diff --git a/Examples/OneSignalDemo/app/src/main/java/com/onesignal/sdktest/application/MainApplication.java b/Examples/OneSignalDemo/app/src/main/java/com/onesignal/sdktest/application/MainApplication.java
index 3050d96fc4..37d0b6c542 100644
--- a/Examples/OneSignalDemo/app/src/main/java/com/onesignal/sdktest/application/MainApplication.java
+++ b/Examples/OneSignalDemo/app/src/main/java/com/onesignal/sdktest/application/MainApplication.java
@@ -6,9 +6,10 @@
 import androidx.annotation.NonNull;
 import androidx.annotation.Nullable;
 import androidx.multidex.MultiDexApplication;
-
 import com.onesignal.Continue;
+import com.onesignal.IUserJwtInvalidatedListener;
 import com.onesignal.OneSignal;
+import com.onesignal.UserJwtInvalidatedEvent;
 import com.onesignal.inAppMessages.IInAppMessageClickListener;
 import com.onesignal.inAppMessages.IInAppMessageClickEvent;
 import com.onesignal.inAppMessages.IInAppMessageDidDismissEvent;
@@ -140,6 +141,13 @@ public void onUserStateChange(@NonNull UserChangedState state) {
             }
         });
 
+        OneSignal.addUserJwtInvalidatedListner(new IUserJwtInvalidatedListener() {
+            @Override
+            public void onUserJwtInvalidated(@NonNull UserJwtInvalidatedEvent event) {
+                Log.v(Tag.LOG_TAG, "onUserJwtInvalidated fired with ID:" + event.getExternalId());
+            }
+        });
+
         OneSignal.getInAppMessages().setPaused(true);
         OneSignal.getLocation().setShared(false);
 
diff --git a/Examples/OneSignalDemo/app/src/main/java/com/onesignal/sdktest/model/MainActivityViewModel.java b/Examples/OneSignalDemo/app/src/main/java/com/onesignal/sdktest/model/MainActivityViewModel.java
index 58069a298c..dc84e28a9e 100644
--- a/Examples/OneSignalDemo/app/src/main/java/com/onesignal/sdktest/model/MainActivityViewModel.java
+++ b/Examples/OneSignalDemo/app/src/main/java/com/onesignal/sdktest/model/MainActivityViewModel.java
@@ -18,6 +18,7 @@
 import android.view.View;
 import android.view.ViewTreeObserver;
 import android.widget.Button;
+import android.widget.EditText;
 import android.widget.LinearLayout;
 import android.widget.RelativeLayout;
 import android.widget.Switch;
@@ -83,6 +84,10 @@ public class MainActivityViewModel implements ActivityViewModel, IPushSubscripti
     private Button loginUserButton;
     private Button logoutUserButton;
 
+    // JWT
+    private Button invalidateJwtButton;
+    private Button updateJwtButton;
+
     // Alias
     private TextView aliasTitleTextView;
     private RecyclerView aliasesRecyclerView;
@@ -211,6 +216,9 @@ public ActivityViewModel onActivityCreated(Context context) {
         loginUserButton = getActivity().findViewById(R.id.main_activity_login_user_button);
         logoutUserButton = getActivity().findViewById(R.id.main_activity_logout_user_button);
 
+        invalidateJwtButton = getActivity().findViewById(R.id.main_activity_invalidate_jwt_button);
+        updateJwtButton = getActivity().findViewById(R.id.main_activity_update_jwt_button);
+
         aliasTitleTextView = getActivity().findViewById(R.id.main_activity_aliases_title_text_view);
         noAliasesTextView = getActivity().findViewById(R.id.main_activity_aliases_no_aliases_text_view);
         addAliasButton = getActivity().findViewById(R.id.main_activity_add_alias_button);
@@ -422,6 +430,7 @@ public void onFailure() {
     }
 
     private void setupUserLayout() {
+        setupJWTLayout();
         setupAliasLayout();
         setupEmailLayout();
         setupSMSLayout();
@@ -430,6 +439,28 @@ private void setupUserLayout() {
         setupTriggersLayout();
     }
 
+    private void setupJWTLayout() {
+        invalidateJwtButton.setOnClickListener(v -> {
+            OneSignal.updateUserJwt(OneSignal.getUser().getExternalId(), "");
+        });
+        updateJwtButton.setOnClickListener(v -> {
+            dialog.createUpdateAlertDialog("", Dialog.DialogAction.UPDATE, ProfileUtil.FieldType.JWT, new UpdateAlertDialogCallback() {
+                @Override
+                public void onSuccess(String update) {
+                    if (update != null && !update.isEmpty()) {
+                        OneSignal.updateUserJwt(OneSignal.getUser().getExternalId(), update);
+                        refreshState();
+                    }
+                }
+
+                @Override
+                public void onFailure() {
+
+                }
+            });
+        });
+    }
+
     private void setupAliasLayout() {
         setupAliasesRecyclerView();
         addAliasButton.setOnClickListener(v -> dialog.createAddPairAlertDialog("Add Alias", ProfileUtil.FieldType.ALIAS, new AddPairAlertDialogCallback() {
diff --git a/Examples/OneSignalDemo/app/src/main/java/com/onesignal/sdktest/util/ProfileUtil.java b/Examples/OneSignalDemo/app/src/main/java/com/onesignal/sdktest/util/ProfileUtil.java
index 9a026c5f47..c48edd4d4f 100644
--- a/Examples/OneSignalDemo/app/src/main/java/com/onesignal/sdktest/util/ProfileUtil.java
+++ b/Examples/OneSignalDemo/app/src/main/java/com/onesignal/sdktest/util/ProfileUtil.java
@@ -13,6 +13,7 @@ public enum FieldType {
         ALIAS("Alias"),
         EMAIL("Email"),
         SMS("SMS"),
+        JWT("JWT"),
         EXTERNAL_USER_ID("External User Id"),
 
         TAG("Tags"),
@@ -97,6 +98,10 @@ public static boolean isSMSValid(TextInputLayout smsTextInputLayout) {
         return true;
     }
 
+    private static boolean isJWTValid(TextInputLayout jwtTextInputLayout) {
+        return !jwtTextInputLayout.getEditText().toString().isEmpty();
+    }
+
     private static boolean isExternalUserIdValid(TextInputLayout externalUserIdTextInputLayout) {
         externalUserIdTextInputLayout.setErrorEnabled(false);
         if (externalUserIdTextInputLayout.getEditText() != null) {
@@ -137,6 +142,8 @@ static boolean isContentValid(FieldType field, TextInputLayout alertDialogTextIn
                 return isEmailValid(alertDialogTextInputLayout);
             case SMS:
                 return isSMSValid(alertDialogTextInputLayout);
+            case JWT:
+                return isJWTValid(alertDialogTextInputLayout);
             case EXTERNAL_USER_ID:
                 return isExternalUserIdValid(alertDialogTextInputLayout);
             case TAG:
diff --git a/Examples/OneSignalDemo/app/src/main/res/layout/main_activity_layout.xml b/Examples/OneSignalDemo/app/src/main/res/layout/main_activity_layout.xml
index ee4ce93cb5..f3eb64a051 100644
--- a/Examples/OneSignalDemo/app/src/main/res/layout/main_activity_layout.xml
+++ b/Examples/OneSignalDemo/app/src/main/res/layout/main_activity_layout.xml
@@ -152,20 +152,20 @@
                     android:layout_width="wrap_content"
                     android:layout_height="wrap_content"
                     android:layout_gravity="start|center_vertical"
-                    android:gravity="start|center_vertical"
-                    android:layout_marginBottom="4dp"
                     android:layout_marginStart="12dp"
                     android:layout_marginLeft="12dp"
+                    android:layout_marginBottom="4dp"
+                    android:gravity="start|center_vertical"
                     android:text="@string/app"
                     android:textColor="@color/colorDarkText" />
 
                 <androidx.cardview.widget.CardView
                     android:layout_width="match_parent"
                     android:layout_height="wrap_content"
-                    android:layout_marginTop="4dp"
-                    android:layout_marginBottom="12dp"
                     android:layout_marginStart="12dp"
+                    android:layout_marginTop="4dp"
                     android:layout_marginEnd="12dp"
+                    android:layout_marginBottom="12dp"
                     app:cardCornerRadius="6dp"
                     app:cardElevation="4dp">
 
@@ -226,23 +226,23 @@
                     android:layout_width="match_parent"
                     android:layout_height="56dp"
                     android:layout_gravity="center"
-                    android:gravity="center"
                     android:layout_marginStart="12dp"
                     android:layout_marginTop="4dp"
                     android:layout_marginEnd="12dp"
                     android:layout_marginBottom="12dp"
-                    android:orientation="vertical"
-                    android:background="@color/colorPrimary">
+                    android:background="@color/colorPrimary"
+                    android:gravity="center"
+                    android:orientation="vertical">
 
                     <Button
                         android:id="@+id/main_activity_app_revoke_consent_button"
                         android:layout_width="match_parent"
                         android:layout_height="match_parent"
+                        android:background="@drawable/ripple_selector_white_red"
                         android:text="@string/revoke_consent"
-                        android:textSize="19sp"
                         android:textColor="@android:color/white"
-                        android:background="@drawable/ripple_selector_white_red"
-                        android:visibility="visible"/>
+                        android:textSize="19sp"
+                        android:visibility="visible" />
 
                 </LinearLayout>
 
@@ -263,11 +263,11 @@
                         android:id="@+id/main_activity_login_user_button"
                         android:layout_width="match_parent"
                         android:layout_height="match_parent"
+                        android:background="@drawable/ripple_selector_white_red"
                         android:text="@string/login_user"
-                        android:textSize="19sp"
                         android:textColor="@android:color/white"
-                        android:background="@drawable/ripple_selector_white_red"
-                        android:visibility="visible"/>
+                        android:textSize="19sp"
+                        android:visibility="visible" />
 
                 </LinearLayout>
 
@@ -288,14 +288,97 @@
                         android:id="@+id/main_activity_logout_user_button"
                         android:layout_width="match_parent"
                         android:layout_height="match_parent"
+                        android:background="@drawable/ripple_selector_white_red"
                         android:text="@string/logout_user"
-                        android:textSize="19sp"
                         android:textColor="@android:color/white"
-                        android:background="@drawable/ripple_selector_white_red"
-                        android:visibility="visible"/>
+                        android:textSize="19sp"
+                        android:visibility="visible" />
                 </LinearLayout>
             </LinearLayout>
 
+            <LinearLayout
+                android:id="@+id/main_activity_jwt_linear_layout"
+                android:layout_width="match_parent"
+                android:layout_height="match_parent"
+                android:clipChildren="false"
+                android:clipToPadding="false"
+                android:orientation="vertical">
+
+                <TextView
+                    android:id="@+id/main_activity_jwt_title_text_view"
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:layout_gravity="start|center_vertical"
+                    android:layout_marginStart="12dp"
+                    android:layout_marginLeft="12dp"
+                    android:layout_marginBottom="4dp"
+                    android:gravity="start|center_vertical"
+                    android:text="@string/JWT"
+                    android:textColor="@color/colorDarkText" />
+
+                <androidx.cardview.widget.CardView
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginStart="12dp"
+                    android:layout_marginTop="4dp"
+                    android:layout_marginEnd="12dp"
+                    android:layout_marginBottom="12dp"
+                    app:cardCornerRadius="6dp"
+                    app:cardElevation="4dp">
+
+                    <LinearLayout
+                        android:id="@+id/main_activity_jwt_details_linear_layout"
+                        android:layout_width="match_parent"
+                        android:layout_height="wrap_content"
+                        android:orientation="vertical">
+
+                        <LinearLayout
+                            android:layout_width="match_parent"
+                            android:layout_height="match_parent"
+                            android:layout_gravity="center"
+                            android:layout_marginTop="4dp"
+                            android:background="@color/colorPrimary"
+                            android:gravity="center"
+                            android:orientation="vertical">
+
+                            <Button
+                                android:id="@+id/main_activity_invalidate_jwt_button"
+                                android:layout_width="match_parent"
+                                android:layout_height="match_parent"
+                                android:background="@drawable/ripple_selector_white_red"
+                                android:text="@string/invalidate_JWT"
+                                android:textColor="@android:color/white"
+                                android:textSize="19sp"
+                                android:visibility="visible" />
+
+                        </LinearLayout>
+
+                        <LinearLayout
+                            android:layout_width="match_parent"
+                            android:layout_height="match_parent"
+                            android:layout_gravity="center"
+                            android:layout_marginTop="4dp"
+                            android:background="@color/colorPrimary"
+                            android:gravity="center"
+                            android:orientation="vertical">
+
+                            <Button
+                                android:id="@+id/main_activity_update_jwt_button"
+                                android:layout_width="match_parent"
+                                android:layout_height="match_parent"
+                                android:background="@drawable/ripple_selector_white_red"
+                                android:text="@string/update_JWT"
+                                android:textColor="@android:color/white"
+                                android:textSize="19sp"
+                                android:visibility="visible" />
+                        </LinearLayout>
+
+                    </LinearLayout>
+
+                </androidx.cardview.widget.CardView>
+
+            </LinearLayout>
+
             <!-- Aliases -->
             <LinearLayout
                 android:id="@+id/main_activity_aliases_linear_layout"
diff --git a/Examples/OneSignalDemo/app/src/main/res/values/strings.xml b/Examples/OneSignalDemo/app/src/main/res/values/strings.xml
index 6fb52127e5..709c0c571f 100644
--- a/Examples/OneSignalDemo/app/src/main/res/values/strings.xml
+++ b/Examples/OneSignalDemo/app/src/main/res/values/strings.xml
@@ -9,6 +9,11 @@
     <string name="login_user">Login User</string>
     <string name="logout_user">Logout User</string>
 
+    <string name="JWT">JWT</string>
+    <string name="invalidate_JWT">Invalidate JWT</string>
+    <string name="update_JWT">Update JWT</string>
+    <string name="no_jwt_added">No JWT Added</string>
+
     <string name="aliases">Aliases</string>
     <string name="external_user_id_colon">EUID:</string>
     <string name="no_aliases_added">No Aliases Added</string>
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/IOneSignal.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/IOneSignal.kt
index cb707e4fe4..38c4d7db33 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/IOneSignal.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/IOneSignal.kt
@@ -123,4 +123,16 @@ interface IOneSignal {
      * data is not cleared.
      */
     fun logout()
+
+    /**
+     * Update JWT token for a user
+     */
+    fun updateUserJwt(
+        externalId: String,
+        token: String,
+    )
+
+    fun addUserJwtInvalidatedListener(listener: IUserJwtInvalidatedListener)
+
+    fun removeUserJwtInvalidatedListener(listener: IUserJwtInvalidatedListener)
 }
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/IUserJwtInvalidatedListener.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/IUserJwtInvalidatedListener.kt
new file mode 100644
index 0000000000..46d43ea292
--- /dev/null
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/IUserJwtInvalidatedListener.kt
@@ -0,0 +1,16 @@
+package com.onesignal
+
+/**
+ * Implement this interface and provide an instance to [OneSignal.addUserJwtInvalidatedListner]
+ * in order to receive control when the JWT for the current user is invalidated.
+ *
+ * @see [User JWT Invalidated Event | OneSignal Docs](https://documentation.onesignal.com/docs/identity-verification)
+ */
+interface IUserJwtInvalidatedListener {
+    /**
+     * Called when the JWT is invalidated
+     *
+     * @param event The user JWT that expired.
+     */
+    fun onUserJwtInvalidated(event: UserJwtInvalidatedEvent)
+}
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/OneSignal.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/OneSignal.kt
index 580cd63252..ec686a9d10 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/OneSignal.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/OneSignal.kt
@@ -192,6 +192,24 @@ object OneSignal {
     @JvmStatic
     fun logout() = oneSignal.logout()
 
