A method of authenticating a client device, comprising: receiving, at a registration server, first device credentials from the client device, the first device credentials including a secret generated by a third party that is unique to the client device; determining, by the registration server, whether the first device credentials are valid; determining, by the registration server, whether receiving the first device credentials from the client device is an initial registration contact involving the first device credentials or a subsequent registration contact involving the first device credentials; when it is determined that the first device credentials are valid and that receiving the first device credentials from the client device is an initial registration contact: generating, by the registration server, second device credentials, wherein the second device credentials are accessible to a synchronization server; and communicating the second device credentials to the client device; when it is determined that receiving the first device credentials is a subsequent registration contact involving the first device credentials: determining whether a user account is already paired with a client device that previously provided the first device credentials to the registration server; and when it is determined that the user account is already paired with the client device that previously provided the first device credentials, unpairing the user account from the client device that previously provided the first credentials. receiving, at a registration server, first device credentials from the client device, the first device credentials including a secret generated by a third party that is unique to the client device; determining, by the registration server, whether the first device credentials are valid; determining, by the registration server, whether receiving the first device credentials from the client device is an initial registration contact involving the first device credentials or a subsequent registration contact involving the first device credentials; when it is determined that the first device credentials are valid and that receiving the first device credentials from the client device is an initial registration contact: generating, by the registration server, second device credentials, generating, by the registration server, second device credentials, wherein the second device credentials are accessible to a synchronization server; and communicating the second device credentials to the client device; when it is determined that receiving the first device credentials is a subsequent registration contact involving the first device credentials: determining whether a user account is already paired with a client device that previously provided the first device credentials to the registration server; and when it is determined that the user account is already paired with the client device that previously provided the first device credentials, unpairing the user account from the client device that previously provided the first credentials. determining whether a user account is already paired with a client device that previously provided the first device credentials to the registration server; and when it is determined that the user account is already paired with the client device that previously provided the first device credentials, unpairing the user account from the client device that previously provided the first credentials.