createAuthClient(authLayer);
     }
     this.unauthClient = IdentityServiceClientWrapper.createUnauthClient();
+    this.getDeviceKeyUpload = getDeviceKeyUpload;
   }
 
   static determineSocketAddr(): string {
     return process.env.IDENTITY_SOCKET_ADDR ?? identityServiceConfig.defaultURL;
   }
 
   static createAuthClient(
     authLayer: IdentityServiceAuthLayer,
   ): IdentityAuthClient.IdentityClientServicePromiseClient {
     const { userID, deviceID, commServicesAccessToken } = authLayer;
 
     const identitySocketAddr =
       IdentityServiceClientWrapper.determineSocketAddr();
 
     const versionInterceptor = new VersionInterceptor<Request, Response>();
     const authInterceptor = new AuthInterceptor<Request, Response>(
       userID,
       deviceID,
       commServicesAccessToken,
     );
 
     const authClientOpts = {
       unaryInterceptors: [versionInterceptor, authInterceptor],
     };
 
     return new IdentityAuthClient.IdentityClientServicePromiseClient(
       identitySocketAddr,
       null,
       authClientOpts,
     );
   }
 
   static createUnauthClient(): IdentityUnauthClient.IdentityClientServicePromiseClient {
     const identitySocketAddr =
       IdentityServiceClientWrapper.determineSocketAddr();
 
     const versionInterceptor = new VersionInterceptor<Request, Response>();
 
     const unauthClientOpts = {
       unaryInterceptors: [versionInterceptor],
     };
 
     return new IdentityUnauthClient.IdentityClientServicePromiseClient(
       identitySocketAddr,
       null,
       unauthClientOpts,
     );
   }
 
   deleteUser: () => Promise<void> = async () => {
     if (!this.authClient) {
       throw new Error('Identity service client is not initialized');
     }
     await this.authClient.deleteUser(new Empty());
   };
 
   getKeyserverKeys: (keyserverID: string) => Promise<DeviceOlmOutboundKeys> =
     async (keyserverID: string) => {
       const client = this.authClient;
       if (!client) {
         throw new Error('Identity service client is not initialized');
       }
 
       const request = new IdentityAuthStructs.OutboundKeysForUserRequest();
       request.setUserId(keyserverID);
       const response = await client.getKeyserverKeys(request);
 
       const keyserverInfo = response.getKeyserverInfo();
       const identityInfo = keyserverInfo?.getIdentityInfo();
       const contentPreKey = keyserverInfo?.getContentPrekey();
       const notifPreKey = keyserverInfo?.getNotifPrekey();
       const payload = identityInfo?.getPayload();
 
       const keyserverKeys = {
         identityKeysBlob: payload ? JSON.parse(payload) : null,
         contentInitializationInfo: {
           prekey: contentPreKey?.getPrekey(),
           prekeySignature: contentPreKey?.getPrekeySignature(),
           oneTimeKey: keyserverInfo?.getOneTimeContentPrekey(),
         },
         notifInitializationInfo: {
           prekey: notifPreKey?.getPrekey(),
           prekeySignature: notifPreKey?.getPrekeySignature(),
           oneTimeKey: keyserverInfo?.getOneTimeNotifPrekey(),
         },
         payloadSignature: identityInfo?.getPayloadSignature(),
         socialProof: identityInfo?.getSocialProof(),
       };
 
       if (!keyserverKeys.contentInitializationInfo.oneTimeKey) {
         throw new Error('Missing content one time key');
       }
       if (!keyserverKeys.notifInitializationInfo.oneTimeKey) {
         throw new Error('Missing notif one time key');
       }
 
       return assertWithValidator(keyserverKeys, deviceOlmOutboundKeysValidator);
     };
 
   getOutboundKeysForUser: (
     userID: string,
   ) => Promise<UserDevicesOlmOutboundKeys[]> = async (userID: string) => {
     const client = this.authClient;
     if (!client) {
       throw new Error('Identity service client is not initialized');
     }
 
     const request = new IdentityAuthStructs.OutboundKeysForUserRequest();
     request.setUserId(userID);
     const response = await client.getOutboundKeysForUser(request);
     const devicesMap = response.toObject()?.devicesMap;
 