+    @JvmStatic
+    fun updateUserJwt(
+        externalId: String,
+        token: String,
+    ) {
+        oneSignal.updateUserJwt(externalId, token)
+    }
+
+    @JvmStatic
+    fun addUserJwtInvalidatedListner(listener: IUserJwtInvalidatedListener) {
+        oneSignal.addUserJwtInvalidatedListener(listener)
+    }
+
+    @JvmStatic
+    fun removeUserJwtInvalidatedListner(listener: IUserJwtInvalidatedListener) {
+        oneSignal.removeUserJwtInvalidatedListener(listener)
+    }
+
     private val oneSignal: IOneSignal by lazy {
         OneSignalImp()
     }
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/UserJwtInvalidatedEvent.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/UserJwtInvalidatedEvent.kt
new file mode 100644
index 0000000000..c8c37a67e9
--- /dev/null
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/UserJwtInvalidatedEvent.kt
@@ -0,0 +1,11 @@
+package com.onesignal
+
+/**
+ * The event passed into [IUserJwtInvalidatedListener.onUserJwtInvalidated], it provides access
+ * to the external ID whose JWT has just been invalidated.
+ *
+ * For more information https://documentation.onesignal.com/docs/identity-verification#4-handle-jwt-lifecycle-events
+ */
+class UserJwtInvalidatedEvent(
+    val externalId: String,
+)
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/CoreModule.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/CoreModule.kt
index 6d36caaf9f..4d1a921fef 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/CoreModule.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/CoreModule.kt
@@ -31,6 +31,7 @@ import com.onesignal.core.internal.preferences.IPreferencesService
 import com.onesignal.core.internal.preferences.impl.PreferencesService
 import com.onesignal.core.internal.purchases.impl.TrackAmazonPurchase
 import com.onesignal.core.internal.purchases.impl.TrackGooglePurchase
+import com.onesignal.core.internal.startup.IBootstrapService
 import com.onesignal.core.internal.startup.IStartableService
 import com.onesignal.core.internal.time.ITime
 import com.onesignal.core.internal.time.impl.Time
@@ -40,6 +41,7 @@ import com.onesignal.location.ILocationManager
 import com.onesignal.location.internal.MisconfiguredLocationManager
 import com.onesignal.notifications.INotificationsManager
 import com.onesignal.notifications.internal.MisconfiguredNotificationsManager
+import com.onesignal.user.internal.service.IdentityVerificationService
 
 internal class CoreModule : IModule {
     override fun register(builder: ServiceBuilder) {
@@ -59,6 +61,7 @@ internal class CoreModule : IModule {
         builder.register<ConfigModelStore>().provides<ConfigModelStore>()
         builder.register<ParamsBackendService>().provides<IParamsBackendService>()
         builder.register<ConfigModelStoreListener>().provides<IStartableService>()
+        builder.register<IdentityVerificationService>().provides<IBootstrapService>()
 
         // Operations
         builder.register<OperationModelStore>().provides<OperationModelStore>()
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/backend/impl/ParamsBackendService.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/backend/impl/ParamsBackendService.kt
index 85dd452d41..a29f66b522 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/backend/impl/ParamsBackendService.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/backend/impl/ParamsBackendService.kt
@@ -61,7 +61,7 @@ internal class ParamsBackendService(
             googleProjectNumber = responseJson.safeString("android_sender_id"),
             enterprise = responseJson.safeBool("enterp"),
             // TODO: New
-            useIdentityVerification = responseJson.safeBool("require_ident_auth"),
+            useIdentityVerification = responseJson.safeBool("jwt_required"),
             notificationChannels = responseJson.optJSONArray("chnl_lst"),
             firebaseAnalytics = responseJson.safeBool("fba"),
             restoreTTLFilter = responseJson.safeBool("restore_ttl_filter"),
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/config/impl/ConfigModelStoreListener.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/config/impl/ConfigModelStoreListener.kt
index 87d7eae6b0..16144c4167 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/config/impl/ConfigModelStoreListener.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/config/impl/ConfigModelStoreListener.kt
@@ -72,7 +72,6 @@ internal class ConfigModelStoreListener(
                     // copy current model into new model, then override with what comes down.
                     val config = ConfigModel()
                     config.initializeFromModel(null, _configModelStore.model)
-
                     config.isInitializedWithRemote = true
 
                     // these are always copied from the backend params
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/http/impl/HttpClient.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/http/impl/HttpClient.kt
index f74a76bc2b..7183c6e56d 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/http/impl/HttpClient.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/http/impl/HttpClient.kt
@@ -80,7 +80,10 @@ internal class HttpClient(
         // If privacy consent is required but not yet given, any non-GET request should be blocked.
         if (method != null && _configModelStore.model.consentRequired == true && _configModelStore.model.consentGiven != true) {
             Logging.warn(
-                "$method `$url` was called before the user provided privacy consent. Your application is set to require the user's privacy consent before the OneSignal SDK can be initialized. Please ensure the user has provided consent before calling this method. You can check the latest OneSignal consent status by calling OneSignal.privacyConsent",
+                "$method `$url` was called before the user provided privacy consent. " +
+                    "Your application is set to require the user's privacy consent before the OneSignal SDK can be initialized. " +
+                    "Please ensure the user has provided consent before calling this method. You can check the latest OneSignal " +
+                    "consent status by calling OneSignal.privacyConsent",
             )
             return HttpResponse(0, null, null)
         }
@@ -137,6 +140,11 @@ internal class HttpClient(
                     con.readTimeout = timeout
                     con.setRequestProperty("SDK-Version", "onesignal/android/" + OneSignalUtils.SDK_VERSION)
 
+                    val jwt = headers?.jwt
+                    if (jwt != null) {
+                        con.setRequestProperty("Authorization", "Bearer $jwt")
+                    }
+
                     if (OneSignalWrapper.sdkType != null && OneSignalWrapper.sdkVersion != null) {
                         con.setRequestProperty("SDK-Wrapper", "onesignal/${OneSignalWrapper.sdkType}/${OneSignalWrapper.sdkVersion}")
                     }
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/http/impl/OptionalHeaders.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/http/impl/OptionalHeaders.kt
index f566fd04fc..83e758599f 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/http/impl/OptionalHeaders.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/http/impl/OptionalHeaders.kt
@@ -17,4 +17,5 @@ data class OptionalHeaders(
      * Used to track delay between session start and request
      */
     val sessionDuration: Long? = null,
+    val jwt: String? = null,
 )
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/operations/impl/OperationRepo.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/operations/impl/OperationRepo.kt
index 7ed6336d4e..83912efd5a 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/operations/impl/OperationRepo.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/operations/impl/OperationRepo.kt
@@ -11,6 +11,7 @@ import com.onesignal.core.internal.startup.IStartableService
 import com.onesignal.core.internal.time.ITime
 import com.onesignal.debug.LogLevel
 import com.onesignal.debug.internal.logging.Logging
+import com.onesignal.user.internal.identity.IdentityModelStore
 import com.onesignal.user.internal.operations.impl.states.NewRecordsState
 import kotlinx.coroutines.CompletableDeferred
 import kotlinx.coroutines.CoroutineScope
@@ -26,6 +27,7 @@ internal class OperationRepo(
     executors: List<IOperationExecutor>,
     private val _operationModelStore: OperationModelStore,
     private val _configModelStore: ConfigModelStore,
+    private val _identityModelStore: IdentityModelStore,
     private val _time: ITime,
     private val _newRecordState: NewRecordsState,
 ) : IOperationRepo, IStartableService {
@@ -94,7 +96,6 @@ internal class OperationRepo(
     }
 
     override fun start() {
-        paused = false
         coroutineScope.launch {
             // load saved operations first then start processing the queue to ensure correct operation order
             loadSavedOperations()
@@ -262,7 +263,15 @@ internal class OperationRepo(
                     ops.forEach { _operationModelStore.remove(it.operation.id) }
                     ops.forEach { it.waiter?.wake(true) }
                 }
-                ExecutionResult.FAIL_UNAUTHORIZED, // TODO: Need to provide callback for app to reset JWT. For now, fail with no retry.
+                ExecutionResult.FAIL_UNAUTHORIZED -> {
+                    Logging.error("Operation execution failed with invalid jwt")
+                    _identityModelStore.invalidateJwt()
+
+                    // add back all operations to the front of the queue to be re-executed.
+                    synchronized(queue) {
+                        ops.reversed().forEach { queue.add(0, it) }
+                    }
+                }
                 ExecutionResult.FAIL_NORETRY,
                 ExecutionResult.FAIL_CONFLICT,
                 -> {
@@ -347,6 +356,13 @@ internal class OperationRepo(
 
     internal fun getNextOps(bucketFilter: Int): List<OperationQueueItem>? {
         return synchronized(queue) {
+            // Ensure the operation does not have empty JWT if identity verification is on
+            if (_configModelStore.model.useIdentityVerification &&
+                _identityModelStore.model.jwtToken == null
+            ) {
+                return null
+            }
+
             val startingOp =
                 queue.firstOrNull {
                     it.operation.canStartExecute &&
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/internal/OneSignalImp.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/internal/OneSignalImp.kt
index 7babf5067b..eee48bc89b 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/internal/OneSignalImp.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/internal/OneSignalImp.kt
@@ -3,6 +3,7 @@ package com.onesignal.internal
 import android.content.Context
 import android.os.Build
 import com.onesignal.IOneSignal
+import com.onesignal.IUserJwtInvalidatedListener
 import com.onesignal.common.AndroidUtils
 import com.onesignal.common.DeviceUtils
 import com.onesignal.common.IDManager
@@ -147,6 +148,8 @@ internal class OneSignalImp : IOneSignal, IServiceProvider {
     private var _disableGMSMissingPrompt: Boolean? = null
     private val initLock: Any = Any()
     private val loginLock: Any = Any()
+    private val useIdentityVerification: Boolean
+        get() = configModel?.useIdentityVerification ?: true
 
     private val listOfModules =
         listOf(
@@ -205,7 +208,6 @@ internal class OneSignalImp : IOneSignal, IServiceProvider {
 
             // Give the logging singleton access to the application service to support visual logging.
             Logging.applicationService = applicationService
-
             // get the current config model, if there is one
             configModel = services.getService<ConfigModelStore>().model
             sessionModel = services.getService<SessionModelStore>().model
@@ -255,14 +257,7 @@ internal class OneSignalImp : IOneSignal, IServiceProvider {
                     )
                 if (legacyPlayerId == null) {
                     Logging.debug("initWithContext: creating new device-scoped user")
-                    createAndSwitchToNewUser()
-                    operationRepo!!.enqueue(
-                        LoginUserOperation(
-                            configModel!!.appId,
-                            identityModelStore!!.model.onesignalId,
-                            identityModelStore!!.model.externalId,
-                        ),
-                    )
+                    createAndSwitchToNewUser(suppressBackendOperation = true)
                 } else {
                     Logging.debug("initWithContext: creating user linked to subscription $legacyPlayerId")
 
@@ -284,7 +279,8 @@ internal class OneSignalImp : IOneSignal, IServiceProvider {
                         pushSubscriptionModel.id = legacyPlayerId
                         pushSubscriptionModel.type = SubscriptionType.PUSH
                         pushSubscriptionModel.optedIn =
-                            notificationTypes != SubscriptionStatus.NO_PERMISSION.value && notificationTypes != SubscriptionStatus.UNSUBSCRIBE.value
+                            notificationTypes != SubscriptionStatus.NO_PERMISSION.value &&
+                            notificationTypes != SubscriptionStatus.UNSUBSCRIBE.value
                         pushSubscriptionModel.address =
                             legacyUserSyncJSON.safeString("identifier") ?: ""
                         if (notificationTypes != null) {
@@ -310,8 +306,10 @@ internal class OneSignalImp : IOneSignal, IServiceProvider {
                         suppressBackendOperation = true
                     }
 
-                    createAndSwitchToNewUser(suppressBackendOperation = suppressBackendOperation)
+                    createAndSwitchToNewUser(suppressBackendOperation = true)
 
+                    // This operation will be dropped if identity verification is on at the time the operation
+                    // is being processed
                     operationRepo!!.enqueue(
                         LoginUserFromSubscriptionOperation(
                             configModel!!.appId,
@@ -357,12 +355,15 @@ internal class OneSignalImp : IOneSignal, IServiceProvider {
             currentIdentityOneSignalId = identityModelStore!!.model.onesignalId
 
             if (currentIdentityExternalId == externalId) {
+                // login is for same user that is already logged in, fetch (refresh)
+                // the current user.
+                identityModelStore!!.model.jwtToken = jwtBearerToken
                 return
             }
 
-            // TODO: Set JWT Token for all future requests.
-            createAndSwitchToNewUser { identityModel, _ ->
+            createAndSwitchToNewUser(suppressBackendOperation = false) { identityModel, _ ->
                 identityModel.externalId = externalId
+                identityModel.jwtToken = jwtBearerToken
             }
 
             newIdentityOneSignalId = identityModelStore!!.model.onesignalId
@@ -376,16 +377,16 @@ internal class OneSignalImp : IOneSignal, IServiceProvider {
             // time if network conditions prevent the operation to succeed.  This allows us to
             // provide a callback to the caller when we can absolutely say the user is logged
             // in, so they may take action on their own backend.
-            val result =
-                operationRepo!!.enqueueAndWait(
-                    LoginUserOperation(
-                        configModel!!.appId,
-                        newIdentityOneSignalId,
-                        externalId,
-                        if (currentIdentityExternalId == null) currentIdentityOneSignalId else null,
-                    ),
+
+            val operation =
+                LoginUserOperation(
+                    configModel!!.appId,
+                    identityModelStore?.model?.onesignalId ?: newIdentityOneSignalId,
+                    identityModelStore?.model?.externalId ?: externalId,
+                    if (!useIdentityVerification && currentIdentityExternalId == null) currentIdentityOneSignalId else null,
                 )
 
+            val result = operationRepo!!.enqueueAndWait(operation)
             if (!result) {
                 Logging.log(LogLevel.ERROR, "Could not login user")
             }
@@ -405,17 +406,48 @@ internal class OneSignalImp : IOneSignal, IServiceProvider {
                 return
             }
 
+            // calling createAndSwitchToNewUser() replaces model with a default empty jwt
             createAndSwitchToNewUser()
-            operationRepo!!.enqueue(
-                LoginUserOperation(
-                    configModel!!.appId,
-                    identityModelStore!!.model.onesignalId,
-                    identityModelStore!!.model.externalId,
-                ),
-            )
 
