diff --git a/src/Core/Services/AuthService.cs b/src/Core/Services/AuthService.cs
index f86f4494c..9dd04333b 100644
--- a/src/Core/Services/AuthService.cs
+++ b/src/Core/Services/AuthService.cs
@@ -501,14 +501,9 @@ namespace Bit.Core.Services
 
                 if (code == null || tokenResponse.Key != null)
                 {
-                    if (tokenResponse.KeyConnectorUrl != null)
-                    {
-                        await _keyConnectorService.GetAndSetKey(tokenResponse.KeyConnectorUrl);
-                    }
-
+                    var decryptOptions = await _stateService.GetAccountDecryptionOptions();
                     await _cryptoService.SetMasterKeyEncryptedUserKeyAsync(tokenResponse.Key);
 
-                    var decryptOptions = await _stateService.GetAccountDecryptionOptions();
                     if (decryptOptions?.TrustedDeviceOption != null)
                     {
                         var key = await _deviceTrustCryptoService.DecryptUserKeyWithDeviceKeyAsync(decryptOptions?.TrustedDeviceOption.EncryptedPrivateKey, decryptOptions?.TrustedDeviceOption.EncryptedUserKey);
@@ -517,12 +512,16 @@ namespace Bit.Core.Services
                             await _cryptoService.SetUserKeyAsync(key);
                         }
                     }
-                    else if (masterKey != null &&
-                        (!string.IsNullOrEmpty(tokenResponse.KeyConnectorUrl) || !string.IsNullOrEmpty(decryptOptions?.KeyConnectorOption?.KeyConnectorUrl)))
+                    else if (!string.IsNullOrEmpty(tokenResponse.KeyConnectorUrl) || !string.IsNullOrEmpty(decryptOptions?.KeyConnectorOption?.KeyConnectorUrl))
                     {
-                        await _cryptoService.SetMasterKeyAsync(masterKey);
-                        var userKey = await _cryptoService.DecryptUserKeyWithMasterKeyAsync(masterKey);
-                        await _cryptoService.SetUserKeyAsync(userKey);
+
+                        await _cryptoService.SetMasterKeyEncryptedUserKeyAsync(tokenResponse.Key);
+                        if (masterKey != null)
+                        {
+                            await _cryptoService.SetMasterKeyAsync(masterKey);
+                            var userKey = await _cryptoService.DecryptUserKeyWithMasterKeyAsync(masterKey);
+                            await _cryptoService.SetUserKeyAsync(userKey);
+                        }
                     }
 
                     // Login with Device
diff --git a/src/Core/Services/DeviceTrustCryptoService.cs b/src/Core/Services/DeviceTrustCryptoService.cs
index 93ccb905e..0d9b81aa9 100644
--- a/src/Core/Services/DeviceTrustCryptoService.cs
+++ b/src/Core/Services/DeviceTrustCryptoService.cs
@@ -33,12 +33,14 @@ namespace Bit.Core.Services
 
         public async Task<SymmetricCryptoKey> GetDeviceKeyAsync()
         {
-            return await _stateService.GetDeviceKeyAsync();
+            var activeUserId = await _stateService.GetActiveUserIdAsync();
+            return await _stateService.GetDeviceKeyAsync(activeUserId);
         }
 
         private async Task SetDeviceKeyAsync(SymmetricCryptoKey deviceKey)
         {
-            await _stateService.SetDeviceKeyAsync(deviceKey);
+            var activeUserId = await _stateService.GetActiveUserIdAsync();
+            await _stateService.SetDeviceKeyAsync(deviceKey, activeUserId);
         }
 
         public async Task<DeviceResponse> TrustDeviceAsync()
diff --git a/src/Core/Services/StateService.cs b/src/Core/Services/StateService.cs
index 480bacaaa..49a069ddf 100644
--- a/src/Core/Services/StateService.cs
+++ b/src/Core/Services/StateService.cs
@@ -515,9 +515,7 @@ namespace Bit.Core.Services
 
         public async Task<SymmetricCryptoKey> GetDeviceKeyAsync(string userId = null)
         {
-            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
-                await GetDefaultStorageOptionsAsync());
-            var deviceKeyB64 = await _storageMediatorService.GetAsync<string>(Constants.DeviceKeyKey(reconciledOptions.UserId), true);
+            var deviceKeyB64 = await _storageMediatorService.GetAsync<string>(Constants.DeviceKeyKey(userId), true);
             if (string.IsNullOrEmpty(deviceKeyB64))
             {
                 return null;
@@ -527,9 +525,7 @@ namespace Bit.Core.Services
 
         public async Task SetDeviceKeyAsync(SymmetricCryptoKey value, string userId = null)
         {
-            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
-                await GetDefaultStorageOptionsAsync());
-            await _storageMediatorService.SaveAsync(Constants.DeviceKeyKey(reconciledOptions.UserId), value.KeyB64, true);
+            await _storageMediatorService.SaveAsync(Constants.DeviceKeyKey(userId), value.KeyB64, true);
         }
 
         public async Task<List<string>> GetAutofillBlacklistedUrisAsync(string userId = null)