diff --git a/CMakeLists.txt b/CMakeLists.txt
index d402ccf04..03356a79d 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -190,6 +190,8 @@ target_sources(${QUOTIENT_LIB_NAME} PUBLIC FILE_SET HEADERS BASE_DIRS .
         Quotient/events/keyverificationevent.h
         Quotient/keyimport.h
         Quotient/qt_connection_util.h
+        Quotient/pendingconnection.h
+        Quotient/config.h
     PRIVATE
         Quotient/function_traits.cpp
         Quotient/networkaccessmanager.cpp
@@ -247,6 +249,8 @@ target_sources(${QUOTIENT_LIB_NAME} PUBLIC FILE_SET HEADERS BASE_DIRS .
         Quotient/e2ee/cryptoutils.cpp
         Quotient/e2ee/sssshandler.cpp
         Quotient/keyimport.cpp
+        Quotient/pendingconnection.cpp
+        Quotient/config.cpp
         libquotientemojis.qrc
 )
 
diff --git a/Quotient/accountregistry.cpp b/Quotient/accountregistry.cpp
index 40e5e7f46..240a54ca4 100644
--- a/Quotient/accountregistry.cpp
+++ b/Quotient/accountregistry.cpp
@@ -4,9 +4,11 @@
 
 #include "accountregistry.h"
 
+#include "pendingconnection.h"
 #include "connection.h"
 #include "logging_categories_p.h"
 #include "settings.h"
+#include "config.h"
 
 #include <QtCore/QCoreApplication>
 
@@ -89,69 +91,24 @@ Connection* AccountRegistry::get(const QString& userId) const
     return nullptr;
 }
 
-void AccountRegistry::invokeLogin()
+QStringList AccountRegistry::accountsLoading() const
 {
-    const auto accounts = SettingsGroup("Accounts"_ls).childGroups();
-    for (const auto& accountId : accounts) {
-        AccountSettings account { accountId };
-
-        if (account.homeserver().isEmpty())
-            continue;
-
-        d->m_accountsLoading += accountId;
-        emit accountsLoadingChanged();
-
-        qCDebug(MAIN) << "Reading access token from keychain for" << accountId;
-        auto accessTokenLoadingJob =
-            new QKeychain::ReadPasswordJob(qAppName(), this);
-        accessTokenLoadingJob->setKey(accountId);
-        connect(accessTokenLoadingJob, &QKeychain::Job::finished, this,
-                [accountId, this, accessTokenLoadingJob]() {
-                    if (accessTokenLoadingJob->error()
-                        != QKeychain::Error::NoError) {
-                        emit keychainError(accessTokenLoadingJob->error());
-                        d->m_accountsLoading.removeAll(accountId);
-                        emit accountsLoadingChanged();
-                        return;
-                    }
-
-                    AccountSettings account { accountId };
-                    auto connection = new Connection(account.homeserver());
-                    connect(connection, &Connection::connected, this,
-                            [connection, this, accountId] {
-                                connection->loadState();
-                                connection->setLazyLoading(true);
-
-                                connection->syncLoop();
-
-                                d->m_accountsLoading.removeAll(accountId);
-                                emit accountsLoadingChanged();
-                            });
-                    connect(connection, &Connection::loginError, this,
-                            [this, connection, accountId](const QString& error,
-                                               const QString& details) {
-                                emit loginError(connection, error, details);
-
-                                d->m_accountsLoading.removeAll(accountId);
-                                emit accountsLoadingChanged();
-                            });
-                    connect(connection, &Connection::resolveError, this,
-                            [this, connection, accountId](const QString& error) {
-                                emit resolveError(connection, error);
-
-                                d->m_accountsLoading.removeAll(accountId);
-                                emit accountsLoadingChanged();
-                            });
-                    connection->assumeIdentity(
-                        account.userId(),
-                        QString::fromUtf8(accessTokenLoadingJob->binaryData()));
-                    add(connection);
-                });
-        accessTokenLoadingJob->start();
-    }
+    return d->m_accountsLoading;
 }
 
-QStringList AccountRegistry::accountsLoading() const
+PendingConnection* AccountRegistry::loginWithPassword(const QString& matrixId, const QString& password, const ConnectionSettings& settings)
 {
-    return d->m_accountsLoading;
+    return PendingConnection::loginWithPassword(matrixId, password, settings, this);
+}
+
+PendingConnection* AccountRegistry::restoreConnection(const QString& matrixId, const ConnectionSettings& settings)
+{
+    return PendingConnection::restoreConnection(matrixId, settings, this);
+}
+
+QStringList AccountRegistry::availableConnections() const
+{
+    //TODO change accounts -> QuotientAccounts?
+    return Config::instance()->childGroups("Accounts"_ls, Config::Data);
+    //TODO check whether we have plausible data?
 }
diff --git a/Quotient/accountregistry.h b/Quotient/accountregistry.h
index 048eedc84..93c8897b1 100644
--- a/Quotient/accountregistry.h
+++ b/Quotient/accountregistry.h
@@ -12,6 +12,19 @@
 
 namespace Quotient {
 class Connection;
+class PendingConnection;
+
+struct ConnectionSettings
+{
+    // Only relevant when logging in or registering. This can be left empty to get a random device id
+    QString deviceId;
+    // Only relevant when logging in or registering. Otherwise leave empty
+    QString initialDeviceName;
+    bool useEncryption = true;
+    bool cacheState = true;
+    bool rememberConnection = true;
+    bool sync = true;
+};
 
 class QUOTIENT_API AccountRegistry : public QAbstractListModel,
                                      private QVector<Connection*> {
@@ -63,9 +76,15 @@ class QUOTIENT_API AccountRegistry : public QAbstractListModel,
 
     QStringList accountsLoading() const;
 
-    [[deprecated("This may leak Connection objects when failing and cannot be"
-                 "fixed without breaking the API; do not use it")]] //
-    void invokeLogin();
+    Quotient::PendingConnection *loginWithPassword(const QString& matrixId, const QString& password, const ConnectionSettings& settings = {});
+    Quotient::PendingConnection *restoreConnection(const QString& matrixId, const ConnectionSettings& settings = {});
+
+    Quotient::PendingConnection *mockConnection(const QString& userId) {
+        //TODO
+        return nullptr;
+    }
+
+    QStringList availableConnections() const;
 
 Q_SIGNALS:
     void accountCountChanged();
diff --git a/Quotient/config.cpp b/Quotient/config.cpp
new file mode 100644
index 000000000..1e2653340
--- /dev/null
+++ b/Quotient/config.cpp
@@ -0,0 +1,55 @@
+// SPDX-FileCopyrightText: 2024 Tobias Fella <tobias.fella@kde.org>
+// SPDX-License-Identifier: LGPL-2.0-or-later
+
+#include "config.h"
+
+#include <QSettings>
+
+class QSettingsConfig : public Config
+{
+    //TODO this backend currently ignores the type and stores everything in the same backend
+    QString load(const QString& group, const QString& childGroup, const QString& key, Type type) override
+    {
+        settings.beginGroup(group);
+        settings.beginGroup(childGroup);
+        auto value = settings.value(key).toString();
+        settings.endGroup();
+        settings.endGroup();
+        return value;
+    }
+
+    void store(const QString& group, const QString& childGroup, const QString& key, const QString& value, Type type) override
+    {
+        settings.beginGroup(group);
+        settings.beginGroup(childGroup);
+        settings.setValue(key, value);
+        settings.endGroup();
+        settings.endGroup();
+        settings.sync();
+    }
+
+    QStringList childGroups(const QString& group, Type type) override
+    {
+        settings.beginGroup(group);
+        auto childGroups = settings.childGroups();
+        settings.endGroup();
+        return childGroups;
+    }
+
+    QSettings settings;
+};
+
+Config* Config::s_instance = nullptr;
+
+Config* Config::instance()
+{
+    if (!s_instance) {
+        s_instance = new QSettingsConfig();
+    }
+    return s_instance;
+}
+
+void Config::setInstance(Config* config)
+{
+    s_instance = config;
+}
diff --git a/Quotient/config.h b/Quotient/config.h
new file mode 100644
index 000000000..0ecc1a508
--- /dev/null
+++ b/Quotient/config.h
@@ -0,0 +1,25 @@
+// SPDX-FileCopyrightText: 2024 Tobias Fella <tobias.fella@kde.org>
+// SPDX-License-Identifier: LGPL-2.0-or-later
+
+#pragma once
+
+#include <QString>
+
+class Config
+{
+public:
+    enum Type
+    {
+        Settings,
+        Data,
+    };
+    virtual QString load(const QString& group, const QString& childGroup, const QString& key, Type type) = 0;
+    virtual void store(const QString& group, const QString& childGroup, const QString& key, const QString& value, Type type) = 0;
+    virtual QStringList childGroups(const QString& group, Type type) = 0;
+
+    static Config* instance();
+    static void setInstance(Config* config);
+
+private:
+    static Config* s_instance;
+};
diff --git a/Quotient/connection.cpp b/Quotient/connection.cpp
index 77b112c80..1187c8e29 100644
--- a/Quotient/connection.cpp
+++ b/Quotient/connection.cpp
@@ -23,8 +23,6 @@
 #include "csapi/room_send.h"
 #include "csapi/to_device.h"
 #include "csapi/voip.h"
-#include "csapi/wellknown.h"
-#include "csapi/whoami.h"
 