-            // TODO: remove JWT Token for all future requests.
+            if (useIdentityVerification) {
+                // disable subscription if identity verification is on
+                user.pushSubscription.optOut()
+            } else {
+                // login to the anonymous user if identity verification is off
+                operationRepo!!.enqueue(
+                    LoginUserOperation(
+                        configModel!!.appId,
+                        identityModelStore!!.model.onesignalId,
+                        identityModelStore!!.model.externalId,
+                    ),
+                )
+            }
+        }
+    }
+
+    override fun updateUserJwt(
+        externalId: String,
+        token: String,
+    ) {
+        // update the model with the given externalId
+        for (model in identityModelStore!!.store.list()) {
+            if (externalId == model.externalId) {
+                identityModelStore!!.model.jwtToken = token
+                operationRepo!!.forceExecuteOperations()
+                Logging.log(LogLevel.DEBUG, "JWT $token is updated for externalId $externalId")
+                return
+            }
         }
+
+        Logging.log(LogLevel.DEBUG, "No identity found for externalId $externalId")
+    }
+
+    override fun addUserJwtInvalidatedListener(listener: IUserJwtInvalidatedListener) {
+        user.addUserJwtInvalidatedListener(listener)
+    }
+
+    override fun removeUserJwtInvalidatedListener(listener: IUserJwtInvalidatedListener) {
+        user.removeUserJwtInvalidatedListener(listener)
     }
 
     private fun createAndSwitchToNewUser(
@@ -439,6 +471,20 @@ internal class OneSignalImp : IOneSignal, IServiceProvider {
             modify(identityModel, propertiesModel)
         }
 
+        if (identityModel.jwtToken != null) {
+            setupNewSubscription(identityModel, propertiesModel, suppressBackendOperation, sdkId)
+        }
+
+        identityModelStore!!.replace(identityModel)
+        propertiesModelStore!!.replace(propertiesModel)
+    }
+
+    private fun setupNewSubscription(
+        identityModel: IdentityModel,
+        propertiesModel: PropertiesModel,
+        suppressBackendOperation: Boolean,
+        sdkId: String,
+    ) {
         val subscriptions = mutableListOf<SubscriptionModel>()
 
         // Create the push subscription for this device under the new user, copying the current
@@ -447,7 +493,7 @@ internal class OneSignalImp : IOneSignal, IServiceProvider {
         // will be automatically transferred over to this new user being created.  If there is no
         // current push subscription we do a "normal" replace which will drive adding a CreateSubscriptionOperation
         // to the queue.
-        val currentPushSubscription = subscriptionModelStore!!.list().firstOrNull { it.id == configModel!!.pushSubscriptionId }
+        val currentPushSubscription = subscriptionModelStore!!.list().firstOrNull { it.type == SubscriptionType.PUSH }
         val newPushSubscription = SubscriptionModel()
 
         newPushSubscription.id = currentPushSubscription?.id ?: IDManager.createLocalId()
@@ -475,7 +521,8 @@ internal class OneSignalImp : IOneSignal, IServiceProvider {
 
         if (suppressBackendOperation) {
             subscriptionModelStore!!.replaceAll(subscriptions, ModelChangeTags.NO_PROPOGATE)
-        } else if (currentPushSubscription != null) {
+        } else if (currentPushSubscription != null && (!useIdentityVerification || !IDManager.isLocalId(currentPushSubscription.id))) {
+            //
             operationRepo!!.enqueue(TransferSubscriptionOperation(configModel!!.appId, currentPushSubscription.id, sdkId))
             subscriptionModelStore!!.replaceAll(subscriptions, ModelChangeTags.NO_PROPOGATE)
         } else {
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/IUserManager.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/IUserManager.kt
index 2b71ca11de..d2076acc91 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/IUserManager.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/IUserManager.kt
@@ -1,5 +1,6 @@
 package com.onesignal.user
 
+import com.onesignal.IUserJwtInvalidatedListener
 import com.onesignal.OneSignal
 import com.onesignal.user.state.IUserStateObserver
 import com.onesignal.user.subscriptions.IPushSubscription
@@ -166,4 +167,11 @@ interface IUserManager {
      * Remove an observer from the user state.
      */
     fun removeObserver(observer: IUserStateObserver)
+
+    /**
+     * Add an event listener allowing user to be notified when the JWT is invalidated.
+     */
+    fun addUserJwtInvalidatedListener(listener: IUserJwtInvalidatedListener)
+
+    fun removeUserJwtInvalidatedListener(listener: IUserJwtInvalidatedListener)
 }
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/UserManager.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/UserManager.kt
index 934d233183..8183361d49 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/UserManager.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/UserManager.kt
@@ -1,5 +1,7 @@
 package com.onesignal.user.internal
 
+import com.onesignal.IUserJwtInvalidatedListener
+import com.onesignal.UserJwtInvalidatedEvent
 import com.onesignal.common.IDManager
 import com.onesignal.common.OneSignalUtils
 import com.onesignal.common.events.EventProducer
@@ -41,6 +43,10 @@ internal open class UserManager(
 
     val changeHandlersNotifier = EventProducer<IUserStateObserver>()
 
+    val jwtInvalidatedCallback = EventProducer<IUserJwtInvalidatedListener>()
+
+    private var jwtTokenInvalidated: String? = null
+
     override val pushSubscription: IPushSubscription
         get() = _subscriptionManager.subscriptions.push
 
@@ -244,6 +250,16 @@ internal open class UserManager(
         changeHandlersNotifier.unsubscribe(observer)
     }
 
+    override fun addUserJwtInvalidatedListener(listener: IUserJwtInvalidatedListener) {
+        Logging.debug("OneSignal.addUserJwtInvalidatedListener(listener: $listener)")
+        jwtInvalidatedCallback.subscribe(listener)
+    }
+
+    override fun removeUserJwtInvalidatedListener(listener: IUserJwtInvalidatedListener) {
+        Logging.debug("OneSignal.removeUserJwtInvalidatedListener(listener: $listener)")
+        jwtInvalidatedCallback.unsubscribe(listener)
+    }
+
     override fun onModelReplaced(
         model: IdentityModel,
         tag: String,
@@ -253,10 +269,27 @@ internal open class UserManager(
         args: ModelChangedArgs,
         tag: String,
     ) {
-        if (args.property == IdentityConstants.ONESIGNAL_ID) {
-            val newUserState = UserState(args.newValue.toString(), externalId)
-            this.changeHandlersNotifier.fire {
-                it.onUserStateChange(UserChangedState(newUserState))
+        when (args.property) {
+            IdentityConstants.ONESIGNAL_ID -> {
+                val newUserState = UserState(args.newValue.toString(), externalId)
+                this.changeHandlersNotifier.fire {
+                    it.onUserStateChange(UserChangedState(newUserState))
+                }
+            }
+            IdentityConstants.JWT_TOKEN -> {
+                // Fire the event when the JWT has been invalidated.
+                val oldJwt = args.oldValue
+                val newJwt = args.newValue
+
+                // When newJwt is equals to null, we are invalidating JWT for the current user.
+                // We need to prevent same JWT from being invalidated twice in a row.
+                if (jwtTokenInvalidated != oldJwt && newJwt == null) {
+                    jwtInvalidatedCallback.fire {
+                        it.onUserJwtInvalidated(UserJwtInvalidatedEvent(externalId))
+                    }
+                }
+
+                jwtTokenInvalidated = oldJwt as String?
             }
         }
     }
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/IIdentityBackendService.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/IIdentityBackendService.kt
index 880599871d..28308225d8 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/IIdentityBackendService.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/IIdentityBackendService.kt
@@ -18,6 +18,7 @@ interface IIdentityBackendService {
         aliasLabel: String,
         aliasValue: String,
         identities: Map<String, String>,
+        jwt: String? = null,
     ): Map<String, String>
 
     /**
@@ -35,6 +36,7 @@ interface IIdentityBackendService {
         aliasLabel: String,
         aliasValue: String,
         aliasLabelToDelete: String,
+        jwt: String? = null,
     )
 }
 
@@ -48,4 +50,9 @@ internal object IdentityConstants {
      * The alias label for the internal onesignal ID alias.
      */
     const val ONESIGNAL_ID = "onesignal_id"
+
+    /**
+     * The alias label for the jwt token.
+     */
+    const val JWT_TOKEN = "jwt_token"
 }
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/ISubscriptionBackendService.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/ISubscriptionBackendService.kt
index 7bcf23fdb2..172d91d8e8 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/ISubscriptionBackendService.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/ISubscriptionBackendService.kt
@@ -22,6 +22,7 @@ interface ISubscriptionBackendService {
         aliasLabel: String,
         aliasValue: String,
         subscription: SubscriptionObject,
+        jwt: String? = null,
     ): Pair<String, RywData?>?
 
     /**
@@ -46,6 +47,7 @@ interface ISubscriptionBackendService {
     suspend fun deleteSubscription(
         appId: String,
         subscriptionId: String,
+        jwt: String? = null,
     )
 
     /**
@@ -61,6 +63,7 @@ interface ISubscriptionBackendService {
         subscriptionId: String,
         aliasLabel: String,
         aliasValue: String,
+        jwt: String? = null,
     )
 
     /**
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/IUserBackendService.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/IUserBackendService.kt
index 4cec114b5a..b849fc4c42 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/IUserBackendService.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/IUserBackendService.kt
@@ -24,6 +24,7 @@ interface IUserBackendService {
         identities: Map<String, String>,
         subscriptions: List<SubscriptionObject>,
         properties: Map<String, String>,
+        jwt: String? = null,
     ): CreateUserResponse
     // TODO: Change to send only the push subscription, optimally
 
@@ -48,6 +49,7 @@ interface IUserBackendService {
         properties: PropertiesObject,
         refreshDeviceMetadata: Boolean,
         propertyiesDelta: PropertiesDeltasObject,
+        jwt: String? = null,
     ): RywData?
 
     /**
@@ -65,6 +67,7 @@ interface IUserBackendService {
         appId: String,
         aliasLabel: String,
         aliasValue: String,
+        jwt: String? = null,
     ): CreateUserResponse
 }
 
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/impl/IdentityBackendService.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/impl/IdentityBackendService.kt
index adfff7bdc9..498374909e 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/impl/IdentityBackendService.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/impl/IdentityBackendService.kt
@@ -4,6 +4,7 @@ import com.onesignal.common.exceptions.BackendException
 import com.onesignal.common.putMap
 import com.onesignal.common.toMap
 import com.onesignal.core.internal.http.IHttpClient
+import com.onesignal.core.internal.http.impl.OptionalHeaders
 import com.onesignal.user.internal.backend.IIdentityBackendService
 import org.json.JSONObject
 
@@ -15,12 +16,18 @@ internal class IdentityBackendService(
         aliasLabel: String,
         aliasValue: String,
         identities: Map<String, String>,
+        jwt: String?,
     ): Map<String, String> {
         val requestJSONObject =
             JSONObject()
                 .put("identity", JSONObject().putMap(identities))
 
-        val response = _httpClient.patch("apps/$appId/users/by/$aliasLabel/$aliasValue/identity", requestJSONObject)
+        val response =
+            _httpClient.patch(
+                "apps/$appId/users/by/$aliasLabel/$aliasValue/identity",
+                requestJSONObject,
+                OptionalHeaders(jwt = jwt),
+            )
 
         if (!response.isSuccess) {
             throw BackendException(response.statusCode, response.payload, response.retryAfterSeconds)
@@ -36,8 +43,13 @@ internal class IdentityBackendService(
         aliasLabel: String,
         aliasValue: String,
         aliasLabelToDelete: String,
+        jwt: String?,
     ) {
-        val response = _httpClient.delete("apps/$appId/users/by/$aliasLabel/$aliasValue/identity/$aliasLabelToDelete")
+        val response =
+            _httpClient.delete(
+                "apps/$appId/users/by/$aliasLabel/$aliasValue/identity/$aliasLabelToDelete",
+                OptionalHeaders(jwt = jwt),
+            )
 
         if (!response.isSuccess) {
             throw BackendException(response.statusCode, response.payload, response.retryAfterSeconds)
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/impl/SubscriptionBackendService.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/impl/SubscriptionBackendService.kt
index 3b5a2f408c..0f2d45adb1 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/impl/SubscriptionBackendService.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/impl/SubscriptionBackendService.kt
@@ -7,6 +7,7 @@ import com.onesignal.common.safeLong
 import com.onesignal.common.safeString
 import com.onesignal.common.toMap
 import com.onesignal.core.internal.http.IHttpClient
+import com.onesignal.core.internal.http.impl.OptionalHeaders
 import com.onesignal.user.internal.backend.ISubscriptionBackendService
 import com.onesignal.user.internal.backend.SubscriptionObject
 import org.json.JSONObject
@@ -19,12 +20,18 @@ internal class SubscriptionBackendService(
         aliasLabel: String,
         aliasValue: String,
         subscription: SubscriptionObject,
+        jwt: String?,
     ): Pair<String, RywData?>? {
         val jsonSubscription = JSONConverter.convertToJSON(subscription)
         jsonSubscription.remove("id")
         val requestJSON = JSONObject().put("subscription", jsonSubscription)
 
-        val response = _httpClient.post("apps/$appId/users/by/$aliasLabel/$aliasValue/subscriptions", requestJSON)
+        val response =
+            _httpClient.post(
+                "apps/$appId/users/by/$aliasLabel/$aliasValue/subscriptions",
+                requestJSON,
+                OptionalHeaders(jwt = jwt),
+            )
 
         if (!response.isSuccess) {
             throw BackendException(response.statusCode, response.payload, response.retryAfterSeconds)
@@ -56,7 +63,11 @@ internal class SubscriptionBackendService(
             JSONObject()
                 .put("subscription", JSONConverter.convertToJSON(subscription))
 
-        val response = _httpClient.patch("apps/$appId/subscriptions/$subscriptionId", requestJSON)
+        val response =
+            _httpClient.patch(
+                "apps/$appId/subscriptions/$subscriptionId",
+                requestJSON,
+            )
 
         if (!response.isSuccess) {
             throw BackendException(response.statusCode, response.payload, response.retryAfterSeconds)
@@ -77,8 +88,9 @@ internal class SubscriptionBackendService(
     override suspend fun deleteSubscription(
         appId: String,
         subscriptionId: String,
+        jwt: String?,
     ) {
-        val response = _httpClient.delete("apps/$appId/subscriptions/$subscriptionId")
+        val response = _httpClient.delete("apps/$appId/subscriptions/$subscriptionId", OptionalHeaders(jwt = jwt))
 
         if (!response.isSuccess) {
             throw BackendException(response.statusCode, response.payload, response.retryAfterSeconds)
@@ -90,12 +102,13 @@ internal class SubscriptionBackendService(
         subscriptionId: String,
         aliasLabel: String,
         aliasValue: String,
+        jwt: String?,
     ) {
         val requestJSON =
             JSONObject()
                 .put("identity", JSONObject().put(aliasLabel, aliasValue))
 
-        val response = _httpClient.patch("apps/$appId/subscriptions/$subscriptionId/owner", requestJSON)
+        val response = _httpClient.patch("apps/$appId/subscriptions/$subscriptionId/owner", requestJSON, OptionalHeaders(jwt = jwt))
 
         if (!response.isSuccess) {
             throw BackendException(response.statusCode, response.payload, response.retryAfterSeconds)
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/impl/UserBackendService.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/impl/UserBackendService.kt
index 1a1514018f..f87a4e24a8 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/impl/UserBackendService.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/impl/UserBackendService.kt
@@ -6,6 +6,7 @@ import com.onesignal.common.putMap
 import com.onesignal.common.safeLong
 import com.onesignal.common.safeString
 import com.onesignal.core.internal.http.IHttpClient
+import com.onesignal.core.internal.http.impl.OptionalHeaders
 import com.onesignal.user.internal.backend.CreateUserResponse
 import com.onesignal.user.internal.backend.IUserBackendService
 import com.onesignal.user.internal.backend.PropertiesDeltasObject
@@ -21,6 +22,7 @@ internal class UserBackendService(
         identities: Map<String, String>,
         subscriptions: List<SubscriptionObject>,
         properties: Map<String, String>,
+        jwt: String?,
     ): CreateUserResponse {
         val requestJSON = JSONObject()
 
