it's being used for the auth-client in /verify and for account update API calls.