 #include "e2ee/qolminboundsession.h"
 
@@ -65,16 +63,19 @@ HashT remove_if(HashT& hashMap, Pred pred)
     return removals;
 }
 
-Connection::Connection(const QUrl& server, QObject* parent)
+Connection::Connection(ConnectionData* connectionData, QObject* parent)
     : QObject(parent)
-    , d(makeImpl<Private>(std::make_unique<ConnectionData>(server)))
+    , d(makeImpl<Private>(connectionData))
 {
     //connect(qApp, &QCoreApplication::aboutToQuit, this, &Connection::saveOlmAccount);
     d->q = this; // All d initialization should occur before this line
-    setObjectName(server.toString());
-}
+    setObjectName(d->data->baseUrl().toString());
+    connect(qApp, &QCoreApplication::aboutToQuit, this, &Connection::saveState);
 
-Connection::Connection(QObject* parent) : Connection({}, parent) {}
+    loadVersions();
+    loadCapabilities();
+    user()->load(); // Load the local user's profile
+}
 
 Connection::~Connection()
 {
@@ -82,60 +83,6 @@ Connection::~Connection()
     stopSync();
 }
 
-void Connection::resolveServer(const QString& mxid)
-{
-    d->resolverJob.abandon(); // The previous network request is no more relevant
-
-    auto maybeBaseUrl = QUrl::fromUserInput(serverPart(mxid));
-    maybeBaseUrl.setScheme("https"_ls); // Instead of the Qt-default "http"
-    if (maybeBaseUrl.isEmpty() || !maybeBaseUrl.isValid()) {
-        emit resolveError(tr("%1 is not a valid homeserver address")
-                              .arg(maybeBaseUrl.toString()));
-        return;
-    }
-
-    qCDebug(MAIN) << "Finding the server" << maybeBaseUrl.host();
-
-    const auto& oldBaseUrl = d->data->baseUrl();
-    d->data->setBaseUrl(maybeBaseUrl); // Temporarily set it for this one call
-    d->resolverJob = callApi<GetWellknownJob>();
-    // Make sure baseUrl is restored in any case, even an abandon, and before any further processing
-    connect(d->resolverJob.get(), &BaseJob::finished, this,
-            [this, oldBaseUrl] { d->data->setBaseUrl(oldBaseUrl); });
-    d->resolverJob.onResult(this, [this, maybeBaseUrl]() mutable {
-        if (d->resolverJob->error() != BaseJob::NotFound) {
-            if (!d->resolverJob->status().good()) {
-                qCWarning(MAIN) << "Fetching .well-known file failed, FAIL_PROMPT";
-                emit resolveError(tr("Failed resolving the homeserver"));
-                return;
-            }
-            const QUrl baseUrl{ d->resolverJob->data().homeserver.baseUrl };
-            if (baseUrl.isEmpty()) {
-                qCWarning(MAIN) << "base_url not provided, FAIL_PROMPT";
-                emit resolveError(tr("The homeserver base URL is not provided"));
-                return;
-            }
-            if (!baseUrl.isValid()) {
-                qCWarning(MAIN) << "base_url invalid, FAIL_ERROR";
-                emit resolveError(tr("The homeserver base URL is invalid"));
-                return;
-            }
-            qCInfo(MAIN) << ".well-known URL for" << maybeBaseUrl.host() << "is"
-                         << baseUrl.toString();
-            setHomeserver(baseUrl);
-        } else {
-            qCInfo(MAIN) << "No .well-known file, using" << maybeBaseUrl << "for base URL";
-            setHomeserver(maybeBaseUrl);
-        }
-        Q_ASSERT(d->loginFlowsJob != nullptr); // Ensured by setHomeserver()
-    });
-}
-
-inline UserIdentifier makeUserIdentifier(const QString& id)
-{
-    return { QStringLiteral("m.id.user"), { { QStringLiteral("user"), id } } };
-}
-
 inline UserIdentifier make3rdPartyIdentifier(const QString& medium,
                                              const QString& address)
 {
@@ -144,55 +91,6 @@ inline UserIdentifier make3rdPartyIdentifier(const QString& medium,
                { QStringLiteral("address"), address } } };
 }
 
-void Connection::loginWithPassword(const QString& userId,
-                                   const QString& password,
-                                   const QString& initialDeviceName,
-                                   const QString& deviceId)
-{
-    d->ensureHomeserver(userId, LoginFlows::Password).then([=, this] {
-        d->loginToServer(LoginFlows::Password.type, makeUserIdentifier(userId),
-                         password, /*token*/ QString(), deviceId, initialDeviceName);
-    });
-}
-
-SsoSession* Connection::prepareForSso(const QString& initialDeviceName,
-                                      const QString& deviceId)
-{
-    return new SsoSession(this, initialDeviceName, deviceId);
-}
-
-void Connection::loginWithToken(const QString& loginToken,
-                                const QString& initialDeviceName,
-                                const QString& deviceId)
-{
-    Q_ASSERT(d->data->baseUrl().isValid() && d->loginFlows.contains(LoginFlows::Token));
-    d->loginToServer(LoginFlows::Token.type, std::nullopt /*user is encoded in loginToken*/,
-                     QString() /*password*/, loginToken, deviceId, initialDeviceName);
-}
-
-void Connection::assumeIdentity(const QString& mxId, const QString& accessToken)
-{
-    d->ensureHomeserver(mxId).then([this, mxId, accessToken] {
-        d->data->setToken(accessToken.toLatin1());
-        callApi<GetTokenOwnerJob>().onResult([this, mxId](const GetTokenOwnerJob* job) {
-            switch (job->error()) {
-            case BaseJob::Success:
-                if (mxId != job->userId())
-                    qCWarning(MAIN).nospace()
-                        << "The access_token owner (" << job->userId()
-                        << ") is different from passed MXID (" << mxId << ")!";
-                d->data->setDeviceId(job->deviceId());
-                d->completeSetup(job->userId());
-                return;
-            case BaseJob::NetworkError:
-                emit networkError(job->errorString(), job->rawDataSample(), job->maxRetries(), -1);
-                return;
-            default: emit loginError(job->errorString(), job->rawDataSample());
-            }
-        });
-    });
-}
-
 JobHandle<GetVersionsJob> Connection::loadVersions()
 {
     return callApi<GetVersionsJob>(BackgroundRequest).then([this](GetVersionsJob::Response r) {
@@ -236,24 +134,6 @@ bool Connection::capabilitiesReady() const
 
 QStringList Connection::supportedMatrixSpecVersions() const { return d->apiVersions.versions; }
 
-void Connection::Private::saveAccessTokenToKeychain() const
-{
-    qCDebug(MAIN) << "Saving access token to keychain for" << q->userId();
-    auto job = new QKeychain::WritePasswordJob(qAppName());
-    job->setKey(q->userId());
-    job->setBinaryData(data->accessToken());
-    job->start();
-    QObject::connect(job, &QKeychain::Job::finished, q, [job] {
-        if (job->error() == QKeychain::Error::NoError)
-            return;
-        qWarning(MAIN).noquote()
-            << "Could not save access token to the keychain:"
-            << qUtf8Printable(job->errorString());
-        // TODO: emit a signal
-    });
-
-}
-
 void Connection::Private::dropAccessToken()
 {
     // TODO: emit a signal on important (i.e. access denied) keychain errors
@@ -286,90 +166,6 @@ void Connection::Private::dropAccessToken()
     data->setToken({});
 }
 
