diff --git a/libresapi/src/api/ApiServer.cpp b/libresapi/src/api/ApiServer.cpp
index fccc3cc72..176e6290e 100644
--- a/libresapi/src/api/ApiServer.cpp
+++ b/libresapi/src/api/ApiServer.cpp
@@ -226,7 +226,7 @@ class ApiServerMainModules
 public:
     ApiServerMainModules(ResourceRouter& router, StateTokenServer* sts, const RsPlugInInterfaces &ifaces):
         mPeersHandler(sts, ifaces.mNotify, ifaces.mPeers, ifaces.mMsgs),
-        mIdentityHandler(ifaces.mIdentity),
+        mIdentityHandler(sts, ifaces.mNotify, ifaces.mIdentity),
         mForumHandler(ifaces.mGxsForums),
         mServiceControlHandler(ifaces.mServiceControl),
         mFileSearchHandler(sts, ifaces.mNotify, ifaces.mTurtle, ifaces.mFiles),
diff --git a/libresapi/src/api/GetPluginInterfaces.h b/libresapi/src/api/GetPluginInterfaces.h
index 053023144..73cca040a 100644
--- a/libresapi/src/api/GetPluginInterfaces.h
+++ b/libresapi/src/api/GetPluginInterfaces.h
@@ -4,6 +4,7 @@ class RsPlugInInterfaces;
 
 namespace resource_api{
 
+// populates the given RsPlugInInterfaces object with pointers from gloabl variables like rsPeers, rsMsgs, rsFiles...
 bool getPluginInterfaces(RsPlugInInterfaces& interfaces);
 
 } // namespace resource_api
diff --git a/libresapi/src/api/IdentityHandler.cpp b/libresapi/src/api/IdentityHandler.cpp
index f5128561a..1902df295 100644
--- a/libresapi/src/api/IdentityHandler.cpp
+++ b/libresapi/src/api/IdentityHandler.cpp
@@ -16,17 +16,18 @@ namespace resource_api
 class SendIdentitiesListTask: public GxsResponseTask
 {
 public:
-    SendIdentitiesListTask(RsIdentity* idservice, std::list<RsGxsId> ids):
-        GxsResponseTask(idservice, 0)
+    SendIdentitiesListTask(RsIdentity* idservice, std::list<RsGxsId> ids, StateToken state):
+        GxsResponseTask(idservice, 0), mStateToken(state)
     {
         for(std::list<RsGxsId>::iterator vit = ids.begin(); vit != ids.end(); ++vit)
         {
             requestGxsId(*vit);
-            mIds.push_back(*vit);// convert fro list to vector
+            mIds.push_back(*vit);// convert from list to vector
         }
     }
 private:
     std::vector<RsGxsId> mIds;
+    StateToken mStateToken;
 protected:
     virtual void gxsDoWork(Request &req, Response &resp)
     {
@@ -35,6 +36,7 @@ protected:
         {
             streamGxsId(*vit, resp.mDataStream.getStreamToMember());
         }
+        resp.mStateToken = mStateToken;
         resp.setOk();
         done();
     }
@@ -93,20 +95,39 @@ protected:
     }
 };
 
-IdentityHandler::IdentityHandler(RsIdentity *identity):
-    mRsIdentity(identity)
+IdentityHandler::IdentityHandler(StateTokenServer *sts, RsNotify *notify, RsIdentity *identity):
+    mStateTokenServer(sts), mNotify(notify), mRsIdentity(identity),
+    mMtx("IdentityHandler Mtx"), mStateToken(sts->getNewToken())
 {
+    mNotify->registerNotifyClient(this);
+
     addResourceHandler("*", this, &IdentityHandler::handleWildcard);
     addResourceHandler("own", this, &IdentityHandler::handleOwn);
     addResourceHandler("create_identity", this, &IdentityHandler::handleCreateIdentity);
 }
 
+IdentityHandler::~IdentityHandler()
+{
+    mNotify->unregisterNotifyClient(this);
+}
+
+void IdentityHandler::notifyGxsChange(const RsGxsChanges &changes)
+{
+    RS_STACK_MUTEX(mMtx); // ********** LOCKED **********
+    // if changes come from identity service, invalidate own state token
+    if(changes.mService == mRsIdentity->getTokenService())
+    {
+        mStateTokenServer->replaceToken(mStateToken);
+    }
+}
+
 void IdentityHandler::handleWildcard(Request &req, Response &resp)
 {
     bool ok = true;
 
     if(req.isPut())
     {
+#ifdef REMOVE
         RsIdentityParameters params;
         req.mStream << makeKeyValueReference("name", params.nickname);
         if(req.mStream.isOK())
@@ -120,9 +141,14 @@ void IdentityHandler::handleWildcard(Request &req, Response &resp)
         {
             ok = false;
         }
+#endif
     }
     else
     {
+        {
+            RS_STACK_MUTEX(mMtx); // ********** LOCKED **********
+            resp.mStateToken = mStateToken;
+        }
         RsTokReqOptions opts;
         opts.mReqType = GXS_REQUEST_TYPE_GROUP_DATA;
         uint32_t token;
@@ -179,9 +205,14 @@ void IdentityHandler::handleWildcard(Request &req, Response &resp)
 
 ResponseTask* IdentityHandler::handleOwn(Request &req, Response &resp)
 {
+    StateToken state;
+    {
+        RS_STACK_MUTEX(mMtx); // ********** LOCKED **********
+        state = mStateToken;
+    }
     std::list<RsGxsId> ids;
     if(mRsIdentity->getOwnIds(ids))
-        return new SendIdentitiesListTask(mRsIdentity, ids);
+        return new SendIdentitiesListTask(mRsIdentity, ids, state);
     resp.mDataStream.getStreamToMember();
     resp.setWarning("identities not loaded yet");
     return 0;
diff --git a/libresapi/src/api/IdentityHandler.h b/libresapi/src/api/IdentityHandler.h
index 8d110727e..5e5d67f13 100644
--- a/libresapi/src/api/IdentityHandler.h
+++ b/libresapi/src/api/IdentityHandler.h
@@ -1,20 +1,36 @@
 #pragma once
 
+#include <retroshare/rsnotify.h>
+#include <util/rsthreads.h>
+
 #include "ResourceRouter.h"
+#include "StateTokenServer.h"
 
 class RsIdentity;
 
 namespace resource_api
 {
 
-class IdentityHandler: public ResourceRouter
+class IdentityHandler: public ResourceRouter, NotifyClient
 {
 public:
-    IdentityHandler(RsIdentity* identity);
+    IdentityHandler(StateTokenServer* sts, RsNotify* notify, RsIdentity* identity);
+    virtual ~IdentityHandler();
+
+    // from NotifyClient
+    // note: this may get called from foreign threads
+    virtual void notifyGxsChange(const RsGxsChanges &changes);
+
 private:
-    RsIdentity* mRsIdentity;
     void handleWildcard(Request& req, Response& resp);
     ResponseTask *handleOwn(Request& req, Response& resp);
     ResponseTask *handleCreateIdentity(Request& req, Response& resp);
+
+    StateTokenServer* mStateTokenServer;
+    RsNotify* mNotify;
+    RsIdentity* mRsIdentity;
+
+    RsMutex mMtx;
+    StateToken mStateToken; // mutex protected
 };
 } // namespace resource_api