@@ -39,7 +41,12 @@ internal class UserBackendService(
 
         requestJSON.put("refresh_device_metadata", true)
 
-        val response = _httpClient.post("apps/$appId/users", requestJSON)
+        val response =
+            _httpClient.post(
+                "apps/$appId/users",
+                requestJSON,
+                OptionalHeaders(jwt = jwt),
+            )
 
         if (!response.isSuccess) {
             throw BackendException(response.statusCode, response.payload, response.retryAfterSeconds)
@@ -55,6 +62,7 @@ internal class UserBackendService(
         properties: PropertiesObject,
         refreshDeviceMetadata: Boolean,
         propertyiesDelta: PropertiesDeltasObject,
+        jwt: String?,
     ): RywData? {
         val jsonObject =
             JSONObject()
@@ -68,7 +76,7 @@ internal class UserBackendService(
             jsonObject.put("deltas", JSONConverter.convertToJSON(propertyiesDelta))
         }
 
-        val response = _httpClient.patch("apps/$appId/users/by/$aliasLabel/$aliasValue", jsonObject)
+        val response = _httpClient.patch("apps/$appId/users/by/$aliasLabel/$aliasValue", jsonObject, OptionalHeaders(jwt = jwt))
 
         if (!response.isSuccess) {
             throw BackendException(response.statusCode, response.payload, response.retryAfterSeconds)
@@ -90,8 +98,9 @@ internal class UserBackendService(
         appId: String,
         aliasLabel: String,
         aliasValue: String,
+        jwt: String?,
     ): CreateUserResponse {
-        val response = _httpClient.get("apps/$appId/users/by/$aliasLabel/$aliasValue")
+        val response = _httpClient.get("apps/$appId/users/by/$aliasLabel/$aliasValue", OptionalHeaders(jwt = jwt))
 
         if (!response.isSuccess) {
             throw BackendException(response.statusCode, response.payload, response.retryAfterSeconds)
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/identity/IdentityModel.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/identity/IdentityModel.kt
index d443fdad60..d0017862fd 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/identity/IdentityModel.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/identity/IdentityModel.kt
@@ -1,6 +1,7 @@
 package com.onesignal.user.internal.identity
 
 import com.onesignal.common.modeling.MapModel
+import com.onesignal.common.modeling.ModelChangeTags
 import com.onesignal.user.internal.backend.IdentityConstants
 
 /**
@@ -29,4 +30,14 @@ class IdentityModel : MapModel<String>() {
         set(value) {
             setOptStringProperty(IdentityConstants.EXTERNAL_ID, value)
         }
+
+    /**
+     * A JWT token generated on your server and given to a OneSignal Client SDK so it can manage
+     * a specific User, their Subscriptions, and Identities (AKA add/remove Aliases).
+     */
+    var jwtToken: String?
+        get() = getOptStringProperty(IdentityConstants.JWT_TOKEN)
+        set(value) {
+            setOptStringProperty(IdentityConstants.JWT_TOKEN, value, ModelChangeTags.NO_PROPOGATE, true)
+        }
 }
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/identity/IdentityModelStore.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/identity/IdentityModelStore.kt
index 911c4ba71b..37ea791c7d 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/identity/IdentityModelStore.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/identity/IdentityModelStore.kt
@@ -3,7 +3,21 @@ package com.onesignal.user.internal.identity
 import com.onesignal.common.modeling.SimpleModelStore
 import com.onesignal.common.modeling.SingletonModelStore
 import com.onesignal.core.internal.preferences.IPreferencesService
+import com.onesignal.user.internal.backend.IdentityConstants
 
 open class IdentityModelStore(prefs: IPreferencesService) : SingletonModelStore<IdentityModel>(
     SimpleModelStore({ IdentityModel() }, "identity", prefs),
-)
+) {
+    fun invalidateJwt() {
+        model.jwtToken = null
+    }
+
+    // Use externalId instead of onesignalId when a jwt is present
+    fun getIdentityAlias(): Pair<String, String> {
+        if (model.jwtToken == null) {
+            return Pair(IdentityConstants.ONESIGNAL_ID, model.onesignalId)
+        }
+
+        return Pair(IdentityConstants.EXTERNAL_ID, model.externalId!!)
+    }
+}
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/UpdateSubscriptionOperation.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/UpdateSubscriptionOperation.kt
index 59a9e1c1b7..f79706c1ff 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/UpdateSubscriptionOperation.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/UpdateSubscriptionOperation.kt
@@ -81,13 +81,24 @@ class UpdateSubscriptionOperation() : Operation(SubscriptionOperationExecutor.UP
             setEnumProperty(::status.name, value)
         }
 
+    /**
+     * The jwt token used for the operation that updates a subscription.
+     */
+    var jwt: String?
+        get() = getStringProperty(::jwt.name)
+        private set(value) {
+            if (value != null) {
+                setStringProperty(::jwt.name, value!!)
+            }
+        }
+
     override val createComparisonKey: String get() = "$appId.User.$onesignalId"
     override val modifyComparisonKey: String get() = "$appId.User.$onesignalId.Subscription.$subscriptionId"
     override val groupComparisonType: GroupComparisonType = GroupComparisonType.ALTER
     override val canStartExecute: Boolean get() = !IDManager.isLocalId(onesignalId) && !IDManager.isLocalId(onesignalId)
     override val applyToRecordId: String get() = subscriptionId
 
-    constructor(appId: String, onesignalId: String, subscriptionId: String, type: SubscriptionType, enabled: Boolean, address: String, status: SubscriptionStatus) : this() {
+    constructor(appId: String, onesignalId: String, subscriptionId: String, type: SubscriptionType, enabled: Boolean, address: String, status: SubscriptionStatus, jwt: String? = null) : this() {
         this.appId = appId
         this.onesignalId = onesignalId
         this.subscriptionId = subscriptionId
@@ -95,6 +106,7 @@ class UpdateSubscriptionOperation() : Operation(SubscriptionOperationExecutor.UP
         this.enabled = enabled
         this.address = address
         this.status = status
+        this.jwt = jwt
     }
 
     override fun translateIds(map: Map<String, String>) {
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/IdentityOperationExecutor.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/IdentityOperationExecutor.kt
index 104fe9569f..a2c59553fc 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/IdentityOperationExecutor.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/IdentityOperationExecutor.kt
@@ -45,11 +45,13 @@ internal class IdentityOperationExecutor(
 
         if (lastOperation is SetAliasOperation) {
             try {
+                val identityAlias = _identityModelStore.getIdentityAlias()
                 _identityBackend.setAlias(
                     lastOperation.appId,
-                    IdentityConstants.ONESIGNAL_ID,
-                    lastOperation.onesignalId,
+                    identityAlias.first,
+                    identityAlias.second,
                     mapOf(lastOperation.label to lastOperation.value),
+                    _identityModelStore.model.jwtToken,
                 )
 
                 // ensure the now created alias is in the model as long as the user is still current.
@@ -66,8 +68,9 @@ internal class IdentityOperationExecutor(
                         ExecutionResponse(ExecutionResult.FAIL_NORETRY)
                     NetworkUtils.ResponseStatusType.CONFLICT ->
                         ExecutionResponse(ExecutionResult.FAIL_CONFLICT, retryAfterSeconds = ex.retryAfterSeconds)
-                    NetworkUtils.ResponseStatusType.UNAUTHORIZED ->
-                        ExecutionResponse(ExecutionResult.FAIL_UNAUTHORIZED, retryAfterSeconds = ex.retryAfterSeconds)
+                    NetworkUtils.ResponseStatusType.UNAUTHORIZED -> {
+                        return ExecutionResponse(ExecutionResult.FAIL_UNAUTHORIZED)
+                    }
                     NetworkUtils.ResponseStatusType.MISSING -> {
                         if (ex.statusCode == 404 && _newRecordState.isInMissingRetryWindow(lastOperation.onesignalId)) {
                             return ExecutionResponse(ExecutionResult.FAIL_RETRY, retryAfterSeconds = ex.retryAfterSeconds)
@@ -93,6 +96,7 @@ internal class IdentityOperationExecutor(
                     IdentityConstants.ONESIGNAL_ID,
                     lastOperation.onesignalId,
                     lastOperation.label,
+                    _identityModelStore.model.jwtToken,
                 )
 
                 // ensure the now deleted alias is not in the model as long as the user is still current.
@@ -110,8 +114,9 @@ internal class IdentityOperationExecutor(
                         ExecutionResponse(ExecutionResult.SUCCESS)
                     NetworkUtils.ResponseStatusType.INVALID ->
                         ExecutionResponse(ExecutionResult.FAIL_NORETRY)
-                    NetworkUtils.ResponseStatusType.UNAUTHORIZED ->
-                        ExecutionResponse(ExecutionResult.FAIL_UNAUTHORIZED, retryAfterSeconds = ex.retryAfterSeconds)
+                    NetworkUtils.ResponseStatusType.UNAUTHORIZED -> {
+                        return ExecutionResponse(ExecutionResult.FAIL_UNAUTHORIZED)
+                    }
                     NetworkUtils.ResponseStatusType.MISSING -> {
                         return if (ex.statusCode == 404 && _newRecordState.isInMissingRetryWindow(lastOperation.onesignalId)) {
                             ExecutionResponse(ExecutionResult.FAIL_RETRY, retryAfterSeconds = ex.retryAfterSeconds)
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/LoginUserFromSubscriptionOperationExecutor.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/LoginUserFromSubscriptionOperationExecutor.kt
index 9a1178999d..719bc9228a 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/LoginUserFromSubscriptionOperationExecutor.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/LoginUserFromSubscriptionOperationExecutor.kt
@@ -3,6 +3,7 @@ package com.onesignal.user.internal.operations.impl.executors
 import com.onesignal.common.NetworkUtils
 import com.onesignal.common.exceptions.BackendException
 import com.onesignal.common.modeling.ModelChangeTags
+import com.onesignal.core.internal.config.ConfigModelStore
 import com.onesignal.core.internal.operations.ExecutionResponse
 import com.onesignal.core.internal.operations.ExecutionResult
 import com.onesignal.core.internal.operations.IOperationExecutor
@@ -20,6 +21,7 @@ internal class LoginUserFromSubscriptionOperationExecutor(
     private val _subscriptionBackend: ISubscriptionBackendService,
     private val _identityModelStore: IdentityModelStore,
     private val _propertiesModelStore: PropertiesModelStore,
+    private val _configModelStore: ConfigModelStore,
 ) : IOperationExecutor {
     override val operations: List<String>
         get() = listOf(LOGIN_USER_FROM_SUBSCRIPTION_USER)
@@ -42,6 +44,11 @@ internal class LoginUserFromSubscriptionOperationExecutor(
 
     private suspend fun loginUser(loginUserOp: LoginUserFromSubscriptionOperation): ExecutionResponse {
         try {
+            // Not allowed when identity verification is on
+            if (_configModelStore.model.useIdentityVerification) {
+                return ExecutionResponse(ExecutionResult.FAIL_NORETRY)
+            }
+
             val identities =
                 _subscriptionBackend.getIdentityFromSubscription(
                     loginUserOp.appId,
@@ -82,8 +89,9 @@ internal class LoginUserFromSubscriptionOperationExecutor(
             return when (responseType) {
                 NetworkUtils.ResponseStatusType.RETRYABLE ->
                     ExecutionResponse(ExecutionResult.FAIL_RETRY)
-                NetworkUtils.ResponseStatusType.UNAUTHORIZED ->
+                NetworkUtils.ResponseStatusType.UNAUTHORIZED -> {
                     ExecutionResponse(ExecutionResult.FAIL_UNAUTHORIZED)
+                }
                 else ->
                     ExecutionResponse(ExecutionResult.FAIL_NORETRY)
             }
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/LoginUserOperationExecutor.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/LoginUserOperationExecutor.kt
index e96c796513..537a60affb 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/LoginUserOperationExecutor.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/LoginUserOperationExecutor.kt
@@ -126,6 +126,9 @@ internal class LoginUserOperationExecutor(
                     )
                     createUser(loginUserOp, operations)
                 }
+                ExecutionResult.FAIL_UNAUTHORIZED -> {
+                    ExecutionResponse(result.result)
+                }
                 else -> ExecutionResponse(result.result)
             }
         }
@@ -160,7 +163,16 @@ internal class LoginUserOperationExecutor(
 
         try {
             val subscriptionList = subscriptions.toList()
-            val response = _userBackend.createUser(createUserOperation.appId, identities, subscriptionList.map { it.second }, properties)
+            val response =
+                _userBackend.createUser(
+                    createUserOperation.appId,
+                    identities,
+                    subscriptionList.map {
+                        it.second
+                    },
+                    properties,
+                    _identityModelStore.model.jwtToken,
+                )
             val idTranslations = mutableMapOf<String, String>()
             // Add the "local-to-backend" ID translation to the IdentifierTranslator for any operations that were
             // *not* executed but still reference the locally-generated IDs.
@@ -212,8 +224,9 @@ internal class LoginUserOperationExecutor(
             return when (responseType) {
                 NetworkUtils.ResponseStatusType.RETRYABLE ->
                     ExecutionResponse(ExecutionResult.FAIL_RETRY, retryAfterSeconds = ex.retryAfterSeconds)
-                NetworkUtils.ResponseStatusType.UNAUTHORIZED ->
-                    ExecutionResponse(ExecutionResult.FAIL_UNAUTHORIZED, retryAfterSeconds = ex.retryAfterSeconds)
+                NetworkUtils.ResponseStatusType.UNAUTHORIZED -> {
+                    ExecutionResponse(ExecutionResult.FAIL_UNAUTHORIZED)
+                }
                 else ->
                     ExecutionResponse(ExecutionResult.FAIL_PAUSE_OPREPO)
             }
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/RefreshUserOperationExecutor.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/RefreshUserOperationExecutor.kt
index cec48b05a9..cb987c3a64 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/RefreshUserOperationExecutor.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/RefreshUserOperationExecutor.kt
@@ -11,7 +11,6 @@ import com.onesignal.core.internal.operations.Operation
 import com.onesignal.debug.LogLevel
 import com.onesignal.debug.internal.logging.Logging
 import com.onesignal.user.internal.backend.IUserBackendService
-import com.onesignal.user.internal.backend.IdentityConstants
 import com.onesignal.user.internal.backend.SubscriptionObjectType
 import com.onesignal.user.internal.builduser.IRebuildUserService
 import com.onesignal.user.internal.identity.IdentityModel
@@ -54,11 +53,13 @@ internal class RefreshUserOperationExecutor(
 
     private suspend fun getUser(op: RefreshUserOperation): ExecutionResponse {
         try {
+            val identityAlias = _identityModelStore.getIdentityAlias()
             val response =
                 _userBackend.getUser(
                     op.appId,
-                    IdentityConstants.ONESIGNAL_ID,
-                    op.onesignalId,
+                    identityAlias.first,
+                    identityAlias.second,
+                    _identityModelStore.model.jwtToken,
                 )
 
             if (op.onesignalId != _identityModelStore.model.onesignalId) {
@@ -69,6 +70,7 @@ internal class RefreshUserOperationExecutor(
             for (aliasKVP in response.identities) {
                 identityModel[aliasKVP.key] = aliasKVP.value
             }
+            identityModel.jwtToken = _identityModelStore.model.jwtToken
 