-template <typename... LoginArgTs>
-void Connection::Private::loginToServer(LoginArgTs&&... loginArgs)
-{
-    auto loginJob =
-            q->callApi<LoginJob>(std::forward<LoginArgTs>(loginArgs)...);
-    connect(loginJob, &BaseJob::success, q, [this, loginJob] {
-        data->setToken(loginJob->accessToken().toLatin1());
-        data->setDeviceId(loginJob->deviceId());
-        completeSetup(loginJob->userId());
-        saveAccessTokenToKeychain();
-        if (encryptionData)
-            encryptionData->database.clear();
-    });
-    connect(loginJob, &BaseJob::failure, q, [this, loginJob] {
-        emit q->loginError(loginJob->errorString(), loginJob->rawDataSample());
-    });
-}
-
-void Connection::Private::completeSetup(const QString& mxId, bool mock)
-{
-    data->setUserId(mxId);
-    q->setObjectName(data->userId() % u'/' % data->deviceId());
-    qCDebug(MAIN) << "Using server" << data->baseUrl().toDisplayString()
-                  << "by user" << data->userId()
-                  << "from device" << data->deviceId();
-    connect(qApp, &QCoreApplication::aboutToQuit, q, &Connection::saveState);
-
-    if (!mock) {
-        q->loadVersions();
-        q->loadCapabilities();
-        q->user()->load(); // Load the local user's profile
-    }
-
-    if (useEncryption) {
-        if (auto&& maybeEncryptionData =
-                _impl::ConnectionEncryptionData::setup(q, mock)) {
-            encryptionData = std::move(*maybeEncryptionData);
-        } else {
-            useEncryption = false;
-            emit q->encryptionChanged(false);
-        }
-    } else
-        qCInfo(E2EE) << "End-to-end encryption (E2EE) support is off for"
-                     << q->objectName();
-
-    emit q->stateChanged();
-    emit q->connected();
-}
-
-QFuture<void> Connection::Private::ensureHomeserver(const QString& userId,
-                                                    const std::optional<LoginFlow>& flow)
-{
-    QPromise<void> promise;
-    auto result = promise.future();
-    promise.start();
-    if (data->baseUrl().isValid() && (!flow || loginFlows.contains(*flow))) {
-        q->setObjectName(userId % u"(?)");
-        promise.finish(); // Perfect, we're already good to go
-    } else if (userId.startsWith(u'@') && userId.indexOf(u':') != -1) {
-        // Try to ascertain the homeserver URL and flows
-        q->setObjectName(userId % u"(?)");
-        q->resolveServer(userId);
-        if (flow)
-            QtFuture::connect(q, &Connection::loginFlowsChanged)
-                .then([this, flow, p = std::move(promise)]() mutable {
-                    if (loginFlows.contains(*flow))
-                        p.finish();
-                    else // Leave the promise unfinished and emit the error
-                        emit q->loginError(tr("Unsupported login flow"),
-                                           tr("The homeserver at %1 does not support"
-                                              " the login flow '%2'")
-                                               .arg(data->baseUrl().toDisplayString(), flow->type));
-                });
-        else // Any flow is fine, just wait until the homeserver is resolved
-            return QFuture<void>(QtFuture::connect(q, &Connection::homeserverChanged));
-    } else // Leave the promise unfinished and emit the error
-        emit q->resolveError(tr("Please provide the fully-qualified user id"
-                                " (such as @user:example.org) so that the"
-                                " homeserver could be resolved; the current"
-                                " homeserver URL(%1) is not good")
-                                 .arg(data->baseUrl().toDisplayString()));
-    return result;
-}
-
 QFuture<void> Connection::logout()
 {
     // If there's an ongoing sync job, stop it (this also suspends sync loop)
@@ -442,7 +238,7 @@ void Connection::sync(int timeout)
         if (job->error() == BaseJob::Unauthorised) {
             qCWarning(SYNCJOB)
                 << "Sync job failed with Unauthorised - login expired?";
-            emit loginError(job->errorString(), job->rawDataSample());
+            //TODO emit loginError(job->errorString(), job->rawDataSample());
         } else
             emit syncError(job->errorString(), job->rawDataSample());
     });
@@ -944,23 +740,6 @@ QUrl Connection::homeserver() const { return d->data->baseUrl(); }
 
 QString Connection::domain() const { return userId().section(u':', 1); }
 
-bool Connection::isUsable() const { return !loginFlows().isEmpty(); }
-
-QVector<GetLoginFlowsJob::LoginFlow> Connection::loginFlows() const
-{
-    return d->loginFlows;
-}
-
-bool Connection::supportsPasswordAuth() const
-{
-    return d->loginFlows.contains(LoginFlows::Password);
-}
-
-bool Connection::supportsSso() const
-{
-    return d->loginFlows.contains(LoginFlows::SSO);
-}
-
 Room* Connection::room(const QString& roomId, JoinStates states) const
 {
     Room* room = d->roomMap.value({ roomId, false }, nullptr);
@@ -1306,7 +1085,7 @@ QStringList Connection::userIds() const { return d->userMap.keys(); }
 
 const ConnectionData* Connection::connectionData() const
 {
-    return d->data.get();
+    return d->data;
 }
 
 HomeserverData Connection::homeserverData() const { return d->data->homeserverData(); }
@@ -1412,27 +1191,6 @@ QString Connection::generateTxnId() const
     return d->data->generateTxnId();
 }
 
-QFuture<QList<LoginFlow>> Connection::setHomeserver(const QUrl& baseUrl)
-{
-    d->resolverJob.abandon();
-    d->loginFlowsJob.abandon();
-    d->loginFlows.clear();
-
-    if (homeserver() != baseUrl) {
-        d->data->setBaseUrl(baseUrl);
-        emit homeserverChanged(homeserver());
-    }
-
-    d->loginFlowsJob = callApi<GetLoginFlowsJob>(BackgroundRequest).onResult([this] {
-        if (d->loginFlowsJob->status().good())
-            d->loginFlows = d->loginFlowsJob->flows();
-        else
-            d->loginFlows.clear();
-        emit loginFlowsChanged();
-    });
-    return d->loginFlowsJob.responseFuture();
-}
-
 void Connection::saveRoomState(Room* r) const
 {
     Q_ASSERT(r);
@@ -1586,7 +1344,7 @@ BaseJob* Connection::run(BaseJob* job, RunningPolicy runningPolicy)
     // garbage-collected if made by or returned to QML/JavaScript.
     job->setParent(this);
     connect(job, &BaseJob::failure, this, &Connection::requestFailed);
-    job->initiate(d->data.get(), runningPolicy & BackgroundRequest);
+    job->initiate(d->data, runningPolicy & BackgroundRequest);
     return job;
 }
 
@@ -1914,15 +1672,6 @@ void Connection::reloadDevices()
     }
 }
 
-Connection* Connection::makeMockConnection(const QString& mxId,
-                                           bool enableEncryption)
-{
-    auto* c = new Connection;
-    c->enableEncryption(enableEncryption);
-    c->d->completeSetup(mxId, true);
-    return c;
-}
-
 QStringList Connection::accountDataEventTypes() const
 {
     QStringList events;
diff --git a/Quotient/connection.h b/Quotient/connection.h
index b3301fc1d..d297a4dca 100644
--- a/Quotient/connection.h
+++ b/Quotient/connection.h
@@ -57,27 +57,6 @@ struct EncryptedFileMetadata;
 class QOlmAccount;
 class QOlmInboundGroupSession;
 
-using LoginFlow = GetLoginFlowsJob::LoginFlow;
-
-//! Predefined login flows
-namespace LoginFlows {
-    inline const LoginFlow Password { "m.login.password"_ls };
-    inline const LoginFlow SSO { "m.login.sso"_ls };
-    inline const LoginFlow Token { "m.login.token"_ls };
-}
-
-// To simplify comparisons of LoginFlows
-
-inline bool operator==(const LoginFlow& lhs, const LoginFlow& rhs)
-{
-    return lhs.type == rhs.type;
-}
-
-inline bool operator!=(const LoginFlow& lhs, const LoginFlow& rhs)
-{
-    return !(lhs == rhs);
-}
-
 class Connection;
 
 using room_factory_t =
@@ -121,11 +100,11 @@ class QUOTIENT_API Connection : public QObject {
     Q_PROPERTY(QByteArray accessToken READ accessToken NOTIFY stateChanged)
     Q_PROPERTY(bool isLoggedIn READ isLoggedIn NOTIFY stateChanged STORED false)
     Q_PROPERTY(QString defaultRoomVersion READ defaultRoomVersion NOTIFY capabilitiesLoaded)
-    Q_PROPERTY(QUrl homeserver READ homeserver WRITE setHomeserver NOTIFY homeserverChanged)
-    Q_PROPERTY(QVector<GetLoginFlowsJob::LoginFlow> loginFlows READ loginFlows NOTIFY loginFlowsChanged)
-    Q_PROPERTY(bool isUsable READ isUsable NOTIFY loginFlowsChanged STORED false)
-    Q_PROPERTY(bool supportsSso READ supportsSso NOTIFY loginFlowsChanged STORED false)
-    Q_PROPERTY(bool supportsPasswordAuth READ supportsPasswordAuth NOTIFY loginFlowsChanged STORED false)
+    Q_PROPERTY(QUrl homeserver READ homeserver CONSTANT)
+    //Q_PROPERTY(QVector<GetLoginFlowsJob::LoginFlow> loginFlows READ loginFlows NOTIFY loginFlowsChanged)
+    //Q_PROPERTY(bool isUsable READ isUsable NOTIFY loginFlowsChanged STORED false)
+    // Q_PROPERTY(bool supportsSso READ supportsSso NOTIFY loginFlowsChanged STORED false)
+    // Q_PROPERTY(bool supportsPasswordAuth READ supportsPasswordAuth NOTIFY loginFlowsChanged STORED false)
     Q_PROPERTY(bool cacheState READ cacheState WRITE setCacheState NOTIFY cacheStateChanged)
     Q_PROPERTY(bool lazyLoading READ lazyLoading WRITE setLazyLoading NOTIFY lazyLoadingChanged)
     Q_PROPERTY(bool canChangePassword READ canChangePassword NOTIFY capabilitiesLoaded)
@@ -141,8 +120,6 @@ class QUOTIENT_API Connection : public QObject {
         UnpublishRoom
     }; // FIXME: Should go inside CreateRoomJob
 
