diff --git a/velconnect-svelte-npm/package.json b/velconnect-svelte-npm/package.json
index ad50620..4fd10b3 100644
--- a/velconnect-svelte-npm/package.json
+++ b/velconnect-svelte-npm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@velaboratory/velconnect-svelte",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "Use VEL-Connect with a Svelte dashboard",
   "main": "src/index.js",
   "files": [
diff --git a/velconnect/main.go b/velconnect/main.go
index 486d84e..d95aa8d 100644
--- a/velconnect/main.go
+++ b/velconnect/main.go
@@ -199,6 +199,59 @@ func main() {
 			apis.ActivityLogger(app),
 		)
 
+		// TODO
+		// e.Router.POST("/pair", func(c echo.Context) error {
+
+		// removes a device from users that own it, and removes its owners
+		// this has no auth protection - maybe there could be a "device secret", that lets devices change themselves securely
+		e.Router.POST("/unpair", func(c echo.Context) error {
+			// we need to:
+			// - remove the device from the list of devices on the user account
+			// - remove the owner from the device
+			// - remove the device datablock from the device
+			// - add a new device datablock to the device
+			//
+			// Inputs:
+			// - device_id
+			// - user_id
+
+			requestData := apis.RequestData(c)
+			deviceId := requestData.Data["device_id"].(string)
+			userId := requestData.Data["user_id"].(string)
+			deviceRecord, deviceErr := app.Dao().FindRecordById("Device", deviceId)
+			userRecord, userErr := app.Dao().FindRecordById("Users", userId)
+			if deviceErr != nil {
+				return apis.NewNotFoundError("The device does not exist.", deviceErr)
+			}
+			if userErr != nil {
+				return apis.NewNotFoundError("The user does not exist.", userErr)
+			}
+			// remove the device from the owner's list of devices
+			userDevicesList := userRecord.GetStringSlice("devices")
+			removeCurrentDevice := func(s string) bool { return s != deviceId }
+			filteredUserDevicesList := filter(userDevicesList, removeCurrentDevice)
+			userRecord.Set("devices", filteredUserDevicesList)
+
+			// modify the device
+			deviceRecord.Set("owner", nil)
+
+			// create new device data
+			collection, err := app.Dao().FindCollectionByNameOrId("DataBlock")
+			if err != nil {
+				log.Fatalln("Couldn't create datablock")
+				return err
+			}
+			deviceDataRecord := models.NewRecord(collection)
+			deviceDataRecord.RefreshId()
+			deviceRecord.Set("data", deviceDataRecord.Id)
+			deviceDataRecord.Set("category", "device")
+			deviceDataRecord.Set("data", "{}")
+
+			return c.JSON(http.StatusOK, deviceRecord)
+		},
+			apis.ActivityLogger(app),
+		)
+
 		return nil
 	})
 
@@ -231,3 +284,12 @@ func mergeDataBlock(requestData *models.RequestData, record *models.Record) {
 		record.Set("data", existingDataMap)
 	}
 }
+
+func filter(ss []string, test func(string) bool) (ret []string) {
+	for _, s := range ss {
+		if test(s) {
+			ret = append(ret, s)
+		}
+	}
+	return
+}
diff --git a/velconnect/migrations/1699037643_updated_Users.go b/velconnect/migrations/1699037643_updated_Users.go
new file mode 100644
index 0000000..f8e4414
--- /dev/null
+++ b/velconnect/migrations/1699037643_updated_Users.go
@@ -0,0 +1,57 @@
+package migrations
+
+import (
+	"encoding/json"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/daos"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+func init() {
+	m.Register(func(db dbx.Builder) error {
+		dao := daos.New(db);
+
+		collection, err := dao.FindCollectionByNameOrId("_pb_users_auth_")
+		if err != nil {
+			return err
+		}
+
+		options := map[string]any{}
+		json.Unmarshal([]byte(`{
+			"allowEmailAuth": true,
+			"allowOAuth2Auth": true,
+			"allowUsernameAuth": true,
+			"exceptEmailDomains": null,
+			"manageRule": null,
+			"minPasswordLength": 6,
+			"onlyEmailDomains": null,
+			"requireEmail": false
+		}`), &options)
+		collection.SetOptions(options)
+
+		return dao.SaveCollection(collection)
+	}, func(db dbx.Builder) error {
+		dao := daos.New(db);
+
+		collection, err := dao.FindCollectionByNameOrId("_pb_users_auth_")
+		if err != nil {
+			return err
+		}
+
+		options := map[string]any{}
+		json.Unmarshal([]byte(`{
+			"allowEmailAuth": true,
+			"allowOAuth2Auth": true,
+			"allowUsernameAuth": true,
+			"exceptEmailDomains": null,
+			"manageRule": null,
+			"minPasswordLength": 8,
+			"onlyEmailDomains": null,
+			"requireEmail": false
+		}`), &options)
+		collection.SetOptions(options)
+
+		return dao.SaveCollection(collection)
+	})
+}