             val propertiesModel = PropertiesModel()
             propertiesModel.onesignalId = op.onesignalId
@@ -98,7 +100,9 @@ internal class RefreshUserOperationExecutor(
                 val subscriptionModel = SubscriptionModel()
                 subscriptionModel.id = subscription.id!!
                 subscriptionModel.address = subscription.token ?: ""
-                subscriptionModel.status = SubscriptionStatus.fromInt(subscription.notificationTypes ?: SubscriptionStatus.SUBSCRIBED.value) ?: SubscriptionStatus.SUBSCRIBED
+                subscriptionModel.status = SubscriptionStatus.fromInt(
+                    subscription.notificationTypes ?: SubscriptionStatus.SUBSCRIBED.value,
+                ) ?: SubscriptionStatus.SUBSCRIBED
                 subscriptionModel.type =
                     when (subscription.type!!) {
                         SubscriptionObjectType.EMAIL -> {
@@ -147,8 +151,9 @@ internal class RefreshUserOperationExecutor(
             return when (responseType) {
                 NetworkUtils.ResponseStatusType.RETRYABLE ->
                     ExecutionResponse(ExecutionResult.FAIL_RETRY, retryAfterSeconds = ex.retryAfterSeconds)
-                NetworkUtils.ResponseStatusType.UNAUTHORIZED ->
-                    ExecutionResponse(ExecutionResult.FAIL_UNAUTHORIZED, retryAfterSeconds = ex.retryAfterSeconds)
+                NetworkUtils.ResponseStatusType.UNAUTHORIZED -> {
+                    ExecutionResponse(ExecutionResult.FAIL_UNAUTHORIZED)
+                }
                 NetworkUtils.ResponseStatusType.MISSING -> {
                     if (ex.statusCode == 404 && _newRecordState.isInMissingRetryWindow(op.onesignalId)) {
                         return ExecutionResponse(ExecutionResult.FAIL_RETRY, retryAfterSeconds = ex.retryAfterSeconds)
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/SubscriptionOperationExecutor.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/SubscriptionOperationExecutor.kt
index 334e47b897..7cc483a727 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/SubscriptionOperationExecutor.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/SubscriptionOperationExecutor.kt
@@ -25,6 +25,7 @@ import com.onesignal.user.internal.backend.IdentityConstants
 import com.onesignal.user.internal.backend.SubscriptionObject
 import com.onesignal.user.internal.backend.SubscriptionObjectType
 import com.onesignal.user.internal.builduser.IRebuildUserService
+import com.onesignal.user.internal.identity.IdentityModelStore
 import com.onesignal.user.internal.operations.CreateSubscriptionOperation
 import com.onesignal.user.internal.operations.DeleteSubscriptionOperation
 import com.onesignal.user.internal.operations.TransferSubscriptionOperation
@@ -38,6 +39,7 @@ internal class SubscriptionOperationExecutor(
     private val _subscriptionBackend: ISubscriptionBackendService,
     private val _deviceService: IDeviceService,
     private val _applicationService: IApplicationService,
+    private val _identityModelStore: IdentityModelStore,
     private val _subscriptionModelStore: SubscriptionModelStore,
     private val _configModelStore: ConfigModelStore,
     private val _buildUserService: IRebuildUserService,
@@ -105,12 +107,14 @@ internal class SubscriptionOperationExecutor(
                     AndroidUtils.getAppVersion(_applicationService.appContext),
                 )
 
+            val identityAlias = _identityModelStore.getIdentityAlias()
             val result =
                 _subscriptionBackend.createSubscription(
                     createOperation.appId,
-                    IdentityConstants.ONESIGNAL_ID,
-                    createOperation.onesignalId,
+                    identityAlias.first,
+                    identityAlias.second,
                     subscription,
+                    _identityModelStore.model.jwtToken,
                 ) ?: return ExecutionResponse(ExecutionResult.SUCCESS)
 
             val backendSubscriptionId = result.first
@@ -148,8 +152,9 @@ internal class SubscriptionOperationExecutor(
                 NetworkUtils.ResponseStatusType.INVALID,
                 ->
                     ExecutionResponse(ExecutionResult.FAIL_NORETRY)
-                NetworkUtils.ResponseStatusType.UNAUTHORIZED ->
+                NetworkUtils.ResponseStatusType.UNAUTHORIZED -> {
                     ExecutionResponse(ExecutionResult.FAIL_UNAUTHORIZED, retryAfterSeconds = ex.retryAfterSeconds)
+                }
                 NetworkUtils.ResponseStatusType.MISSING -> {
                     if (ex.statusCode == 404 && _newRecordState.isInMissingRetryWindow(createOperation.onesignalId)) {
                         return ExecutionResponse(ExecutionResult.FAIL_RETRY, retryAfterSeconds = ex.retryAfterSeconds)
@@ -158,7 +163,11 @@ internal class SubscriptionOperationExecutor(
                     if (operations == null) {
                         return ExecutionResponse(ExecutionResult.FAIL_NORETRY)
                     } else {
-                        return ExecutionResponse(ExecutionResult.FAIL_RETRY, operations = operations, retryAfterSeconds = ex.retryAfterSeconds)
+                        return ExecutionResponse(
+                            ExecutionResult.FAIL_RETRY,
+                            operations = operations,
+                            retryAfterSeconds = ex.retryAfterSeconds,
+                        )
                     }
                 }
             }
@@ -243,6 +252,7 @@ internal class SubscriptionOperationExecutor(
                 startingOperation.subscriptionId,
                 IdentityConstants.ONESIGNAL_ID,
                 startingOperation.onesignalId,
+                _identityModelStore.model.jwtToken,
             )
         } catch (ex: BackendException) {
             val responseType = NetworkUtils.getResponseStatusType(ex.statusCode)
@@ -274,7 +284,7 @@ internal class SubscriptionOperationExecutor(
 
     private suspend fun deleteSubscription(op: DeleteSubscriptionOperation): ExecutionResponse {
         try {
-            _subscriptionBackend.deleteSubscription(op.appId, op.subscriptionId)
+            _subscriptionBackend.deleteSubscription(op.appId, op.subscriptionId, _identityModelStore.model.jwtToken)
 
             // remove the subscription model as a HYDRATE in case for some reason it still exists.
             _subscriptionModelStore.remove(op.subscriptionId, ModelChangeTags.HYDRATE)
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/UpdateUserOperationExecutor.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/UpdateUserOperationExecutor.kt
index e529035ec1..aeccd32177 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/UpdateUserOperationExecutor.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/UpdateUserOperationExecutor.kt
@@ -13,7 +13,6 @@ import com.onesignal.core.internal.operations.Operation
 import com.onesignal.debug.LogLevel
 import com.onesignal.debug.internal.logging.Logging
 import com.onesignal.user.internal.backend.IUserBackendService
-import com.onesignal.user.internal.backend.IdentityConstants
 import com.onesignal.user.internal.backend.PropertiesDeltasObject
 import com.onesignal.user.internal.backend.PropertiesObject
 import com.onesignal.user.internal.backend.PurchaseObject
@@ -88,7 +87,12 @@ internal class UpdateUserOperationExecutor(
                     val sessionCount = if (deltasObject.sessionCount != null) deltasObject.sessionCount!! + 1 else 1
 
                     deltasObject =
-                        PropertiesDeltasObject(deltasObject.sessionTime, sessionCount, deltasObject.amountSpent, deltasObject.purchases)
+                        PropertiesDeltasObject(
+                            deltasObject.sessionTime,
+                            sessionCount,
+                            deltasObject.amountSpent,
+                            deltasObject.purchases,
+                        )
                     refreshDeviceMetadata = true
                 }
                 is TrackSessionEndOperation -> {
@@ -107,7 +111,12 @@ internal class UpdateUserOperationExecutor(
                         }
 
                     deltasObject =
-                        PropertiesDeltasObject(sessionTime, deltasObject.sessionCount, deltasObject.amountSpent, deltasObject.purchases)
+                        PropertiesDeltasObject(
+                            sessionTime,
+                            deltasObject.sessionCount,
+                            deltasObject.amountSpent,
+                            deltasObject.purchases,
+                        )
                 }
                 is TrackPurchaseOperation -> {
                     if (appId == null) {
@@ -138,14 +147,16 @@ internal class UpdateUserOperationExecutor(
 
         if (appId != null && onesignalId != null) {
             try {
+                val identityAlias = _identityModelStore.getIdentityAlias()
                 val rywData =
                     _userBackend.updateUser(
                         appId,
-                        IdentityConstants.ONESIGNAL_ID,
-                        onesignalId,
+                        identityAlias.first,
+                        identityAlias.second,
                         propertiesObject,
                         refreshDeviceMetadata,
                         deltasObject,
+                        _identityModelStore.model.jwtToken,
                     )
 
                 if (rywData != null) {
@@ -185,8 +196,9 @@ internal class UpdateUserOperationExecutor(
                 return when (responseType) {
                     NetworkUtils.ResponseStatusType.RETRYABLE ->
                         ExecutionResponse(ExecutionResult.FAIL_RETRY, retryAfterSeconds = ex.retryAfterSeconds)
-                    NetworkUtils.ResponseStatusType.UNAUTHORIZED ->
+                    NetworkUtils.ResponseStatusType.UNAUTHORIZED -> {
                         ExecutionResponse(ExecutionResult.FAIL_UNAUTHORIZED, retryAfterSeconds = ex.retryAfterSeconds)
+                    }
                     NetworkUtils.ResponseStatusType.MISSING -> {
                         if (ex.statusCode == 404 && _newRecordState.isInMissingRetryWindow(onesignalId)) {
                             return ExecutionResponse(ExecutionResult.FAIL_RETRY, retryAfterSeconds = ex.retryAfterSeconds)
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/listeners/SubscriptionModelStoreListener.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/listeners/SubscriptionModelStoreListener.kt
index f0002940e9..cb6136797a 100644
--- a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/listeners/SubscriptionModelStoreListener.kt
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/listeners/SubscriptionModelStoreListener.kt
@@ -19,7 +19,7 @@ internal class SubscriptionModelStoreListener(
     private val _configModelStore: ConfigModelStore,
 ) : ModelStoreListener<SubscriptionModel>(store, opRepo) {
     override fun getAddOperation(model: SubscriptionModel): Operation {
-        val enabledAndStatus = getSubscriptionEnabledAndStatus(model)
+        val enabledAndStatus = getSubscriptionEnabledAndStatus(model, _identityModelStore, _configModelStore)
         return CreateSubscriptionOperation(
             _configModelStore.model.appId,
             _identityModelStore.model.onesignalId,
@@ -42,7 +42,7 @@ internal class SubscriptionModelStoreListener(
         oldValue: Any?,
         newValue: Any?,
     ): Operation {
-        val enabledAndStatus = getSubscriptionEnabledAndStatus(model)
+        val enabledAndStatus = getSubscriptionEnabledAndStatus(model, _identityModelStore, _configModelStore)
         return UpdateSubscriptionOperation(
             _configModelStore.model.appId,
             _identityModelStore.model.onesignalId,
@@ -55,11 +55,20 @@ internal class SubscriptionModelStoreListener(
     }
 
     companion object {
-        fun getSubscriptionEnabledAndStatus(model: SubscriptionModel): Pair<Boolean, SubscriptionStatus> {
+        fun getSubscriptionEnabledAndStatus(
+            model: SubscriptionModel,
+            identityModelStore: IdentityModelStore,
+            configModelStore: ConfigModelStore,
+        ): Pair<Boolean, SubscriptionStatus> {
             val status: SubscriptionStatus
             val enabled: Boolean
 
-            if (model.optedIn && model.status == SubscriptionStatus.SUBSCRIBED && model.address.isNotEmpty()) {
+            /*
+                When identity verification is off, we can enable the subscription regardless of the login status.
+                When identity verification is on, the subscription is enabled only when a user is currently logged in.
+             */
+            val isUserLoggedInWhenIdentityRequired = !configModelStore.model.useIdentityVerification || !identityModelStore.model.externalId.isNullOrEmpty()
+            if (isUserLoggedInWhenIdentityRequired && model.optedIn && model.status == SubscriptionStatus.SUBSCRIBED && model.address.isNotEmpty()) {
                 enabled = true
                 status = SubscriptionStatus.SUBSCRIBED
             } else {
diff --git a/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/service/IdentityVerificationService.kt b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/service/IdentityVerificationService.kt
new file mode 100644
index 0000000000..6414b9301c
--- /dev/null
+++ b/OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/service/IdentityVerificationService.kt
@@ -0,0 +1,52 @@
+package com.onesignal.user.internal.service
+
+import com.onesignal.common.modeling.ISingletonModelStoreChangeHandler
+import com.onesignal.common.modeling.ModelChangeTags
+import com.onesignal.common.modeling.ModelChangedArgs
+import com.onesignal.core.internal.config.ConfigModel
+import com.onesignal.core.internal.config.ConfigModelStore
+import com.onesignal.core.internal.operations.IOperationRepo
+import com.onesignal.core.internal.startup.IBootstrapService
+import com.onesignal.debug.LogLevel
+import com.onesignal.debug.internal.logging.Logging
+import com.onesignal.user.internal.identity.IdentityModelStore
+import com.onesignal.user.internal.operations.LoginUserOperation
+
+internal class IdentityVerificationService(
+    private val _configModelStore: ConfigModelStore,
+    private val _identityModelStore: IdentityModelStore,
+    private val opRepo: IOperationRepo,
+) : IBootstrapService, ISingletonModelStoreChangeHandler<ConfigModel> {
+    override fun bootstrap() {
+        _configModelStore.subscribe(this)
+    }
+
+    override fun onModelReplaced(
+        model: ConfigModel,
+        tag: String,
+    ) {
+        if (tag != ModelChangeTags.HYDRATE) {
+            return
+        }
+        if (model.useIdentityVerification && _identityModelStore.model.jwtToken == null) {
+            Logging.log(LogLevel.INFO, "A valid JWT is required for user ${_identityModelStore.model.externalId}.")
+            return
+        }
+
+        // calling login either identity verification is turned off or a jwt is cached
+        opRepo.enqueue(
+            LoginUserOperation(
+                _configModelStore.model.appId,
+                _identityModelStore.model.onesignalId,
+                _identityModelStore.model.externalId,
+            ),
+        )
+    }
+
+    override fun onModelUpdated(
+        args: ModelChangedArgs,
+        tag: String,
+    ) {
+        // left empty intentionally
+    }
+}
diff --git a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/core/internal/operations/OperationRepoTests.kt b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/core/internal/operations/OperationRepoTests.kt
index 936e0e5b92..eeeca3afd2 100644
--- a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/core/internal/operations/OperationRepoTests.kt
+++ b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/core/internal/operations/OperationRepoTests.kt
@@ -12,6 +12,7 @@ import com.onesignal.mocks.MockHelper
 import com.onesignal.user.internal.operations.ExecutorMocks.Companion.getNewRecordState
 import io.kotest.core.spec.style.FunSpec
 import io.kotest.matchers.shouldBe
+import io.kotest.matchers.shouldNotBe
 import io.mockk.CapturingSlot
 import io.mockk.coEvery
 import io.mockk.coVerify
@@ -34,6 +35,12 @@ import java.util.UUID
 private class Mocks {
     val configModelStore = MockHelper.configModelStore()
 