-    explicit Connection(QObject* parent = nullptr);
-    explicit Connection(const QUrl& server, QObject* parent = nullptr);
     ~Connection() override;
 
     //! \brief Get all rooms known within this Connection
@@ -293,13 +270,13 @@ class QUOTIENT_API Connection : public QObject {
     //! Get the domain name used for ids/aliases on the server
     QString domain() const;
     //! Check if the homeserver is known to be reachable and working
-    bool isUsable() const;
+    // TODO remove bool isUsable() const;
     //! Get the list of supported login flows
-    QVector<GetLoginFlowsJob::LoginFlow> loginFlows() const;
-    //! Check whether the current homeserver supports password auth
-    bool supportsPasswordAuth() const;
-    //! Check whether the current homeserver supports SSO
-    bool supportsSso() const;
+    // QVector<GetLoginFlowsJob::LoginFlow> loginFlows() const;
+    // //! Check whether the current homeserver supports password auth
+    // bool supportsPasswordAuth() const;
+    // //! Check whether the current homeserver supports SSO
+    // bool supportsSso() const;
     //! Find a room by its id and a mask of applicable states
     Q_INVOKABLE Quotient::Room* room(
         const QString& roomId,
@@ -536,20 +513,6 @@ class QUOTIENT_API Connection : public QObject {
         return JobT::makeRequestUrl(homeserverData(), std::forward<JobArgTs>(jobArgs)...);
     }
 
-    //! \brief Start a local HTTP server and generate a single sign-on URL
-    //!
-    //! This call does the preparatory steps to carry out single sign-on
-    //! sequence
-    //! \sa https://matrix.org/docs/guides/sso-for-client-developers
-    //! \return A proxy object holding two URLs: one for SSO on the chosen
-    //!         homeserver and another for the local callback address. Normally
-    //!         you won't need the callback URL unless you proxy the response
-    //!         with a custom UI. You do not need to delete the SsoSession
-    //!         object; the Connection that issued it will dispose of it once
-    //!         the login sequence completes (with any outcome).
-    Q_INVOKABLE SsoSession* prepareForSso(const QString& initialDeviceName,
-                                          const QString& deviceId = {});
-
     //! \brief Generate a new transaction id
     //!
     //! Transaction id's are unique within a single Connection object
@@ -593,25 +556,6 @@ class QUOTIENT_API Connection : public QObject {
         setUserFactory(defaultUserFactory<T>);
     }
 
-    //! \brief Determine and set the homeserver from MXID
-    //!
-    //! This attempts to resolve the homeserver by requesting
-    //! .well-known/matrix/client record from the server taken from the MXID
-    //! serverpart. If there is no record found, the serverpart itself is
-    //! attempted as the homeserver base URL; if the record is there but
-    //! is malformed (e.g., the homeserver base URL cannot be found in it)
-    //! resolveError() is emitted and further processing stops. Otherwise,
-    //! setHomeserver is called, preparing the Connection object for the login
-    //! attempt.
-    //! \param mxid user Matrix ID, such as @someone:example.org
-    //! \sa setHomeserver, homeserverChanged, loginFlowsChanged, resolveError
-    Q_INVOKABLE void resolveServer(const QString& mxid);
-
-    //! \brief Set the homeserver base URL and retrieve its login flows
-    //!
-    //! \sa LoginFlowsJob, loginFlows, loginFlowsChanged, homeserverChanged
-    Q_INVOKABLE QFuture<QList<LoginFlow> > setHomeserver(const QUrl& baseUrl);
-
     //! \brief Get a future to a direct chat with the user
     Q_INVOKABLE QFuture<Room*> getDirectChat(const QString& otherUserId);
 
@@ -632,16 +576,16 @@ class QUOTIENT_API Connection : public QObject {
                                               const QStringList& serverNames = {});
 
 public Q_SLOTS:
-    //! \brief Log in using a username and password pair
-    //!
-    //! Before logging in, this method checks if the homeserver is valid and
-    //! supports the password login flow. If the homeserver is invalid but
-    //! a full user MXID is provided, this method calls resolveServer() using
-    //! this MXID.
-    //! \sa resolveServer, resolveError, loginError
-    void loginWithPassword(const QString& userId, const QString& password,
-                           const QString& initialDeviceName,
-                           const QString& deviceId = {});
+    // //! \brief Log in using a username and password pair
+    // //!
+    // //! Before logging in, this method checks if the homeserver is valid and
+    // //! supports the password login flow. If the homeserver is invalid but
+    // //! a full user MXID is provided, this method calls resolveServer() using
+    // //! this MXID.
+    // //! \sa resolveServer, resolveError, loginError
+    // void loginWithPassword(const QString& userId, const QString& password,
+    //                        const QString& initialDeviceName,
+    //                        const QString& deviceId = {});
 
     //! \brief Log in using a login token
     //!
@@ -650,16 +594,16 @@ public Q_SLOTS:
     //! resolve the server from the user name because the full user MXID is
     //! encoded in the login token. Callers should ensure the homeserver
     //! sanity in advance.
-    void loginWithToken(const QString& loginToken,
-                        const QString& initialDeviceName,
-                        const QString& deviceId = {});
+    // void loginWithToken(const QString& loginToken,
+    //                     const QString& initialDeviceName,
+    //                     const QString& deviceId = {});
 
     //! \brief Use an existing access token to connect to the homeserver
     //!
     //! Similar to loginWithPassword(), this method checks that the homeserver
     //! URL is valid and tries to resolve it from the MXID in case it is not.
     //! \since 0.7.2
-    void assumeIdentity(const QString& mxId, const QString& accessToken);
+    // void assumeIdentity(const QString& mxId, const QString& accessToken);
 
     //! \brief Request supported spec versions from the homeserver
     //!
@@ -751,22 +695,9 @@ public Q_SLOTS:
     Q_INVOKABLE void startSelfVerification();
     void encryptionUpdate(const Room* room, const QStringList& invitedIds = {});
 
-    static Connection* makeMockConnection(const QString& mxId,
-                                          bool enableEncryption = true);
-
 Q_SIGNALS:
-    //! \brief Initial server resolution has failed
-    //!
-    //! This signal is emitted when resolveServer() did not manage to resolve
-    //! the homeserver using its .well-known/client record or otherwise.
-    //! \sa resolveServer
-    void resolveError(QString error);
-
-    void homeserverChanged(QUrl baseUrl);
-    void loginFlowsChanged();
     void capabilitiesLoaded();
 
-    void connected();
     void loggedOut();
 
     //! \brief Login data or state have changed
@@ -775,7 +706,6 @@ public Q_SLOTS:
     //! accessToken - these properties normally only change at
     //! a successful login and logout and are constant at other times.
     void stateChanged();
-    void loginError(QString message, QString details);
 
     //! \brief A network request (job) started by callApi() has failed
     //! \param request the pointer to the failed job
@@ -957,9 +887,13 @@ protected Q_SLOTS:
     void syncLoopIteration();
 
 private:
+    friend class PendingConnection;
+
     class Private;
     ImplPtr<Private> d;
 
+    Connection(ConnectionData* connectionData, QObject* parent = nullptr);
+
     static room_factory_t _roomFactory;
     static user_factory_t _userFactory;
 };
diff --git a/Quotient/connection_p.h b/Quotient/connection_p.h
index f72da4088..f9881f6b2 100644
--- a/Quotient/connection_p.h
+++ b/Quotient/connection_p.h
@@ -15,7 +15,6 @@
 #include "csapi/capabilities.h"
 #include "csapi/logout.h"
 #include "csapi/versions.h"
-#include "csapi/wellknown.h"
 
 #include <QtCore/QCoreApplication>
 
@@ -23,12 +22,12 @@ namespace Quotient {
 
 class Q_DECL_HIDDEN Quotient::Connection::Private {
 public:
-    explicit Private(std::unique_ptr<ConnectionData>&& connection)
-        : data(std::move(connection))
+    explicit Private(ConnectionData* data)
+        : data(data)
     {}
 
     Connection* q = nullptr;
-    std::unique_ptr<ConnectionData> data;
+    ConnectionData* data = nullptr;
     // A complex key below is a pair of room name and whether its
     // state is Invited. The spec mandates to keep Invited room state
     // separately; specifically, we should keep objects for Invite and
@@ -55,17 +54,12 @@ class Q_DECL_HIDDEN Quotient::Connection::Private {
     GetVersionsJob::Response apiVersions{};
     GetCapabilitiesJob::Capabilities capabilities{};
 
