diff --git a/src/config.cc b/src/config.cc
index f0ec963..18e50b5 100644
--- a/src/config.cc
+++ b/src/config.cc
@@ -42,7 +42,7 @@
 const char kRobotAccount[] = "robot_account";
 const char kLastConfiguredSsid[] = "last_configured_ssid";
 const char kSecret[] = "secret";
-const char kLocalAuthInfoChanged[] = "local_auth_info_changed";
+const char kRootClientTokenOwner[] = "root_client_token_owner";
 
 }  // namespace config_keys
 
@@ -72,8 +72,18 @@
   return result;
 }
 
+const EnumToStringMap<RootClientTokenOwner>::Map kRootClientTokenOwnerMap[] = {
+    {RootClientTokenOwner::kNone, "none"},
+    {RootClientTokenOwner::kClient, "client"},
+    {RootClientTokenOwner::kCloud, "cloud"},
+};
+
 }  // namespace
 
+template <>
+LIBWEAVE_EXPORT EnumToStringMap<RootClientTokenOwner>::EnumToStringMap()
+    : EnumToStringMap(kRootClientTokenOwnerMap) {}
+
 Config::Config(provider::ConfigStore* config_store)
     : settings_{CreateDefaultSettings()}, config_store_{config_store} {
 }
@@ -121,7 +131,7 @@
   CHECK(settings_.robot_account.empty());
   CHECK(settings_.last_configured_ssid.empty());
   CHECK(settings_.secret.empty());
-  CHECK(settings_.local_auth_info_changed);
+  CHECK(settings_.root_client_token_owner == RootClientTokenOwner::kNone);
 
   change.LoadState();
 }
@@ -214,8 +224,11 @@
   if (dict->GetString(config_keys::kSecret, &tmp) && Base64Decode(tmp, &secret))
     set_secret(secret);
 
-  if (dict->GetBoolean(config_keys::kLocalAuthInfoChanged, &tmp_bool))
-    set_local_auth_info_changed(tmp_bool);
+  RootClientTokenOwner token_owner{RootClientTokenOwner::kNone};
+  if (dict->GetString(config_keys::kRootClientTokenOwner, &tmp) &&
+      StringToEnum(tmp, &token_owner)) {
+    set_root_client_token_owner(token_owner);
+  }
 }
 
 void Config::Save() {
@@ -237,8 +250,8 @@
   dict.SetString(config_keys::kLastConfiguredSsid,
                  settings_.last_configured_ssid);
   dict.SetString(config_keys::kSecret, Base64Encode(settings_.secret));
-  dict.SetBoolean(config_keys::kLocalAuthInfoChanged,
-                  settings_.local_auth_info_changed);
+  dict.SetString(config_keys::kRootClientTokenOwner,
+                 EnumToString(settings_.root_client_token_owner));
   dict.SetString(config_keys::kName, settings_.name);
   dict.SetString(config_keys::kDescription, settings_.description);
   dict.SetString(config_keys::kLocation, settings_.location);
diff --git a/src/config.h b/src/config.h
index fc2568f..0c7ea5f 100644
--- a/src/config.h
+++ b/src/config.h
@@ -14,12 +14,18 @@
 #include <weave/error.h>
 #include <weave/provider/config_store.h>
 
-#include "src/privet/security_delegate.h"
+#include "src/privet/privet_types.h"
 
 namespace weave {
 
 class StorageInterface;
 
+enum class RootClientTokenOwner {
+  kNone,
+  kClient,
+  kCloud,
+};
+
 // Handles reading buffet config and state files.
 class Config final {
  public:
@@ -28,7 +34,7 @@
     std::string robot_account;
     std::string last_configured_ssid;
     std::vector<uint8_t> secret;
-    bool local_auth_info_changed{true};
+    RootClientTokenOwner root_client_token_owner{RootClientTokenOwner::kNone};
   };
 
   using OnChangedCallback = base::Callback<void(const weave::Settings&)>;
@@ -92,8 +98,9 @@
     void set_secret(const std::vector<uint8_t>& secret) {
       settings_->secret = secret;
     }
-    void set_local_auth_info_changed(bool local_auth_info_changed) {
-      settings_->local_auth_info_changed = local_auth_info_changed;
+    void set_root_client_token_owner(
+        RootClientTokenOwner root_client_token_owner) {
+      settings_->root_client_token_owner = root_client_token_owner;
     }
 
     void Commit();
diff --git a/src/config_unittest.cc b/src/config_unittest.cc
index 8c99131..1491d7b 100644
--- a/src/config_unittest.cc
+++ b/src/config_unittest.cc
@@ -77,7 +77,7 @@
   EXPECT_EQ("", GetSettings().robot_account);
   EXPECT_EQ("", GetSettings().last_configured_ssid);
   EXPECT_EQ(std::vector<uint8_t>(), GetSettings().secret);
-  EXPECT_TRUE(GetSettings().local_auth_info_changed);
+  EXPECT_EQ(RootClientTokenOwner::kNone, GetSettings().root_client_token_owner);
 }
 
 TEST_F(ConfigTest, LoadStateV0) {
@@ -117,7 +117,7 @@
     "device_id": "state_device_id",
     "last_configured_ssid": "state_last_configured_ssid",
     "local_anonymous_access_role": "user",
-    "local_auth_info_changed": false,
+    "root_client_token_owner": "client",
     "local_discovery_enabled": false,
     "local_pairing_enabled": false,
     "location": "state_location",
@@ -161,7 +161,8 @@
   EXPECT_EQ("state_robot_account", GetSettings().robot_account);
   EXPECT_EQ("state_last_configured_ssid", GetSettings().last_configured_ssid);
   EXPECT_EQ("c3RhdGVfc2VjcmV0", Base64Encode(GetSettings().secret));
-  EXPECT_FALSE(GetSettings().local_auth_info_changed);
+  EXPECT_EQ(RootClientTokenOwner::kClient,
+            GetSettings().root_client_token_owner);
 }
 
 TEST_F(ConfigTest, Setters) {
@@ -231,8 +232,9 @@
   change.set_secret(secret);
   EXPECT_EQ(secret, GetSettings().secret);
 
-  change.set_local_auth_info_changed(false);
-  EXPECT_FALSE(GetSettings().local_auth_info_changed);
+  change.set_root_client_token_owner(RootClientTokenOwner::kCloud);
+  EXPECT_EQ(RootClientTokenOwner::kCloud,
+            GetSettings().root_client_token_owner);
 
   EXPECT_CALL(*this, OnConfigChanged(_)).Times(1);
 
@@ -248,7 +250,7 @@
           'device_id': 'set_device_id',
           'last_configured_ssid': 'set_last_configured_ssid',
           'local_anonymous_access_role': 'user',
-          'local_auth_info_changed': false,
+          'root_client_token_owner': 'cloud',
           'local_discovery_enabled': true,
           'local_pairing_enabled': true,
           'location': 'set_location',