+    val identityModelStore =
+        MockHelper.identityModelStore {
+            it.jwtToken = null
+            it.externalId = "externalId1"
+        }
+
     val operationModelStore: OperationModelStore =
         run {
             val operationStoreList = mutableListOf<Operation>()
@@ -63,6 +70,7 @@ private class Mocks {
                 listOf(executor),
                 operationModelStore,
                 configModelStore,
+                identityModelStore,
                 Time(),
                 getNewRecordState(configModelStore),
             ),
@@ -685,6 +693,54 @@ class OperationRepoTests : FunSpec({
         response2 shouldBe true
         opRepo.forceExecuteOperations()
     }
+
+    test("operations that need to be identity verified cannot execute until JWT is provided") {
+        val mocks = Mocks()
+        mocks.configModelStore.model.useIdentityVerification = true
+        val operation = mockOperation()
+        val opRepo = mocks.operationRepo
+
+        // When JWT is not supplied
+        opRepo.start()
+        opRepo.enqueue(operation)
+        opRepo.forceExecuteOperations()
+        val responseBeforeJWT =
+            withTimeoutOrNull(100) {
+                opRepo.enqueueAndWait(mockOperation())
+            }
+
+        // Then response should be null
+        responseBeforeJWT shouldBe null
+
+        // When JWT is updated
+        mocks.identityModelStore.model.jwtToken = "123"
+        val opToExecute = opRepo.getNextOps(0)
+
+        // Operation is ready to execute
+        opToExecute shouldNotBe null
+    }
+
+    test("JWT will be invalidated when a FAIL_UNAUTHORIZED response is returned") {
+        // Given
+        val mocks = Mocks()
+        val opRepo = mocks.operationRepo
+        val identityModelStore = mocks.identityModelStore
+        coEvery { opRepo.delayBeforeNextExecution(any(), any()) } just runs
+        coEvery {
+            mocks.executor.execute(any())
+        } returns ExecutionResponse(ExecutionResult.FAIL_UNAUTHORIZED) andThen ExecutionResponse(ExecutionResult.SUCCESS)
+        val operation = mockOperation()
+
+        // When
+        mocks.operationRepo.start()
+        mocks.operationRepo.enqueueAndWait(operation)
+
+        // Then
+        coVerifyOrder {
+            mocks.executor.execute(listOf(operation))
+            identityModelStore.invalidateJwt()
+        }
+    }
 }) {
     companion object {
         private fun mockOperation(
diff --git a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/UserManagerTests.kt b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/UserManagerTests.kt
index 41e836eb9b..de777eafe1 100644
--- a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/UserManagerTests.kt
+++ b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/UserManagerTests.kt
@@ -141,7 +141,8 @@ class UserManagerTests : FunSpec({
                 it.tags["my-tag-key1"] = "my-tag-value1"
             }
 
-        val userManager = UserManager(mockSubscriptionManager, MockHelper.identityModelStore(), propertiesModelStore, MockHelper.languageContext())
+        val userManager =
+            UserManager(mockSubscriptionManager, MockHelper.identityModelStore(), propertiesModelStore, MockHelper.languageContext())
 
         // When
         val tagSnapshot1 = userManager.getTags()
diff --git a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/backend/IdentityBackendServiceTests.kt b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/backend/IdentityBackendServiceTests.kt
index d66ee47ebf..36c99e652f 100644
--- a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/backend/IdentityBackendServiceTests.kt
+++ b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/backend/IdentityBackendServiceTests.kt
@@ -21,7 +21,7 @@ class IdentityBackendServiceTests : FunSpec({
         val aliasLabel = "onesignal_id"
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.patch(any(), any()) } returns HttpResponse(200, "{ identity: { aliasKey1: \"aliasValue1\"} }")
+        coEvery { spyHttpClient.patch(any(), any(), any()) } returns HttpResponse(200, "{ identity: { aliasKey1: \"aliasValue1\"} }")
         val identityBackendService = IdentityBackendService(spyHttpClient)
         val identities = mapOf("aliasKey1" to "aliasValue1")
 
@@ -38,6 +38,7 @@ class IdentityBackendServiceTests : FunSpec({
                     it.getJSONObject("identity").has("aliasKey1") shouldBe true
                     it.getJSONObject("identity").getString("aliasKey1") shouldBe "aliasValue1"
                 },
+                any(),
             )
         }
     }
@@ -48,7 +49,7 @@ class IdentityBackendServiceTests : FunSpec({
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val aliasToDelete = "aliasKey1"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.delete(any()) } returns HttpResponse(200, "")
+        coEvery { spyHttpClient.delete(any(), any()) } returns HttpResponse(200, "")
         val identityBackendService = IdentityBackendService(spyHttpClient)
 
         // When
@@ -56,7 +57,7 @@ class IdentityBackendServiceTests : FunSpec({
 
         // Then
         coVerify {
-            spyHttpClient.delete("apps/appId/users/by/$aliasLabel/$aliasValue/identity/$aliasToDelete")
+            spyHttpClient.delete("apps/appId/users/by/$aliasLabel/$aliasValue/identity/$aliasToDelete", any())
         }
     }
 })
diff --git a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/backend/SubscriptionBackendServiceTests.kt b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/backend/SubscriptionBackendServiceTests.kt
index 4b6ba88968..a28002a45b 100644
--- a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/backend/SubscriptionBackendServiceTests.kt
+++ b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/backend/SubscriptionBackendServiceTests.kt
@@ -27,7 +27,9 @@ class SubscriptionBackendServiceTests : FunSpec({
         val aliasLabel = "onesignal_id"
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.post(any(), any()) } returns HttpResponse(202, "{ \"subscription\": { id: \"subscriptionId\" }, \"ryw_token\": \"123\"}")
+        coEvery {
+            spyHttpClient.post(any(), any(), any())
+        } returns HttpResponse(202, "{ \"subscription\": { id: \"subscriptionId\" }, \"ryw_token\": \"123\"}")
         val subscriptionBackendService = SubscriptionBackendService(spyHttpClient)
 
         // When
@@ -55,6 +57,7 @@ class SubscriptionBackendServiceTests : FunSpec({
                     sub.getBoolean("enabled") shouldBe true
                     sub.getInt("notification_types") shouldBe 1
                 },
+                any(),
             )
         }
     }
@@ -64,7 +67,7 @@ class SubscriptionBackendServiceTests : FunSpec({
         val aliasLabel = "onesignal_id"
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.post(any(), any()) } returns HttpResponse(404, "NOT FOUND")
+        coEvery { spyHttpClient.post(any(), any(), any()) } returns HttpResponse(404, "NOT FOUND")
         val subscriptionBackendService = SubscriptionBackendService(spyHttpClient)
 
         // When
@@ -100,6 +103,7 @@ class SubscriptionBackendServiceTests : FunSpec({
                     sub.getBoolean("enabled") shouldBe true
                     sub.getInt("notification_types") shouldBe 1
                 },
+                any(),
             )
         }
     }
diff --git a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/backend/UserBackendServiceTests.kt b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/backend/UserBackendServiceTests.kt
index f8b5839356..81a607a80d 100644
--- a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/backend/UserBackendServiceTests.kt
+++ b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/backend/UserBackendServiceTests.kt
@@ -22,7 +22,7 @@ class UserBackendServiceTests : FunSpec({
     test("create user with nothing throws an exception") {
         // Given
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.post(any(), any()) } returns HttpResponse(403, "FORBIDDEN")
+        coEvery { spyHttpClient.post(any(), any(), any()) } returns HttpResponse(403, "FORBIDDEN")
         val userBackendService = UserBackendService(spyHttpClient)
         val identities = mapOf<String, String>()
         val properties = mapOf<String, String>()
@@ -44,8 +44,12 @@ class UserBackendServiceTests : FunSpec({
         val osId = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
         coEvery {
-            spyHttpClient.post(any(), any())
-        } returns HttpResponse(202, "{identity:{onesignal_id: \"$osId\", aliasLabel1: \"aliasValue1\"}, properties:{timezone_id: \"testTimeZone\", language: \"testLanguage\"}}")
+            spyHttpClient.post(any(), any(), any())
+        } returns
+            HttpResponse(
+                202,
+                "{identity:{onesignal_id: \"$osId\", aliasLabel1: \"aliasValue1\"}, properties:{timezone_id: \"testTimeZone\", language: \"testLanguage\"}}",
+            )
         val userBackendService = UserBackendService(spyHttpClient)
         val identities = mapOf("aliasLabel1" to "aliasValue1")
         val properties = mapOf("timezone_id" to "testTimeZone", "language" to "testLanguage")
@@ -70,6 +74,7 @@ class UserBackendServiceTests : FunSpec({
                     it.has("properties") shouldBe true
                     it.has("subscriptions") shouldBe false
                 },
+                any(),
             )
         }
     }
@@ -79,8 +84,12 @@ class UserBackendServiceTests : FunSpec({
         val osId = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
         coEvery {
-            spyHttpClient.post(any(), any())
-        } returns HttpResponse(202, "{identity:{onesignal_id: \"$osId\"}, subscriptions:[{id:\"subscriptionId1\", type:\"AndroidPush\"}], properties:{timezone_id: \"testTimeZone\", language: \"testLanguage\"}}")
+            spyHttpClient.post(any(), any(), any())
+        } returns
+            HttpResponse(
+                202,
+                "{identity:{onesignal_id: \"$osId\"}, subscriptions:[{id:\"subscriptionId1\", type:\"AndroidPush\"}], properties:{timezone_id: \"testTimeZone\", language: \"testLanguage\"}}",
+            )
         val userBackendService = UserBackendService(spyHttpClient)
         val identities = mapOf<String, String>()
         val subscriptions = mutableListOf<SubscriptionObject>()
@@ -109,6 +118,7 @@ class UserBackendServiceTests : FunSpec({
                     it.getJSONArray("subscriptions").getJSONObject(0).has("type") shouldBe true
                     it.getJSONArray("subscriptions").getJSONObject(0).getString("type") shouldBe "AndroidPush"
                 },
+                any(),
             )
         }
     }
@@ -118,7 +128,7 @@ class UserBackendServiceTests : FunSpec({
         val aliasLabel = "onesignal_id"
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.patch(any(), any()) } returns HttpResponse(202, "{properties: { tags: {tagKey1: tagValue1}}}")
+        coEvery { spyHttpClient.patch(any(), any(), any()) } returns HttpResponse(202, "{properties: { tags: {tagKey1: tagValue1}}}")
         val userBackendService = UserBackendService(spyHttpClient)
         val properties = PropertiesObject(tags = mapOf("tagkey1" to "tagValue1"))
         val propertiesDelta = PropertiesDeltasObject()
@@ -136,6 +146,7 @@ class UserBackendServiceTests : FunSpec({
                     it.getJSONObject("properties").getJSONObject("tags").has("tagkey1") shouldBe true
                     it.getJSONObject("properties").getJSONObject("tags").getString("tagkey1") shouldBe "tagValue1"
                 },
+                any(),
             )
         }
     }
@@ -145,7 +156,7 @@ class UserBackendServiceTests : FunSpec({
         val aliasLabel = "onesignal_id"
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.patch(any(), any()) } returns HttpResponse(202, "{properties: { tags: {tagKey1: tagValue1}}}")
+        coEvery { spyHttpClient.patch(any(), any(), any()) } returns HttpResponse(202, "{properties: { tags: {tagKey1: tagValue1}}}")
         val userBackendService = UserBackendService(spyHttpClient)
         val properties = PropertiesObject(language = "newLanguage")
         val propertiesDelta = PropertiesDeltasObject()
@@ -162,6 +173,7 @@ class UserBackendServiceTests : FunSpec({
                     it.getJSONObject("properties").has("language") shouldBe true
                     it.getJSONObject("properties").getString("language") shouldBe "newLanguage"
                 },
+                any(),
             )
         }
     }
@@ -171,7 +183,7 @@ class UserBackendServiceTests : FunSpec({
         val aliasLabel = "onesignal_id"
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.patch(any(), any()) } returns HttpResponse(202, "{properties: { timezone_id: \"America/New_York\"}}")
+        coEvery { spyHttpClient.patch(any(), any(), any()) } returns HttpResponse(202, "{properties: { timezone_id: \"America/New_York\"}}")
         val userBackendService = UserBackendService(spyHttpClient)
         val properties = PropertiesObject(timezoneId = "America/New_York")
         val propertiesDelta = PropertiesDeltasObject()
@@ -188,6 +200,7 @@ class UserBackendServiceTests : FunSpec({
                     it.getJSONObject("properties").has("timezone_id") shouldBe true
                     it.getJSONObject("properties").getString("timezone_id") shouldBe "America/New_York"
                 },
+                any(),
             )
         }
     }
@@ -197,7 +210,7 @@ class UserBackendServiceTests : FunSpec({
         val aliasLabel = "onesignal_id"
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.patch(any(), any()) } returns HttpResponse(202, "{properties: { country: \"TV\"}}")
+        coEvery { spyHttpClient.patch(any(), any(), any()) } returns HttpResponse(202, "{properties: { country: \"TV\"}}")
         val userBackendService = UserBackendService(spyHttpClient)
         val properties = PropertiesObject(country = "TV")
         val propertiesDelta = PropertiesDeltasObject()
@@ -214,6 +227,7 @@ class UserBackendServiceTests : FunSpec({
                     it.getJSONObject("properties").has("country") shouldBe true
                     it.getJSONObject("properties").getString("country") shouldBe "TV"
                 },
+                any(),
             )
         }
     }
@@ -223,7 +237,7 @@ class UserBackendServiceTests : FunSpec({
         val aliasLabel = "onesignal_id"
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.patch(any(), any()) } returns HttpResponse(202, "{properties: { lat: 12.34, long: 45.67}}")
+        coEvery { spyHttpClient.patch(any(), any(), any()) } returns HttpResponse(202, "{properties: { lat: 12.34, long: 45.67}}")
         val userBackendService = UserBackendService(spyHttpClient)
         val properties = PropertiesObject(latitude = 12.34, longitude = 45.67)
         val propertiesDelta = PropertiesDeltasObject()
@@ -242,6 +256,7 @@ class UserBackendServiceTests : FunSpec({
                     it.getJSONObject("properties").has("long") shouldBe true
                     it.getJSONObject("properties").getDouble("long") shouldBe 45.67
                 },
+                any(),
             )
         }
     }
@@ -251,7 +266,7 @@ class UserBackendServiceTests : FunSpec({
         val aliasLabel = "onesignal_id"
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.patch(any(), any()) } returns HttpResponse(202, "{properties: {} }")
+        coEvery { spyHttpClient.patch(any(), any(), any()) } returns HttpResponse(202, "{properties: {} }")
         val userBackendService = UserBackendService(spyHttpClient)
         val properties = PropertiesObject(tags = mapOf("tagkey1" to "tagValue1"))
         val propertiesDelta = PropertiesDeltasObject()
@@ -266,6 +281,7 @@ class UserBackendServiceTests : FunSpec({
                 withArg {
                     it.getBoolean("refresh_device_metadata") shouldBe true
                 },
+                any(),
             )
         }
     }
@@ -275,7 +291,7 @@ class UserBackendServiceTests : FunSpec({
         val aliasLabel = "onesignal_id"
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.patch(any(), any()) } returns HttpResponse(202, "{properties: {} }")
+        coEvery { spyHttpClient.patch(any(), any(), any()) } returns HttpResponse(202, "{properties: {} }")
         val userBackendService = UserBackendService(spyHttpClient)
         val properties = PropertiesObject(tags = mapOf("tagkey1" to "tagValue1"))
         val propertiesDelta = PropertiesDeltasObject()
@@ -290,6 +306,7 @@ class UserBackendServiceTests : FunSpec({
                 withArg {
                     it.getBoolean("refresh_device_metadata") shouldBe false
                 },
+                any(),
             )
         }
     }
@@ -299,7 +316,7 @@ class UserBackendServiceTests : FunSpec({
         val aliasLabel = "onesignal_id"
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.patch(any(), any()) } returns HttpResponse(202, "{properties: { }}")
+        coEvery { spyHttpClient.patch(any(), any(), any()) } returns HttpResponse(202, "{properties: { }}")
         val userBackendService = UserBackendService(spyHttpClient)
         val properties = PropertiesObject()
         val propertiesDelta = PropertiesDeltasObject(sessionTime = 1111, sessionCount = 1)
@@ -318,6 +335,7 @@ class UserBackendServiceTests : FunSpec({
                     it.getJSONObject("deltas").has("session_count") shouldBe true
                     it.getJSONObject("deltas").getInt("session_count") shouldBe 1
                 },
+                any(),
             )
         }
     }
@@ -327,7 +345,7 @@ class UserBackendServiceTests : FunSpec({
         val aliasLabel = "onesignal_id"
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.patch(any(), any()) } returns HttpResponse(202, "{properties: { }}")
+        coEvery { spyHttpClient.patch(any(), any(), any()) } returns HttpResponse(202, "{properties: { }}")
         val userBackendService = UserBackendService(spyHttpClient)
         val properties = PropertiesObject()
         val propertiesDelta =
@@ -366,6 +384,7 @@ class UserBackendServiceTests : FunSpec({
                     it.getJSONObject("deltas").getJSONArray("purchases").getJSONObject(1).has("amount") shouldBe true
                     it.getJSONObject("deltas").getJSONArray("purchases").getJSONObject(1).getDouble("amount") shouldBe 4444
                 },
+                any(),
             )
         }
     }
@@ -375,7 +394,7 @@ class UserBackendServiceTests : FunSpec({
         val aliasLabel = "onesignal_id"
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.patch(any(), any()) } returns HttpResponse(404, "NOT FOUND")
+        coEvery { spyHttpClient.patch(any(), any(), any()) } returns HttpResponse(404, "NOT FOUND")
         val userBackendService = UserBackendService(spyHttpClient)
         val properties = PropertiesObject(tags = mapOf("tagkey1" to "tagValue1"))
         val propertiesDelta = PropertiesDeltasObject()
@@ -396,7 +415,7 @@ class UserBackendServiceTests : FunSpec({
         val aliasLabel = "onesignal_id"
         val aliasValue = "11111111-1111-1111-1111-111111111111"
         val spyHttpClient = mockk<IHttpClient>()
-        coEvery { spyHttpClient.patch(any(), any()) } returns HttpResponse(403, "FORBIDDEN")
+        coEvery { spyHttpClient.patch(any(), any(), any()) } returns HttpResponse(403, "FORBIDDEN")
         val userBackendService = UserBackendService(spyHttpClient)
         val properties = PropertiesObject(tags = mapOf("tagkey1" to "tagValue1"))
         val propertiesDelta = PropertiesDeltasObject()
diff --git a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/migrations/RecoverFromDroppedLoginBugTests.kt b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/migrations/RecoverFromDroppedLoginBugTests.kt
index 554c09ac96..27a5c873cb 100644
--- a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/migrations/RecoverFromDroppedLoginBugTests.kt
+++ b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/migrations/RecoverFromDroppedLoginBugTests.kt
@@ -36,6 +36,7 @@ private class Mocks {
                 listOf(),
                 operationModelStore,
                 configModelStore,
+                MockHelper.identityModelStore(),
                 Time(),
                 ExecutorMocks.getNewRecordState(configModelStore),
             ),
diff --git a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/operations/IdentityOperationExecutorTests.kt b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/operations/IdentityOperationExecutorTests.kt
index 34d0681c48..d2ae66bf5d 100644
--- a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/operations/IdentityOperationExecutorTests.kt
+++ b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/operations/IdentityOperationExecutorTests.kt
@@ -32,9 +32,11 @@ class IdentityOperationExecutorTests : FunSpec({
         val mockIdentityModel = mockk<IdentityModel>()
         every { mockIdentityModel.onesignalId } returns "onesignalId"
         every { mockIdentityModel.setStringProperty(any(), any(), any()) } just runs
+        every { mockIdentityModel.jwtToken } returns null
 