-    QVector<GetLoginFlowsJob::LoginFlow> loginFlows;
-
     static inline bool encryptionDefault = false;
     bool useEncryption = encryptionDefault;
     static inline bool directChatEncryptionDefault = false;
     bool encryptDirectChats = directChatEncryptionDefault;
     std::unique_ptr<_impl::ConnectionEncryptionData> encryptionData;
 
-    JobHandle<GetWellknownJob> resolverJob = nullptr;
-    JobHandle<GetLoginFlowsJob> loginFlowsJob = nullptr;
-
     SyncJob* syncJob = nullptr;
     JobHandle<LogoutJob> logoutJob = nullptr;
 
@@ -76,24 +70,6 @@ class Q_DECL_HIDDEN Quotient::Connection::Private {
         != "json"_ls;
     bool lazyLoading = false;
 
-    //! \brief Check the homeserver and resolve it if needed, before connecting
-    //!
-    //! A single entry for functions that need to check whether the homeserver is valid before
-    //! running. Emits resolveError() if the homeserver URL is not valid and cannot be resolved
-    //! from \p userId; loginError() if the homeserver is accessible but doesn't support \p flow.
-    //!
-    //! \param userId    fully-qualified MXID to resolve HS from
-    //! \param flow      optionally, a login flow that should be supported;
-    //!                  `std::nullopt`, if there are no login flow requirements
-    //! \return a future that becomes ready once the homeserver is available; if the homeserver
-    //!         URL is incorrect or other problems occur, the future is never resolved and is
-    //!         deleted (along with associated continuations) as soon as the problem becomes
-    //!         apparent
-    //! \sa resolveServer, resolveError, loginError
-    QFuture<void> ensureHomeserver(const QString& userId, const std::optional<LoginFlow>& flow = {});
-    template <typename... LoginArgTs>
-    void loginToServer(LoginArgTs&&... loginArgs);
-    void completeSetup(const QString &mxId, bool mock = false);
     void removeRoom(const QString& roomId);
 
     void consumeRoomData(SyncDataList&& roomDataList, bool fromCache);
@@ -121,7 +97,6 @@ class Q_DECL_HIDDEN Quotient::Connection::Private {
         return q->stateCacheDir().filePath("state.json"_ls);
     }
 