     if (!devicesMap || !Array.isArray(devicesMap)) {
       throw new Error('Invalid devicesMap');
     }
 
     const devicesKeys: (?UserDevicesOlmOutboundKeys)[] = devicesMap.map(
       ([deviceID, outboundKeysInfo]) => {
         const identityInfo = outboundKeysInfo?.identityInfo;
         const payload = identityInfo?.payload;
         const contentPreKey = outboundKeysInfo?.contentPrekey;
         const notifPreKey = outboundKeysInfo?.notifPrekey;
 
         if (!(typeof deviceID === 'string')) {
           console.log(`Invalid deviceID in devicesMap: ${deviceID}`);
           return null;
         }
 
         if (
           !outboundKeysInfo.oneTimeContentPrekey ||
           !outboundKeysInfo.oneTimeNotifPrekey
         ) {
           console.log(`Missing one time key for device ${deviceID}`);
           return {
             deviceID,
             keys: null,
           };
         }
 
         const deviceKeys = {
           identityKeysBlob: payload ? JSON.parse(payload) : null,
           contentInitializationInfo: {
             prekey: contentPreKey?.prekey,
             prekeySignature: contentPreKey?.prekeySignature,
             oneTimeKey: outboundKeysInfo.oneTimeContentPrekey,
           },
           notifInitializationInfo: {
             prekey: notifPreKey?.prekey,
             prekeySignature: notifPreKey?.prekeySignature,
             oneTimeKey: outboundKeysInfo.oneTimeNotifPrekey,
           },
           payloadSignature: identityInfo?.payloadSignature,
           socialProof: identityInfo?.socialProof,
         };
 
         try {
           const validatedKeys = assertWithValidator(
             deviceKeys,
             deviceOlmOutboundKeysValidator,
           );
           return {
             deviceID,
             keys: validatedKeys,
           };
         } catch (e) {
           console.log(e);
           return {
             deviceID,
             keys: null,
           };
         }
       },
     );
 
     return devicesKeys.filter(Boolean);
   };
+
+  logInPasswordUser: (
+    username: string,
+    password: string,
+  ) => Promise<IdentityAuthResult> = async (
+    username: string,
+    password: string,
+  ) => {
+    const client = this.unauthClient;
+    if (!client) {
+      throw new Error('Identity service client is not initialized');
+    }
+
+    const [identityDeviceKeyUpload] = await Promise.all([
+      this.getDeviceKeyUpload(),
+      initOpaque(),
+    ]);
+
+    const {
+      keyPayload,
+      keyPayloadSignature,
+      contentPrekey,
+      contentPrekeySignature,
+      notifPrekey,
+      notifPrekeySignature,
+      contentOneTimeKeys,
+      notifOneTimeKeys,
+    } = identityDeviceKeyUpload;
+
+    const contentOneTimeKeysArray = [...contentOneTimeKeys];
+    const notifOneTimeKeysArray = [...notifOneTimeKeys];
+
+    const opaqueLogin = new Login();
+    const startRequestBytes = opaqueLogin.start(password);
+
+    const identityKeyInfo = new IdentityKeyInfo();
+    identityKeyInfo.setPayload(keyPayload);
+    identityKeyInfo.setPayloadSignature(keyPayloadSignature);
+
+    const contentPrekeyUpload = new Prekey();
+    contentPrekeyUpload.setPrekey(contentPrekey);
+    contentPrekeyUpload.setPrekeySignature(contentPrekeySignature);
+
+    const notifPrekeyUpload = new Prekey();
+    notifPrekeyUpload.setPrekey(notifPrekey);
+    notifPrekeyUpload.setPrekeySignature(notifPrekeySignature);
+
+    const deviceKeyUpload = new DeviceKeyUpload();
+    deviceKeyUpload.setDeviceKeyInfo(identityKeyInfo);
+    deviceKeyUpload.setContentUpload(contentPrekeyUpload);
+    deviceKeyUpload.setNotifUpload(notifPrekeyUpload);
+    deviceKeyUpload.setOneTimeContentPrekeysList(contentOneTimeKeysArray);
+    deviceKeyUpload.setOneTimeNotifPrekeysList(notifOneTimeKeysArray);
+    deviceKeyUpload.setDeviceType(identityDeviceTypes.WEB);
+
+    const loginStartRequest = new OpaqueLoginStartRequest();
+    loginStartRequest.setUsername(username);
+    loginStartRequest.setOpaqueLoginRequest(startRequestBytes);
+    loginStartRequest.setDeviceKeyUpload(deviceKeyUpload);
+
+    let loginStartResponse;
+    try {
+      loginStartResponse =
+        await client.logInPasswordUserStart(loginStartRequest);
+    } catch (e) {
+      console.log('Error calling logInPasswordUserStart:', e);
+      throw new Error(
+        `logInPasswordUserStart RPC failed: ${
+          getMessageForException(e) ?? 'unknown'
+        }`,
+      );
+    }
+    const finishRequestBytes = opaqueLogin.finish(
+      loginStartResponse.getOpaqueLoginResponse_asU8(),
+    );
+
+    const loginFinishRequest = new OpaqueLoginFinishRequest();
+    loginFinishRequest.setSessionId(loginStartResponse.getSessionId());
+    loginFinishRequest.setOpaqueLoginUpload(finishRequestBytes);
+
+    let loginFinishResponse;
+    try {
+      loginFinishResponse =
+        await client.logInPasswordUserFinish(loginFinishRequest);
+    } catch (e) {
+      console.log('Error calling logInPasswordUserFinish:', e);
+      throw new Error(
+        `logInPasswordUserFinish RPC failed: ${
+          getMessageForException(e) ?? 'unknown'
+        }`,
+      );
+    }
+
+    const userID = loginFinishResponse.getUserId();
+    const accessToken = loginFinishResponse.getAccessToken();
+    const identityAuthResult = { accessToken, userID, username };
+
+    return assertWithValidator(identityAuthResult, identityAuthResultValidator);
+  };
 }
 
