diff --git a/app/sql.js b/app/sql.js
index 0be90dbd6..97418c087 100644
--- a/app/sql.js
+++ b/app/sql.js
@@ -940,7 +940,8 @@ async function updateToLokiSchemaVersion2(currentVersion, instance) {
       primaryDevicePubKey VARCHAR(255),
       secondaryDevicePubKey VARCHAR(255),
       isGranted BOOLEAN,
-      json TEXT
+      json TEXT,
+      UNIQUE(primaryDevicePubKey, secondaryDevicePubKey)
     );`
   );
 
diff --git a/libloki/api.js b/libloki/api.js
index 5e632ca49..0dcd53e68 100644
--- a/libloki/api.js
+++ b/libloki/api.js
@@ -1,4 +1,4 @@
-/* global window, textsecure, log, Whisper, dcodeIO, StringView */
+/* global window, textsecure, log, Whisper, dcodeIO, StringView, ConversationController */
 
 // eslint-disable-next-line func-names
 (function() {
@@ -31,7 +31,7 @@
     let p2pPort = null;
     let type;
 
-    if (!window.localLokiServer.isListening()) {
+    if (!window.localLokiServer || !window.localLokiServer.isListening()) {
       type = textsecure.protobuf.LokiAddressMessage.Type.HOST_UNREACHABLE;
     } else {
       // clearnet change: getMyLokiAddress -> getMyClearIP
@@ -166,7 +166,7 @@
     );
     // Send profile name to secondary device
     const ourNumber = textsecure.storage.user.getNumber();
-    const conversation = await window.ConversationController.getOrCreateAndWait(
+    const conversation = await ConversationController.getOrCreateAndWait(
       ourNumber,
       'private'
     );
diff --git a/libloki/storage.js b/libloki/storage.js
index 733d3df92..16b3efdec 100644
--- a/libloki/storage.js
+++ b/libloki/storage.js
@@ -1,4 +1,5 @@
-/* global window, libsignal, textsecure, Signal, lokiFileServerAPI */
+/* global window, libsignal, textsecure, Signal,
+   lokiFileServerAPI, ConversationController */
 
 // eslint-disable-next-line func-names
 (function() {
@@ -115,29 +116,36 @@
 
   // fetches device mappings from server.
   async function getPrimaryDeviceMapping(pubKey) {
-    const deviceMapping = await lokiFileServerAPI.getUserDeviceMapping(pubKey);
-    if (!deviceMapping) {
+    if (typeof lokiFileServerAPI === 'undefined') {
+      // If this is not defined then we are initiating a pairing
       return [];
     }
-    let { authorisations } = deviceMapping;
-    if (!authorisations) {
+    const deviceMapping = await lokiFileServerAPI.getUserDeviceMapping(pubKey);
+    if (!deviceMapping) {
       return [];
     }
-    if (deviceMapping.isPrimary !== '1') {
-      const { primaryDevicePubKey } = authorisations.find(
-        authorisation => authorisation.secondaryDevicePubKey === pubKey
-      );
+    let authorisations = deviceMapping.authorisations || [];
+    if (deviceMapping.isPrimary === '0') {
+      const { primaryDevicePubKey } =
+        authorisations.find(
+          authorisation => authorisation.secondaryDevicePubKey === pubKey
+        ) || {};
       if (primaryDevicePubKey) {
         // do NOT call getprimaryDeviceMapping recursively
         // in case both devices are out of sync and think they are
         // each others' secondary pubkey.
-        ({ authorisations } = await lokiFileServerAPI.getUserDeviceMapping(
+        const primaryDeviceMapping = await lokiFileServerAPI.getUserDeviceMapping(
           primaryDevicePubKey
-        ));
+        );
+        if (!primaryDeviceMapping) {
+          return [];
+        }
+        ({ authorisations } = primaryDeviceMapping);
       }
     }
     return authorisations || [];
   }
+
   // if the device is a secondary device,
   // fetch the device mappings for its primary device
   async function saveAllPairingAuthorisationsFor(pubKey) {
@@ -161,6 +169,10 @@
 
   // Transforms signatures from base64 to ArrayBuffer!
   async function getGrantAuthorisationForSecondaryPubKey(secondaryPubKey) {
+    const conversation = ConversationController.get(secondaryPubKey);
+    if (!conversation || conversation.isPublic() || conversation.isRss()) {
+      return null;
+    }
     const authorisation = await window.Signal.Data.getGrantAuthorisationForSecondaryPubKey(
       secondaryPubKey
     );