-    void saveAccessTokenToKeychain() const;
     void dropAccessToken();
 };
 } // namespace Quotient
diff --git a/Quotient/pendingconnection.cpp b/Quotient/pendingconnection.cpp
new file mode 100644
index 000000000..09ab5c619
--- /dev/null
+++ b/Quotient/pendingconnection.cpp
@@ -0,0 +1,429 @@
+// SPDX-FileCopyrightText: 2024 Tobias Fella <tobias.fella@kde.org>
+// SPDX-License-Identifier: LGPL-2.0-or-later
+
+#include "pendingconnection.h"
+
+#include "connectiondata.h"
+#include "connectionencryptiondata_p.h"
+#include "logging_categories_p.h"
+#include "csapi/login.h"
+#include "csapi/wellknown.h"
+#include "jobs/jobhandle.h"
+#include "connection.h"
+#include "connection_p.h"
+#include "config.h"
+
+#include <QtCore/QCoreApplication>
+#include <QtCore/QPointer>
+
+using namespace Quotient;
+using namespace Qt::Literals::StringLiterals;
+
+using LoginFlow = GetLoginFlowsJob::LoginFlow;
+
+//! Predefined login flows
+namespace LoginFlows {
+    inline const LoginFlow Password { "m.login.password"_ls };
+    inline const LoginFlow SSO { "m.login.sso"_ls };
+    inline const LoginFlow Token { "m.login.token"_ls };
+}
+
+// To simplify comparisons of LoginFlows
+
+inline bool operator==(const LoginFlow& lhs, const LoginFlow& rhs)
+{
+    return lhs.type == rhs.type;
+}
+
+inline bool operator!=(const LoginFlow& lhs, const LoginFlow& rhs)
+{
+    return !(lhs == rhs);
+}
+
+
+class Quotient::PendingConnection::Private
+{
+public:
+    Private(PendingConnection *qq)
+        : q(qq)
+        , connectionData(new ConnectionData({}))
+        {}
+
+    //! \brief Check the homeserver and resolve it if needed, before connecting
+    //!
+    //! A single entry for functions that need to check whether the homeserver is valid before
+    //! running. Emits resolveError() if the homeserver URL is not valid and cannot be resolved
+    //! from \p userId; loginError() if the homeserver is accessible but doesn't support \p flow.
+    //!
+    //! \param userId    fully-qualified MXID to resolve HS from
+    //! \param flow      optionally, a login flow that should be supported;
+    //!                  `std::nullopt`, if there are no login flow requirements
+    //! \return a future that becomes ready once the homeserver is available; if the homeserver
+    //!         URL is incorrect or other problems occur, the future is never resolved and is
+    //!         deleted (along with associated continuations) as soon as the problem becomes
+    //!         apparent
+    //! \sa resolveServer, resolveError, loginError
+    QFuture<void> ensureHomeserver(const QString& userId, const std::optional<LoginFlow>& flow = {});
+
+    //! \brief Determine and set the homeserver from MXID
+    //!
+    //! This attempts to resolve the homeserver by requesting
+    //! .well-known/matrix/client record from the server taken from the MXID
+    //! serverpart. If there is no record found, the serverpart itself is
+    //! attempted as the homeserver base URL; if the record is there but
+    //! is malformed (e.g., the homeserver base URL cannot be found in it)
+    //! resolveError() is emitted and further processing stops. Otherwise,
+    //! setHomeserver is called, preparing the Connection object for the login
+    //! attempt.
+    //! \param mxid user Matrix ID, such as @someone:example.org
+    //! \sa setHomeserver, homeserverChanged, loginFlowsChanged, resolveError
+    void resolveServer(const QString& mxid);
+
+    template <typename... LoginArgTs>
+    void loginToServer(LoginArgTs&&... loginArgs);
+
+    //! \brief Set the homeserver base URL and retrieve its login flows
+    //!
+    //! \sa LoginFlowsJob, loginFlows, loginFlowsChanged, homeserverChanged
+    Q_INVOKABLE QFuture<QList<LoginFlow> > setHomeserver(const QUrl& baseUrl);
+
+
+    BaseJob* run(BaseJob* job, RunningPolicy runningPolicy);
+
+
+    //! \brief Start a job of a given type with specified arguments and policy
+    //!
+    //! This is a universal method to create and start a job of a type passed
+    //! as a template parameter. The policy allows to fine-tune the way
+    //! the job is executed - as of this writing it means a choice
+    //! between "foreground" and "background".
+    //!
+    //! \param runningPolicy controls how the job is executed
+    //! \param jobArgs arguments to the job constructor
+    //!
+    //! \sa BaseJob::isBackground. QNetworkRequest::BackgroundRequestAttribute
+    template <typename JobT, typename... JobArgTs>
+    JobHandle<JobT> callApi(RunningPolicy runningPolicy, JobArgTs&&... jobArgs)
+    {
+        auto job = new JobT(std::forward<JobArgTs>(jobArgs)...);
+        run(job, runningPolicy);
+        return job;
+    }
+
+    //! \brief Start a job of a specified type with specified arguments
+    //!
+    //! This is an overload that runs the job with "foreground" policy.
+    template <typename JobT, typename... JobArgTs>
+    JobHandle<JobT> callApi(JobArgTs&&... jobArgs)
+    {
+        return callApi<JobT>(ForegroundRequest, std::forward<JobArgTs>(jobArgs)...);
+    }
+
+    QKeychain::ReadPasswordJob *loadAccessTokenFromKeyChain()
+    {
+        qDebug() << "Reading access token from the keychain for" << connectionData->userId();
+        auto job = new QKeychain::ReadPasswordJob(qAppName(), q);
+        job->setKey(connectionData->userId());
+
+        // connect(job, &QKeychain::Job::finished, q, [this, job]() {
+        //     if (job->error() == QKeychain::Error::NoError) {
+        //         return;
+        //     }
+        //
+        //     // switch (job->error()) {
+        //     // case QKeychain::EntryNotFound:
+        //     //     Q_EMIT errorOccured(i18n("Access token wasn't found"), i18n("Maybe it was deleted?"));
+        //     //     break;
+        //     // case QKeychain::AccessDeniedByUser:
+        //     // case QKeychain::AccessDenied:
+        //     //     Q_EMIT errorOccured(i18n("Access to keychain was denied."), i18n("Please allow NeoChat to read the access token"));
+        //     //     break;
+        //     // case QKeychain::NoBackendAvailable:
+        //     //     Q_EMIT errorOccured(i18n("No keychain available."), i18n("Please install a keychain, e.g. KWallet or GNOME keyring on Linux"));
+        //     //     break;
+        //     // case QKeychain::OtherError:
+        //     //     Q_EMIT errorOccured(i18n("Unable to read access token"), job->errorString());
+        //     //     break;
+        //     // default:
+        //     //     break;
+        //     // }
+        // });
+        job->start();
+
+        return job;
+    }
+
+
+    void completeSetup(const QString& mxId, bool mock);
+    void saveAccessTokenToKeychain() const;
+    void setupConnection();
+
+    QVector<GetLoginFlowsJob::LoginFlow> loginFlows;
+    JobHandle<GetWellknownJob> resolverJob = nullptr;
+    JobHandle<GetLoginFlowsJob> loginFlowsJob = nullptr;
+
+    PendingConnection* q;
+
+    ConnectionData* connectionData = nullptr; //TODO this should be a unique_ptr
+    Connection* connection = nullptr;
+    AccountRegistry* accountRegistry;
+    bool mock = false;
+    ConnectionSettings settings;
+};
+
+inline UserIdentifier makeUserIdentifier(const QString& id)
+{
+    return { QStringLiteral("m.id.user"), { { QStringLiteral("user"), id } } };
+}
+
+PendingConnection::PendingConnection(const QString& userId, const QString& password, const Quotient::ConnectionSettings& settings, Quotient::AccountRegistry* accountRegistry)
+    : d(new Private(this))
+{
+    d->settings = settings;
+    d->accountRegistry = accountRegistry;
+    d->ensureHomeserver(userId, LoginFlows::Password).then([=, this] {
+        d->loginToServer(LoginFlows::Password.type, makeUserIdentifier(userId),
+                         password, /*token*/ QString(), settings.deviceId, settings.initialDeviceName);
+    });
+}
+
+PendingConnection::PendingConnection(const QString& userId, const Quotient::ConnectionSettings& settings, Quotient::AccountRegistry* accountRegistry)
+    : d(new Private(this))
+{
+    d->accountRegistry = accountRegistry;
+    auto config = Config::instance();
+
+    d->connectionData->setUserId(userId);
+    d->connectionData->setBaseUrl(QUrl(config->load(u"Accounts"_s, userId, u"Homeserver"_s, Config::Data)));
+    d->connectionData->setDeviceId(config->load(u"Accounts"_s, userId, u"DeviceId"_s, Config::Data));
+
+    auto job = d->loadAccessTokenFromKeyChain();
+    connect(job, &QKeychain::ReadPasswordJob::finished, this, [this, job](){
+        d->connectionData->setToken(job->binaryData());
+        d->connection = new Connection(d->connectionData);
+
+        d->setupConnection();
+    });
+}
+
+PendingConnection *PendingConnection::loginWithPassword(const QString& userId, const QString& password, const Quotient::ConnectionSettings& settings, Quotient::AccountRegistry* accountRegistry)
+{
+    return new PendingConnection(userId, password, settings, accountRegistry);
+}
+
+PendingConnection *PendingConnection::restoreConnection(const QString& userId, const Quotient::ConnectionSettings& settings, Quotient::AccountRegistry* accountRegistry)
+{
+    return new PendingConnection(userId, settings, accountRegistry);
+}
+
+QFuture<void> PendingConnection::Private::ensureHomeserver(const QString& userId,
+                                                    const std::optional<LoginFlow>& flow)
+{
+    QPromise<void> promise;
+    auto result = promise.future();
+    promise.start();
+    if (connectionData->baseUrl().isValid()/* TODO && (!flow || loginFlows.contains(*flow))*/) {
+        q->setObjectName(userId % u"(?)");
+        promise.finish(); // Perfect, we're already good to go
+    } else if (userId.startsWith(u'@') && userId.indexOf(u':') != -1) {
+        // Try to ascertain the homeserver URL and flows
+        q->setObjectName(userId % u"(?)");
+        resolveServer(userId);
+        if (flow)
+            QtFuture::connect(q, &PendingConnection::loginFlowsChanged)
+                .then([this, flow, p = std::move(promise)]() mutable {
+                    // TODO if (loginFlows.contains(*flow))
+                        p.finish();
+                    // else // Leave the promise unfinished and emit the error
+                    //     emit q->loginError(tr("Unsupported login flow"),
+                    //                        tr("The homeserver at %1 does not support"
+                    //                           " the login flow '%2'")
+                    //                            .arg(connectionData->baseUrl().toDisplayString(), flow->type));
+                });
+        else // Any flow is fine, just wait until the homeserver is resolved
+            return QFuture<void>(QtFuture::connect(q, &PendingConnection::homeserverChanged));
+    } else // Leave the promise unfinished and emit the error
+        emit q->resolveError(tr("Please provide the fully-qualified user id"
+                                " (such as @user:example.org) so that the"
+                                " homeserver could be resolved; the current"
+                                " homeserver URL(%1) is not good")
+                                 .arg(connectionData->baseUrl().toDisplayString()));
+    return result;
+}
+
+
+template <typename... LoginArgTs>
+void PendingConnection::Private::loginToServer(LoginArgTs&&... loginArgs)
+{
+    auto loginJob =
+            callApi<LoginJob>(std::forward<LoginArgTs>(loginArgs)...);
+    connect(loginJob, &BaseJob::success, q, [this, loginJob] {
+        connectionData->setToken(loginJob->accessToken().toLatin1());
+        connectionData->setDeviceId(loginJob->deviceId());
+        completeSetup(loginJob->userId(), false);
+        saveAccessTokenToKeychain();
+        // if (encryptionData) probably not needed?
+        //     encryptionData->database.clear();
+    });
+    connect(loginJob, &BaseJob::failure, q, [this, loginJob] {
+        emit q->loginError(loginJob->errorString(), loginJob->rawDataSample());
+    });
+}
+
+void PendingConnection::Private::resolveServer(const QString& mxid)
+{
+    resolverJob.abandon(); // The previous network request is no more relevant
+
+    auto maybeBaseUrl = QUrl::fromUserInput(serverPart(mxid));
+    maybeBaseUrl.setScheme("https"_ls); // Instead of the Qt-default "http"
+    if (maybeBaseUrl.isEmpty() || !maybeBaseUrl.isValid()) {
+        emit q->resolveError(tr("%1 is not a valid homeserver address")
+                              .arg(maybeBaseUrl.toString()));
+        return;
+    }
+
+    qCDebug(MAIN) << "Finding the server" << maybeBaseUrl.host();
+
+    const auto& oldBaseUrl = connectionData->baseUrl();
+    connectionData->setBaseUrl(maybeBaseUrl); // Temporarily set it for this one call
+    resolverJob = callApi<GetWellknownJob>();
+    // Make sure baseUrl is restored in any case, even an abandon, and before any further processing
+    connect(resolverJob.get(), &BaseJob::finished, q,
+            [this, oldBaseUrl] { connectionData->setBaseUrl(oldBaseUrl); });
+    resolverJob.onResult(q, [this, maybeBaseUrl]() mutable {
+        if (resolverJob->error() != BaseJob::NotFound) {
+            if (!resolverJob->status().good()) {
+                qCWarning(MAIN) << "Fetching .well-known file failed, FAIL_PROMPT";
+                emit q->resolveError(tr("Failed resolving the homeserver"));
+                return;
+            }
+            const QUrl baseUrl{ resolverJob->data().homeserver.baseUrl };
+            if (baseUrl.isEmpty()) {
+                qCWarning(MAIN) << "base_url not provided, FAIL_PROMPT";
+                emit q->resolveError(tr("The homeserver base URL is not provided"));
+                return;
+            }
+            if (!baseUrl.isValid()) {
+                qCWarning(MAIN) << "base_url invalid, FAIL_ERROR";
+                emit q->resolveError(tr("The homeserver base URL is invalid"));
+                return;
+            }
+            qCInfo(MAIN) << ".well-known URL for" << maybeBaseUrl.host() << "is"
+                         << baseUrl.toString();
+            setHomeserver(baseUrl);
+        } else {
+            qCInfo(MAIN) << "No .well-known file, using" << maybeBaseUrl << "for base URL";
+            setHomeserver(maybeBaseUrl);
+        }
+        Q_ASSERT(loginFlowsJob != nullptr); // Ensured by setHomeserver()
+    });
+}
+
+QFuture<QList<LoginFlow>> PendingConnection::Private::setHomeserver(const QUrl& baseUrl)
+{
+    resolverJob.abandon();
+    loginFlowsJob.abandon();
+    loginFlows.clear();
+
+    if (connectionData->baseUrl() != baseUrl) {
+        connectionData->setBaseUrl(baseUrl);
+        emit q->homeserverChanged(baseUrl);
+    }
+
+    loginFlowsJob = callApi<GetLoginFlowsJob>(BackgroundRequest).onResult([this] {
+        if (loginFlowsJob->status().good())
+            loginFlows = loginFlowsJob->flows();
+        else
+            loginFlows.clear();
+        emit q->loginFlowsChanged();
+    });
+    return loginFlowsJob.responseFuture();
+}
+
+BaseJob* PendingConnection::Private::run(BaseJob* job, RunningPolicy runningPolicy)
+{
+    // Reparent to protect from #397, #398 and to prevent BaseJob* from being
+    // garbage-collected if made by or returned to QML/JavaScript.
+    job->setParent(q);
+    //TODO maybe connect(job, &BaseJob::failure, this, &Connection::requestFailed);
+    job->initiate(connectionData, runningPolicy & BackgroundRequest);
+    return job;
+}
+
+
+void PendingConnection::Private::completeSetup(const QString& mxId, bool mock)
+{
+    connectionData->setUserId(mxId);
+    q->setObjectName(connectionData->userId() % u'/' % connectionData->deviceId());
+    qCDebug(MAIN) << "Using server" << connectionData->baseUrl().toDisplayString()
+                  << "by user" << connectionData->userId()
+                  << "from device" << connectionData->deviceId();
+
+    setupConnection();
+}
+
+PendingConnection::~PendingConnection() = default;
+
+void PendingConnection::Private::saveAccessTokenToKeychain() const
+{
+    qCDebug(MAIN) << "Saving access token to keychain for" << connectionData->userId();
+    auto job = new QKeychain::WritePasswordJob(qAppName());
+    job->setKey(connectionData->userId());
+    job->setBinaryData(connectionData->accessToken());
+    job->start();
+    QObject::connect(job, &QKeychain::Job::finished, q, [job] {
+        if (job->error() == QKeychain::Error::NoError)
+            return;
+        qWarning(MAIN).noquote()
+            << "Could not save access token to the keychain:"
+            << qUtf8Printable(job->errorString());
+        // TODO: emit a signal
+    });
+}
+
+QString PendingConnection::userId() const
+{
+    return d->connectionData->userId();
+}
+
+Connection* PendingConnection::connection() const
+{
+    return d->connection;
+}
+
+void PendingConnection::Private::setupConnection()
+{
+    connection = new Connection(connectionData);
+
+    if (settings.useEncryption) {
+        if (auto&& maybeEncryptionData = _impl::ConnectionEncryptionData::setup(connection, mock)) {
+            connection->d->encryptionData = std::move(*maybeEncryptionData);
+        } else {
+            //TODO d->connectionData->useEncryption = false;
+            //TODO emit q->encryptionChanged(false);
+        }
+    } else {
+        qCInfo(E2EE) << "End-to-end encryption (E2EE) support is off for"
+                     << q->objectName();
+
+    }
+
+
+    if (settings.cacheState) {
+        connection->loadState();
+        connect(connection, &Connection::syncDone, connection, &Connection::saveState);
+    }
+
+    if (settings.sync) {
+        connection->syncLoop();
+    }
+
+    if (settings.rememberConnection) {
+        auto config = Config::instance();
+        config->store(u"Accounts"_s, connection->userId(), u"DeviceId"_s, connection->deviceId(), Config::Data);
+        config->store(u"Accounts"_s, connection->userId(), u"Homeserver"_s, connection->homeserver().toString(), Config::Data);
+    }
+
+    emit q->ready();
+    accountRegistry->add(connection);
+}
diff --git a/Quotient/pendingconnection.h b/Quotient/pendingconnection.h
new file mode 100644
index 000000000..5a5918f32
--- /dev/null
+++ b/Quotient/pendingconnection.h
@@ -0,0 +1,51 @@
+// SPDX-FileCopyrightText: 2024 Tobias Fella <tobias.fella@kde.org>
+// SPDX-License-Identifier: LGPL-2.0-or-later
+
+#pragma once
+
+#include "accountregistry.h"
+
+#include <QObject>
+
+namespace Quotient
+{
+namespace _impl {
+class ConnectionEncryptionData;
+}
+
+class PendingConnection : public QObject
+{
+    Q_OBJECT
+
+public:
+    static PendingConnection *loginWithPassword(const QString& userId, const QString& password, const Quotient::ConnectionSettings& settings, Quotient::AccountRegistry* accountRegistry);
+    static PendingConnection *restoreConnection(const QString& userId, const Quotient::ConnectionSettings& settings, Quotient::AccountRegistry* accountRegistry);
+
+    ~PendingConnection();
+    Quotient::Connection* connection() const;
+
+Q_SIGNALS:
+    void loginFlowsChanged(); //TODO make private somehow?
+    void homeserverChanged(QUrl baseUrl);
+
+    //! \brief Initial server resolution has failed
+    //!
+    //! This signal is emitted when resolveServer() did not manage to resolve
+    //! the homeserver using its .well-known/client record or otherwise.
+    //! \sa resolveServer
+    void resolveError(QString error);
+    void loginError(QString message, QString details);
+    void ready();
+
+private:
+    friend class Quotient::_impl::ConnectionEncryptionData;
+    PendingConnection(const QString& userId, const QString& password, const Quotient::ConnectionSettings& settings, Quotient::AccountRegistry* accountRegistry);
+    PendingConnection(const QString& userId, const Quotient::ConnectionSettings& settings, Quotient::AccountRegistry* accountRegistry);
+
+    QString userId() const;
+
+    class Private;
+    std::unique_ptr<Private> d;
+};
+
+}
diff --git a/Quotient/ssosession.cpp b/Quotient/ssosession.cpp
index 3fb39829c..e22568d48 100644
--- a/Quotient/ssosession.cpp
+++ b/Quotient/ssosession.cpp
@@ -99,20 +99,23 @@ void SsoSession::Private::processCallback()
         return;
     }
     qCDebug(MAIN) << "Found the token in SSO callback, logging in";
-    connection->loginWithToken(query.queryItemValue(QueryItemName),
-                               initialDeviceName, deviceId);
-    connect(connection, &Connection::connected, socket, [this] {
-        const auto msg =
-            tr("The application '%1' has successfully logged in as a user %2 "
-               "with device id %3. This window can be closed. Thank you.\r\n")
-                .arg(QCoreApplication::applicationName(), connection->userId(),
-                     connection->deviceId());
-        sendHttpResponse("200 OK", msg.toHtmlEscaped().toUtf8());
-        socket->disconnectFromHost();
-    });
-    connect(connection, &Connection::loginError, socket, [this] {
-        onError("401 Unauthorised", tr("Login failed"));
-    });
+    // connection->loginWithToken(query.queryItemValue(QueryItemName),
+    //                            initialDeviceName, deviceId);
+    //TODO
+    // connect(connection, &Connection::connected, socket, [this] {
+    //     const auto msg =
+    //         tr("The application '%1' has successfully logged in as a user %2 "
+    //            "with device id %3. This window can be closed. Thank you.\r\n")
+    //             .arg(QCoreApplication::applicationName(), connection->userId(),
+    //                  connection->deviceId());
+    //     sendHttpResponse("200 OK", msg.toHtmlEscaped().toUtf8());
+    //     socket->disconnectFromHost();
+    // });
+
+    //TODO
+    // connect(connection, &Connection::loginError, socket, [this] {
+    //     onError("401 Unauthorised", tr("Login failed"));
+    // });
 }
 