 export { IdentityServiceClientWrapper };
diff --git a/web/grpc/identity-service-context-provider.react.js b/web/grpc/identity-service-context-provider.react.js
index 7282e6f0a..4004af233 100644
--- a/web/grpc/identity-service-context-provider.react.js
+++ b/web/grpc/identity-service-context-provider.react.js
@@ -1,61 +1,63 @@
 // @flow
 
 import * as React from 'react';
 
 import {
   IdentityClientContext,
   type AuthMetadata,
 } from 'lib/shared/identity-client-context.js';
 
 import { IdentityServiceClientWrapper } from './identity-service-client-wrapper.js';
+import { useGetDeviceKeyUpload } from '../account/account-hooks.js';
 import { useSelector } from '../redux/redux-utils.js';
 
 type Props = {
   +children: React.Node,
 };
 function IdentityServiceContextProvider(props: Props): React.Node {
   const { children } = props;
 
   const userID = useSelector(state => state.currentUserInfo?.id);
   const accessToken = useSelector(state => state.commServicesAccessToken);
   const deviceID = useSelector(
     state => state.cryptoStore?.primaryIdentityKeys.ed25519,
   );
+  const getDeviceKeyUpload = useGetDeviceKeyUpload();
 
   const client = React.useMemo(() => {
     let authLayer = null;
     if (userID && deviceID && accessToken) {
       authLayer = {
         userID,
         deviceID,
         commServicesAccessToken: accessToken,
       };
     }
-    return new IdentityServiceClientWrapper(authLayer);
-  }, [accessToken, deviceID, userID]);
+    return new IdentityServiceClientWrapper(authLayer, getDeviceKeyUpload);
+  }, [accessToken, deviceID, getDeviceKeyUpload, userID]);
 
   const getAuthMetadata = React.useCallback<() => Promise<AuthMetadata>>(
     async () => ({
       userID,
       deviceID,
       accessToken,
     }),
     [accessToken, deviceID, userID],
   );
 
   const value = React.useMemo(
     () => ({
       identityClient: client,
       getAuthMetadata,
     }),
     [client, getAuthMetadata],
   );
 
   return (
     <IdentityClientContext.Provider value={value}>
       {children}
     </IdentityClientContext.Provider>
   );
 }
 
 export default IdentityServiceContextProvider;