         val mockIdentityModelStore = mockk<IdentityModelStore>()
         every { mockIdentityModelStore.model } returns mockIdentityModel
+        every { mockIdentityModelStore.getIdentityAlias() } returns Pair<String, String>(IdentityConstants.ONESIGNAL_ID, "onesignalId")
 
         val mockBuildUserService = mockk<IRebuildUserService>()
 
@@ -48,7 +50,13 @@ class IdentityOperationExecutorTests : FunSpec({
         // Then
         response.result shouldBe ExecutionResult.SUCCESS
         coVerify(exactly = 1) {
-            mockIdentityBackendService.setAlias("appId", IdentityConstants.ONESIGNAL_ID, "onesignalId", mapOf("aliasKey1" to "aliasValue1"))
+            mockIdentityBackendService.setAlias(
+                "appId",
+                IdentityConstants.ONESIGNAL_ID,
+                "onesignalId",
+                mapOf("aliasKey1" to "aliasValue1"),
+                null,
+            )
         }
         verify(exactly = 1) { mockIdentityModel.setStringProperty("aliasKey1", "aliasValue1", ModelChangeTags.HYDRATE) }
     }
@@ -153,6 +161,7 @@ class IdentityOperationExecutorTests : FunSpec({
         val mockIdentityModel = mockk<IdentityModel>()
         every { mockIdentityModel.onesignalId } returns "onesignalId"
         every { mockIdentityModel.setOptStringProperty(any(), any(), any()) } just runs
+        every { mockIdentityModel.jwtToken } returns null
 
         val mockIdentityModelStore = mockk<IdentityModelStore>()
         every { mockIdentityModelStore.model } returns mockIdentityModel
diff --git a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/operations/SubscriptionOperationExecutorTests.kt b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/operations/SubscriptionOperationExecutorTests.kt
index 9ed8cd2a08..b4202a56e4 100644
--- a/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/operations/SubscriptionOperationExecutorTests.kt
+++ b/OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/operations/SubscriptionOperationExecutorTests.kt
@@ -52,6 +52,7 @@ class SubscriptionOperationExecutorTests :
                 Pair(remoteSubscriptionId, rywData)
 
             val mockSubscriptionsModelStore = mockk<SubscriptionModelStore>()
+            val mockIdentityModelStore = MockHelper.identityModelStore()
             val subscriptionModel1 = SubscriptionModel()
             subscriptionModel1.id = localSubscriptionId
             every { mockSubscriptionsModelStore.get(localSubscriptionId) } returns subscriptionModel1
@@ -63,6 +64,7 @@ class SubscriptionOperationExecutorTests :
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    mockIdentityModelStore,
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
@@ -110,6 +112,7 @@ class SubscriptionOperationExecutorTests :
             coEvery { mockSubscriptionBackendService.createSubscription(any(), any(), any(), any()) } throws
                 BackendException(408, retryAfterSeconds = 10)
 
+            val mockIdentityModelStore = MockHelper.identityModelStore()
             val mockSubscriptionsModelStore = mockk<SubscriptionModelStore>()
             val mockBuildUserService = mockk<IRebuildUserService>()
 
@@ -118,6 +121,7 @@ class SubscriptionOperationExecutorTests :
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    mockIdentityModelStore,
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
@@ -173,6 +177,7 @@ class SubscriptionOperationExecutorTests :
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    MockHelper.identityModelStore(),
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
@@ -220,14 +225,20 @@ class SubscriptionOperationExecutorTests :
 
             val mockSubscriptionsModelStore = mockk<SubscriptionModelStore>()
             val mockBuildUserService = mockk<IRebuildUserService>()
+            val mockIdentityModelStore = MockHelper.identityModelStore()
             val mockConfigModelStore = MockHelper.configModelStore().also { it.model.opRepoPostCreateRetryUpTo = 1_000 }
             val newRecordState = getNewRecordState(mockConfigModelStore).also { it.add(remoteOneSignalId) }
+            val subscriptionModel1 = SubscriptionModel()
+            subscriptionModel1.id = remoteSubscriptionId
+            subscriptionModel1.address = "pushToken1"
+            every { mockSubscriptionsModelStore.get(remoteSubscriptionId) } returns subscriptionModel1
 
             val subscriptionOperationExecutor =
                 SubscriptionOperationExecutor(
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    mockIdentityModelStore,
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
@@ -258,7 +269,7 @@ class SubscriptionOperationExecutorTests :
         test("create subscription then delete subscription is a successful no-op") {
             // Given
             val mockSubscriptionBackendService = mockk<ISubscriptionBackendService>()
-
+            val mockIdentityModelStore = MockHelper.identityModelStore()
             val mockSubscriptionsModelStore = mockk<SubscriptionModelStore>()
             val subscriptionModel1 = SubscriptionModel()
             subscriptionModel1.id = localSubscriptionId
@@ -271,6 +282,7 @@ class SubscriptionOperationExecutorTests :
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    mockIdentityModelStore,
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
@@ -301,6 +313,7 @@ class SubscriptionOperationExecutorTests :
 
         test("create subscription then update subscription successfully creates subscription") {
             // Given
+            val mockIdentityModelStore = MockHelper.identityModelStore()
             val mockSubscriptionBackendService = mockk<ISubscriptionBackendService>()
             coEvery { mockSubscriptionBackendService.createSubscription(any(), any(), any(), any()) } returns
                 Pair(remoteSubscriptionId, rywData)
@@ -317,6 +330,7 @@ class SubscriptionOperationExecutorTests :
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    mockIdentityModelStore,
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
@@ -369,6 +383,7 @@ class SubscriptionOperationExecutorTests :
 
         test("update subscription successfully updates subscription") {
             // Given
+            val mockIdentityModelStore = MockHelper.identityModelStore()
             val mockSubscriptionBackendService = mockk<ISubscriptionBackendService>()
             coEvery { mockSubscriptionBackendService.updateSubscription(any(), any(), any()) } returns rywData
 
@@ -387,6 +402,7 @@ class SubscriptionOperationExecutorTests :
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    mockIdentityModelStore,
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
@@ -437,6 +453,7 @@ class SubscriptionOperationExecutorTests :
 
         test("update subscription fails with retry when there is a network condition") {
             // Given
+            val mockIdentityModelStore = MockHelper.identityModelStore()
             val mockSubscriptionBackendService = mockk<ISubscriptionBackendService>()
             coEvery { mockSubscriptionBackendService.updateSubscription(any(), any(), any()) } throws BackendException(408)
 
@@ -448,6 +465,7 @@ class SubscriptionOperationExecutorTests :
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    mockIdentityModelStore,
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
@@ -492,6 +510,7 @@ class SubscriptionOperationExecutorTests :
             val mockSubscriptionBackendService = mockk<ISubscriptionBackendService>()
             coEvery { mockSubscriptionBackendService.updateSubscription(any(), any(), any()) } throws BackendException(404)
 
+            val mockIdentityModelStore = MockHelper.identityModelStore()
             val mockSubscriptionsModelStore = mockk<SubscriptionModelStore>()
             val mockBuildUserService = mockk<IRebuildUserService>()
 
@@ -500,6 +519,7 @@ class SubscriptionOperationExecutorTests :
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    mockIdentityModelStore,
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
@@ -544,6 +564,7 @@ class SubscriptionOperationExecutorTests :
             val mockSubscriptionBackendService = mockk<ISubscriptionBackendService>()
             coEvery { mockSubscriptionBackendService.updateSubscription(any(), any(), any()) } throws BackendException(404)
 
+            val mockIdentityModelStore = MockHelper.identityModelStore()
             val mockSubscriptionsModelStore = mockk<SubscriptionModelStore>()
             val mockBuildUserService = mockk<IRebuildUserService>()
             val mockConfigModelStore = MockHelper.configModelStore().also { it.model.opRepoPostCreateRetryUpTo = 1_000 }
@@ -554,6 +575,7 @@ class SubscriptionOperationExecutorTests :
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    mockIdentityModelStore,
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
@@ -586,6 +608,7 @@ class SubscriptionOperationExecutorTests :
             val mockSubscriptionBackendService = mockk<ISubscriptionBackendService>()
             coEvery { mockSubscriptionBackendService.deleteSubscription(any(), any()) } just runs
 
+            val mockIdentityModelStore = MockHelper.identityModelStore()
             val mockSubscriptionsModelStore = mockk<SubscriptionModelStore>()
             every { mockSubscriptionsModelStore.remove(any(), any()) } just runs
 
@@ -596,6 +619,7 @@ class SubscriptionOperationExecutorTests :
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    mockIdentityModelStore,
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
@@ -622,6 +646,7 @@ class SubscriptionOperationExecutorTests :
             val mockSubscriptionBackendService = mockk<ISubscriptionBackendService>()
             coEvery { mockSubscriptionBackendService.deleteSubscription(any(), any()) } throws BackendException(408)
 
+            val mockIdentityModelStore = MockHelper.identityModelStore()
             val mockSubscriptionsModelStore = mockk<SubscriptionModelStore>()
             val mockBuildUserService = mockk<IRebuildUserService>()
 
@@ -630,6 +655,7 @@ class SubscriptionOperationExecutorTests :
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    mockIdentityModelStore,
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
@@ -657,6 +683,7 @@ class SubscriptionOperationExecutorTests :
             val mockSubscriptionBackendService = mockk<ISubscriptionBackendService>()
             coEvery { mockSubscriptionBackendService.deleteSubscription(any(), any()) } throws BackendException(404)
 
+            val mockIdentityModelStore = MockHelper.identityModelStore()
             val mockSubscriptionsModelStore = mockk<SubscriptionModelStore>()
             val mockBuildUserService = mockk<IRebuildUserService>()
 
@@ -665,6 +692,7 @@ class SubscriptionOperationExecutorTests :
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    mockIdentityModelStore,
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
@@ -700,6 +728,7 @@ class SubscriptionOperationExecutorTests :
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    MockHelper.identityModelStore(),
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
@@ -741,6 +770,7 @@ class SubscriptionOperationExecutorTests :
                     mockSubscriptionBackendService,
                     MockHelper.deviceService(),
                     AndroidMockHelper.applicationService(),
+                    MockHelper.identityModelStore(),
                     mockSubscriptionsModelStore,
                     MockHelper.configModelStore(),
                     mockBuildUserService,
diff --git a/OneSignalSDK/onesignal/in-app-messages/src/main/java/com/onesignal/inAppMessages/internal/InAppMessagesManager.kt b/OneSignalSDK/onesignal/in-app-messages/src/main/java/com/onesignal/inAppMessages/internal/InAppMessagesManager.kt
index f1743d3715..83774a37f0 100644
--- a/OneSignalSDK/onesignal/in-app-messages/src/main/java/com/onesignal/inAppMessages/internal/InAppMessagesManager.kt
+++ b/OneSignalSDK/onesignal/in-app-messages/src/main/java/com/onesignal/inAppMessages/internal/InAppMessagesManager.kt
@@ -43,6 +43,7 @@ import com.onesignal.session.internal.outcomes.IOutcomeEventsController
 import com.onesignal.session.internal.session.ISessionLifecycleHandler
 import com.onesignal.session.internal.session.ISessionService
 import com.onesignal.user.IUserManager
+import com.onesignal.user.internal.identity.IdentityModelStore
 import com.onesignal.user.internal.subscriptions.ISubscriptionChangedHandler
 import com.onesignal.user.internal.subscriptions.ISubscriptionManager
 import com.onesignal.user.internal.subscriptions.SubscriptionModel
@@ -60,6 +61,7 @@ internal class InAppMessagesManager(
     private val _influenceManager: IInfluenceManager,
     private val _configModelStore: ConfigModelStore,
     private val _userManager: IUserManager,
+    private val _identityModelStore: IdentityModelStore,
     private val _subscriptionManager: ISubscriptionManager,
     private val _outcomeEventsController: IOutcomeEventsController,
     private val _state: InAppStateService,
@@ -279,7 +281,15 @@ internal class InAppMessagesManager(
 