 void SsoSession::Private::sendHttpResponse(const QByteArray& code,
@@ -134,6 +137,6 @@ void SsoSession::Private::onError(const QByteArray& code,
     sendHttpResponse(code, "<h3>" + errorMsg.toUtf8() + "</h3>");
     // [kitsune] Yeah, I know, dirty. Maybe the "right" way would be to have
     // an intermediate signal but that seems just a fight for purity.
-    emit connection->loginError(errorMsg, QString::fromUtf8(requestData));
+    //TODO emit connection->loginError(errorMsg, QString::fromUtf8(requestData));
     socket->disconnectFromHost();
 }
diff --git a/autotests/testcrosssigning.cpp b/autotests/testcrosssigning.cpp
index 0cd823636..3d9e88ebb 100644
--- a/autotests/testcrosssigning.cpp
+++ b/autotests/testcrosssigning.cpp
@@ -5,6 +5,9 @@
 
 #include <QTest>
 #include <Quotient/connection_p.h>
+#include <Quotient/accountregistry.h>
+#include <Quotient/pendingconnection.h>
+
 #include "testutils.h"
 
 using namespace Quotient;
@@ -27,7 +30,7 @@ private Q_SLOTS:
         jobMock.setResult(QJsonDocument::fromJson(data));
         auto mockKeys = collectResponse(&jobMock);
 
-        auto connection = Connection::makeMockConnection("@tobiasfella:kde.org"_ls, true);
+        auto connection = (new AccountRegistry())->mockConnection("@tobiasfella:kde.org"_ls)->connection();
         connection->d->encryptionData->handleQueryKeys(mockKeys);
 
         QVERIFY(!connection->isUserVerified("@tobiasfella:kde.org"_ls));
diff --git a/autotests/testcryptoutils.cpp b/autotests/testcryptoutils.cpp
index 36205d1a4..4a92b43f3 100644
--- a/autotests/testcryptoutils.cpp
+++ b/autotests/testcryptoutils.cpp
@@ -6,7 +6,8 @@
 #include <Quotient/database.h>
 #include <Quotient/e2ee/cryptoutils.h>
 #include <Quotient/e2ee/e2ee_common.h>
-
+#include <Quotient/accountregistry.h>
+#include <Quotient/pendingconnection.h>
 #include <Quotient/events/filesourceinfo.h>
 
 #include <QTest>
@@ -102,7 +103,7 @@ void TestCryptoUtils::testEncrypted()
 {
     QByteArray key(32, '\0');
     auto text = QByteArrayLiteral("This is a message");
-    auto connection = Connection::makeMockConnection("@foo:bar.com"_ls, true);
+    auto connection = (new AccountRegistry())->mockConnection("@foo:bar.com"_ls)->connection();
     connection->database()->storeEncrypted("testKey"_ls, text);
     auto decrypted = connection->database()->loadEncrypted("testKey"_ls);
     QCOMPARE(text, decrypted);
diff --git a/autotests/testkeyverification.cpp b/autotests/testkeyverification.cpp
index 4933f95ba..a03f94e33 100644
--- a/autotests/testkeyverification.cpp
+++ b/autotests/testkeyverification.cpp
@@ -9,6 +9,8 @@
 
 #include <Quotient/connection.h>
 #include <Quotient/e2ee/qolmaccount.h>
+#include <Quotient/accountregistry.h>
+#include <Quotient/pendingconnection.h>
 
 using namespace Quotient;
 
@@ -21,7 +23,8 @@ private Q_SLOTS:
     {
         auto userId = QStringLiteral("@bob:localhost");
         auto deviceId = QStringLiteral("DEFABC");
-        auto connection = Connection::makeMockConnection("@carl:localhost"_ls);
+
+        auto connection = (new AccountRegistry())->mockConnection("@carl:localhost"_ls)->connection();
         const auto transactionId = "other_transaction_id"_ls;
         auto session = connection->startKeyVerificationSession("@alice:localhost"_ls, "ABCDEF"_ls);
         session->sendRequest();
@@ -40,7 +43,7 @@ private Q_SLOTS:
         auto userId = QStringLiteral("@bob:localhost");
         auto deviceId = QStringLiteral("DEFABC");
         const auto transactionId = "trans123action123id"_ls;
-        auto connection = Connection::makeMockConnection("@carl:localhost"_ls);
+        auto connection = (new AccountRegistry())->mockConnection("@carl:localhost"_ls)->connection();
         auto session = new KeyVerificationSession(userId, KeyVerificationRequestEvent(transactionId, deviceId, {SasV1Method}, QDateTime::currentDateTime()), connection, false);
         QVERIFY(session->state() == KeyVerificationSession::INCOMING);
         session->sendReady();
diff --git a/autotests/testutils.cpp b/autotests/testutils.cpp
index d6ab30546..a9a4dc952 100644
--- a/autotests/testutils.cpp
+++ b/autotests/testutils.cpp
@@ -26,22 +26,22 @@ std::shared_ptr<Quotient::Connection> Quotient::createTestConnection(
     QObject::connect(nam, &QNetworkAccessManager::sslErrors, nam,
                      [](QNetworkReply* reply) { reply->ignoreSslErrors(); });
 
-    auto c = std::make_shared<Connection>();
-    c->enableEncryption(true);
-    const QString userId{ u'@' % localUserName % u':' % homeserverAddr };
-    c->setHomeserver(QUrl(u"https://" % homeserverAddr));
-    if (!waitForSignal(c, &Connection::loginFlowsChanged)
-        || !c->supportsPasswordAuth()) {
-        qCritical().noquote() << "Can't use password login at" << homeserverAddr
-                              << "- check that the homeserver is running";
-        return nullptr;
-    }
-    c->loginWithPassword(localUserName, secret, deviceName);
-    if (!waitForSignal(c, &Connection::connected)) {
-        qCritical().noquote()
-            << "Could not achieve the logged in state for" << userId
-            << "- check the credentials in the test code and at the homeserver";
-        return nullptr;
-    }
-    return c;
+    // auto c = std::make_shared<Connection>();
+    // c->enableEncryption(true);
+    // const QString userId{ u'@' % localUserName % u':' % homeserverAddr };
+    // // c->setHomeserver(QUrl(u"https://" % homeserverAddr));
+    // // if (!waitForSignal(c, &Connection::loginFlowsChanged)
+    // //     || !c->supportsPasswordAuth()) {
+    // //     qCritical().noquote() << "Can't use password login at" << homeserverAddr
+    // //                           << "- check that the homeserver is running";
+    // //     return nullptr;
+    // // }
+    // //c->loginWithPassword(localUserName, secret, deviceName);
+    // if (!waitForSignal(c, &Connection::connected)) {
+    //     qCritical().noquote()
+    //         << "Could not achieve the logged in state for" << userId
+    //         << "- check the credentials in the test code and at the homeserver";
+    //     return nullptr;
+    // }
+    return nullptr;//c;
 }
diff --git a/quotest/quotest.cpp b/quotest/quotest.cpp
index facee88a4..775699ec9 100644
--- a/quotest/quotest.cpp
+++ b/quotest/quotest.cpp
@@ -35,7 +35,7 @@ class TestSuite;
 
 class TestManager : public QCoreApplication {
 public:
-    TestManager(int& argc, char** argv);
+    //TestManager(int& argc, char** argv);
 
 private:
     void setupAndRun();
@@ -180,15 +180,15 @@ void TestSuite::finishTest(const TestToken& token, bool condition,
 
     emit finishedItem(item, condition);
 }
-
+/*
 TestManager::TestManager(int& argc, char** argv)
     : QCoreApplication(argc, argv), c(new Connection(this))
 {
     Q_ASSERT(argc >= 5);
     // NOLINTBEGIN(cppcoreguidelines-pro-bounds-pointer-arithmetic)
     clog << "Connecting to Matrix as " << argv[1] << endl;
-    c->loginWithPassword(QString::fromUtf8(argv[1]), QString::fromUtf8(argv[2]),
-                         QString::fromUtf8(argv[3]));
+    // c->loginWithPassword(QString::fromUtf8(argv[1]), QString::fromUtf8(argv[2]),
+    //                      QString::fromUtf8(argv[3]));
     targetRoomName = QString::fromUtf8(argv[4]);
     clog << "Test room name: " << argv[4] << '\n';
     if (argc > 5) {
@@ -199,20 +199,20 @@ TestManager::TestManager(int& argc, char** argv)
     // NOLINTEND(cppcoreguidelines-pro-bounds-pointer-arithmetic)
 
     connect(c, &Connection::connected, this, &TestManager::setupAndRun);
-    connect(c, &Connection::resolveError, this,
-        [](const QString& error) {
-            clog << "Failed to resolve the server: " << error.toStdString() << endl;
-            QCoreApplication::exit(-2);
-        },
-        Qt::QueuedConnection);
-    connect(c, &Connection::loginError, this,
-        [this](const QString& message, const QString& details) {
-            clog << "Failed to login to " << c->homeserver().toDisplayString().toStdString() << ": "
-                 << message.toStdString() << "\nDetails:\n"
-                 << details.toStdString() << endl;
-            QCoreApplication::exit(-2);
-        },
-        Qt::QueuedConnection);
+    // connect(c, &Connection::resolveError, this,
+    //     [](const QString& error) {
+    //         clog << "Failed to resolve the server: " << error.toStdString() << endl;
+    //         QCoreApplication::exit(-2);
+    //     },
+    //     Qt::QueuedConnection);
+    // connect(c, &Connection::loginError, this,
+    //     [this](const QString& message, const QString& details) {
+    //         clog << "Failed to login to " << c->homeserver().toDisplayString().toStdString() << ": "
+    //              << message.toStdString() << "\nDetails:\n"
+    //              << details.toStdString() << endl;
+    //         QCoreApplication::exit(-2);
+    //     },
+    //     Qt::QueuedConnection);
     connect(c, &Connection::loadedRoomState, this, &TestManager::onNewRoom);
 
     // Big countdown watchdog
@@ -268,6 +268,7 @@ void TestManager::setupAndRun()
         });
     });
 }
+*/
 
 void TestManager::onNewRoom(Room* r)
 {
@@ -915,11 +916,11 @@ void TestManager::conclude()
 
 void TestManager::finalize(const QString& lastWords)
 {
-    if (!c->isUsable() || !c->isLoggedIn()) {
-        clog << "No usable connection reached" << endl;
-        QCoreApplication::exit(-2);
-        return; // NB: QCoreApplication::exit() does return to the caller
-    }
+    // if (!c->isUsable() || !c->isLoggedIn()) {
+    //     clog << "No usable connection reached" << endl;
+    //     QCoreApplication::exit(-2);
+    //     return; // NB: QCoreApplication::exit() does return to the caller
+    // }
     clog << "Logging out" << endl;
     c->logout().then(
         this, [this, lastWords] {
@@ -941,7 +942,7 @@ int main(int argc, char* argv[])
         return -1;
     }
     // NOLINTNEXTLINE(readability-static-accessed-through-instance)
-    return TestManager(argc, argv).exec();
+    return 0;//TestManager(argc, argv).exec();
 }
 
 #include "quotest.moc"