         // lambda so that it is updated on each potential retry
         val sessionDurationProvider = { _time.currentTimeMillis - _sessionService.startTime }
-        val newMessages = _backend.listInAppMessages(appId, subscriptionId, rywData, sessionDurationProvider)
+        val newMessages =
+            _backend.listInAppMessages(
+                appId,
+                subscriptionId,
+                rywData,
+                sessionDurationProvider,
+                _identityModelStore.model.jwtToken,
+                _identityModelStore.getIdentityAlias(),
+            )
 
         if (newMessages != null) {
             this.messages = newMessages as MutableList<InAppMessage>
diff --git a/OneSignalSDK/onesignal/in-app-messages/src/main/java/com/onesignal/inAppMessages/internal/backend/IInAppBackendService.kt b/OneSignalSDK/onesignal/in-app-messages/src/main/java/com/onesignal/inAppMessages/internal/backend/IInAppBackendService.kt
index 6755b6eb5a..1d53007028 100644
--- a/OneSignalSDK/onesignal/in-app-messages/src/main/java/com/onesignal/inAppMessages/internal/backend/IInAppBackendService.kt
+++ b/OneSignalSDK/onesignal/in-app-messages/src/main/java/com/onesignal/inAppMessages/internal/backend/IInAppBackendService.kt
@@ -16,6 +16,8 @@ internal interface IInAppBackendService {
      * @param subscriptionId The specific subscription within the [appId] the IAM will be delivered to.
      * @param rywToken Used for read your write consistency
      * @param sessionDurationProvider Lambda to calculate the session duration at the time of the request
+     * @param jwt The JWT token for the current logged in user. Not used if identity verification is off.
+     * @param externalId the external ID of current user. Not used if identity verification is off.
      *
      * @return The list of IAMs associated to the subscription, or null if the IAMs could not be retrieved.
      */
@@ -24,6 +26,8 @@ internal interface IInAppBackendService {
         subscriptionId: String,
         rywData: RywData,
         sessionDurationProvider: () -> Long,
+        jwt: String? = null,
+        alias: Pair<String, String>,
     ): List<InAppMessage>?
 
     /**
diff --git a/OneSignalSDK/onesignal/in-app-messages/src/main/java/com/onesignal/inAppMessages/internal/backend/impl/InAppBackendService.kt b/OneSignalSDK/onesignal/in-app-messages/src/main/java/com/onesignal/inAppMessages/internal/backend/impl/InAppBackendService.kt
index 79d9a76099..02e25616ab 100644
--- a/OneSignalSDK/onesignal/in-app-messages/src/main/java/com/onesignal/inAppMessages/internal/backend/impl/InAppBackendService.kt
+++ b/OneSignalSDK/onesignal/in-app-messages/src/main/java/com/onesignal/inAppMessages/internal/backend/impl/InAppBackendService.kt
@@ -29,12 +29,14 @@ internal class InAppBackendService(
         subscriptionId: String,
         rywData: RywData,
         sessionDurationProvider: () -> Long,
+        jwt: String?,
+        alias: Pair<String, String>,
     ): List<InAppMessage>? {
         val rywDelay = rywData.rywDelay ?: DEFAULT_RYW_DELAY_MS
         delay(rywDelay) // Delay by the specified amount
 
-        val baseUrl = "apps/$appId/subscriptions/$subscriptionId/iams"
-        return attemptFetchWithRetries(baseUrl, rywData, sessionDurationProvider)
+        val baseUrl = "apps/$appId/users/by/${alias.first}/${alias.second}/subscriptions/$subscriptionId/iams"
+        return attemptFetchWithRetries(baseUrl, rywData, sessionDurationProvider, OptionalHeaders(jwt = jwt))
     }
 
     override suspend fun getIAMData(
@@ -209,6 +211,7 @@ internal class InAppBackendService(
         baseUrl: String,
         rywData: RywData,
         sessionDurationProvider: () -> Long,
+        optionalHeaders: OptionalHeaders,
     ): List<InAppMessage>? {
         var attempts = 0
         var retryLimit: Int = 0 // retry limit is remote defined & set dynamically below
@@ -220,8 +223,13 @@ internal class InAppBackendService(
                     rywToken = rywData.rywToken,
                     sessionDuration = sessionDurationProvider(),
                     retryCount = retryCount,
+                    jwt = optionalHeaders.jwt,
+                )
+            val response =
+                _httpClient.get(
+                    baseUrl,
+                    values,
                 )
-            val response = _httpClient.get(baseUrl, values)
 
             if (response.isSuccess) {
                 val jsonResponse = response.payload?.let { JSONObject(it) }
@@ -244,26 +252,27 @@ internal class InAppBackendService(
         } while (attempts <= retryLimit)
 
         // Final attempt without the RYW token if retries fail
-        return fetchInAppMessagesWithoutRywToken(baseUrl, sessionDurationProvider)
+        return fetchInAppMessagesWithoutRywToken(
+            baseUrl,
+            OptionalHeaders(sessionDuration = optionalHeaders.sessionDuration, jwt = optionalHeaders.jwt),
+        )
     }
 
     private suspend fun fetchInAppMessagesWithoutRywToken(
         url: String,
-        sessionDurationProvider: () -> Long,
+        optionalHeaders: OptionalHeaders,
     ): List<InAppMessage>? {
         val response =
             _httpClient.get(
                 url,
-                OptionalHeaders(
-                    sessionDuration = sessionDurationProvider(),
-                ),
+                optionalHeaders,
             )
 
-        if (response.isSuccess) {
+        return if (response.isSuccess) {
             val jsonResponse = response.payload?.let { JSONObject(it) }
-            return jsonResponse?.let { hydrateInAppMessages(it) }
+            jsonResponse?.let { hydrateInAppMessages(it) }
         } else {
-            return null
+            null
         }
     }
 
diff --git a/OneSignalSDK/onesignal/in-app-messages/src/test/java/com/onesignal/inAppMessages/internal/InAppMessagesManagerTests.kt b/OneSignalSDK/onesignal/in-app-messages/src/test/java/com/onesignal/inAppMessages/internal/InAppMessagesManagerTests.kt
index f2753bcff8..63cea213b4 100644
--- a/OneSignalSDK/onesignal/in-app-messages/src/test/java/com/onesignal/inAppMessages/internal/InAppMessagesManagerTests.kt
+++ b/OneSignalSDK/onesignal/in-app-messages/src/test/java/com/onesignal/inAppMessages/internal/InAppMessagesManagerTests.kt
@@ -14,6 +14,7 @@ import com.onesignal.session.internal.influence.IInfluenceManager
 import com.onesignal.session.internal.outcomes.IOutcomeEventsController
 import com.onesignal.session.internal.session.ISessionService
 import com.onesignal.user.IUserManager
+import com.onesignal.user.internal.identity.IdentityModelStore
 import com.onesignal.user.internal.subscriptions.ISubscriptionManager
 import io.kotest.core.spec.style.FunSpec
 import io.kotest.matchers.shouldBe
@@ -41,6 +42,7 @@ class InAppMessagesManagerTests : FunSpec({
                 mockk<IInfluenceManager>(),
                 mockk<ConfigModelStore>(),
                 mockk<IUserManager>(),
+                mockk<IdentityModelStore>(),
                 mockk<ISubscriptionManager>(),
                 mockk<IOutcomeEventsController>(),
                 mockk<InAppStateService>(),
diff --git a/OneSignalSDK/onesignal/in-app-messages/src/test/java/com/onesignal/inAppMessages/internal/backend/InAppBackendServiceTests.kt b/OneSignalSDK/onesignal/in-app-messages/src/test/java/com/onesignal/inAppMessages/internal/backend/InAppBackendServiceTests.kt
index 72f986e0ec..4f97d95bdf 100644
--- a/OneSignalSDK/onesignal/in-app-messages/src/test/java/com/onesignal/inAppMessages/internal/backend/InAppBackendServiceTests.kt
+++ b/OneSignalSDK/onesignal/in-app-messages/src/test/java/com/onesignal/inAppMessages/internal/backend/InAppBackendServiceTests.kt
@@ -40,12 +40,21 @@ class InAppBackendServiceTests :
             val inAppBackendService = InAppBackendService(mockHttpClient, MockHelper.deviceService(), mockHydrator)
 
             // When
-            val response = inAppBackendService.listInAppMessages("appId", "subscriptionId", RywData("123", 500L), mockSessionDurationProvider)
+            val response =
+                inAppBackendService.listInAppMessages(
+                    "appId",
+                    "subscriptionId",
+                    rywData = RywData("123", 500L),
+                    mockSessionDurationProvider,
+                    alias = Pair<String, String>("onesignal_id", "onesignal_id"),
+                )
 
             // Then
             response shouldNotBe null
             response!!.count() shouldBe 0
-            coVerify(exactly = 1) { mockHttpClient.get("apps/appId/subscriptions/subscriptionId/iams", any()) }
+            coVerify(
+                exactly = 1,
+            ) { mockHttpClient.get("apps/appId/users/by/onesignal_id/onesignal_id/subscriptions/subscriptionId/iams", any()) }
         }
 
         test("listInAppMessages with 1 message returns one-lengthed array") {
@@ -63,7 +72,14 @@ class InAppBackendServiceTests :
             val inAppBackendService = InAppBackendService(mockHttpClient, MockHelper.deviceService(), mockHydrator)
 
             // When
-            val response = inAppBackendService.listInAppMessages("appId", "subscriptionId", RywData("123", 500L), mockSessionDurationProvider)
+            val response =
+                inAppBackendService.listInAppMessages(
+                    "appId",
+                    "subscriptionId",
+                    rywData = RywData("123", 0),
+                    mockSessionDurationProvider,
+                    alias = Pair<String, String>("onesignal_id", "onesignal_id"),
+                )
 
             // Then
             response shouldNotBe null
@@ -84,7 +100,9 @@ class InAppBackendServiceTests :
             response[0].redisplayStats.displayLimit shouldBe 11111
             response[0].redisplayStats.displayDelay shouldBe 22222
 
-            coVerify(exactly = 1) { mockHttpClient.get("apps/appId/subscriptions/subscriptionId/iams", any()) }
+            coVerify(
+                exactly = 1,
+            ) { mockHttpClient.get("apps/appId/users/by/onesignal_id/onesignal_id/subscriptions/subscriptionId/iams", any()) }
         }
 
         test("listInAppMessages returns null when non-success response") {
@@ -96,11 +114,20 @@ class InAppBackendServiceTests :
             val inAppBackendService = InAppBackendService(mockHttpClient, MockHelper.deviceService(), mockHydrator)
 
             // When
-            val response = inAppBackendService.listInAppMessages("appId", "subscriptionId", RywData("123", 500L), mockSessionDurationProvider)
+            val response =
+                inAppBackendService.listInAppMessages(
+                    "appId",
+                    "subscriptionId",
+                    rywData = RywData("123", 0),
+                    mockSessionDurationProvider,
+                    alias = Pair<String, String>("onesignal_id", "onesignal_id"),
+                )
 
             // Then
             response shouldBe null
-            coVerify(exactly = 1) { mockHttpClient.get("apps/appId/subscriptions/subscriptionId/iams", any()) }
+            coVerify(
+                exactly = 1,
+            ) { mockHttpClient.get("apps/appId/users/by/onesignal_id/onesignal_id/subscriptions/subscriptionId/iams", any()) }
         }
 
         test(
@@ -125,7 +152,14 @@ class InAppBackendServiceTests :
             val inAppBackendService = InAppBackendService(mockHttpClient, MockHelper.deviceService(), mockHydrator)
 
             // When
-            val response = inAppBackendService.listInAppMessages("appId", "subscriptionId", RywData("1234", 500L), mockSessionDurationProvider)
+            val response =
+                inAppBackendService.listInAppMessages(
+                    "appId",
+                    "subscriptionId",
+                    rywData = RywData("1234", 0),
+                    mockSessionDurationProvider,
+                    alias = Pair<String, String>("onesignal_id", "onesignal_id"),
+                )
 
             // Then
             response shouldNotBe null
@@ -133,7 +167,7 @@ class InAppBackendServiceTests :
 
             coVerify(exactly = 1) {
                 mockHttpClient.get(
-                    "apps/appId/subscriptions/subscriptionId/iams",
+                    "apps/appId/users/by/onesignal_id/onesignal_id/subscriptions/subscriptionId/iams",
                     match {
                         it.rywToken == "1234" && it.retryCount == null && it.sessionDuration == mockSessionDurationProvider()
                     },
@@ -143,7 +177,7 @@ class InAppBackendServiceTests :
             // Verify that the get method retried twice with the RYW token
             coVerify(exactly = 3) {
                 mockHttpClient.get(
-                    "apps/appId/subscriptions/subscriptionId/iams",
+                    "apps/appId/users/by/onesignal_id/onesignal_id/subscriptions/subscriptionId/iams",
                     match {
                         it.rywToken == "1234" && it.sessionDuration == mockSessionDurationProvider() && it.retryCount != null
                     },
@@ -153,9 +187,9 @@ class InAppBackendServiceTests :
             // Verify that the get method was retried the final time without the RYW token
             coVerify(exactly = 1) {
                 mockHttpClient.get(
-                    "apps/appId/subscriptions/subscriptionId/iams",
+                    any(),
                     match {
-                        it.rywToken == null && it.sessionDuration == mockSessionDurationProvider() && it.retryCount == null
+                        it.rywToken == null && it.sessionDuration == null && it.retryCount == null
                     },
                 )
             }
diff --git a/OneSignalSDK/onesignal/testhelpers/src/main/java/com/onesignal/mocks/MockHelper.kt b/OneSignalSDK/onesignal/testhelpers/src/main/java/com/onesignal/mocks/MockHelper.kt
index d8fa8ed86a..2e22da10b5 100644
--- a/OneSignalSDK/onesignal/testhelpers/src/main/java/com/onesignal/mocks/MockHelper.kt
+++ b/OneSignalSDK/onesignal/testhelpers/src/main/java/com/onesignal/mocks/MockHelper.kt
@@ -78,6 +78,7 @@ object MockHelper {
         val mockIdentityStore = mockk<IdentityModelStore>(relaxed = true)
 
         every { mockIdentityStore.model } returns identityModel
+        every { mockIdentityStore.getIdentityAlias() } returns Pair<String, String>("onesignal_id", "remote-onesignalId")
 
         return mockIdentityStore
     }