diff --git a/Makefile b/Makefile
index 9b95799..9370b3a 100644
--- a/Makefile
+++ b/Makefile
@@ -8,9 +8,12 @@ endif
 build:
 	go build .
 
-migrate:
+migrate_up:
 	go tool goose sqlite3 db.sqlite3 -dir migrations up
 
+migrate_down:
+	go tool goose sqlite3 db.sqlite3 -dir migrations down
+
 html:
 	go tool qtc -dir templates
 
diff --git a/api/controllers.go b/api/controllers.go
new file mode 100644
index 0000000..c8e19f0
--- /dev/null
+++ b/api/controllers.go
@@ -0,0 +1,101 @@
+package api
+
+import (
+  "log"
+  "github.com/gofiber/fiber/v2"
+
+   _ "github.com/mattn/go-sqlite3"
+   sq "github.com/Masterminds/squirrel"
+   "github.com/gofiber/fiber/v2/middleware/session"
+
+  "zedshaw.games/webapp/data"
+)
+
+var STORE *session.Store
+
+func GetApiStream(c *fiber.Ctx) error {
+  sess, err := STORE.Get(c)
+  sess.Set("fuck", "off")
+
+  sql, args, err := sq.Select("*").From("stream").ToSql()
+  err = data.SelectJson[data.Stream](c, err, sql, args...)
+
+  return IfErrNil(err, c)
+}
+
+func GetApiStreamId(c *fiber.Ctx) error {
+  sql, args, err := sq.Select("*").
+    From("stream").Where("id=?", c.Params("id")).ToSql()
+
+  err = data.GetJson[data.Stream](c, err, sql, args...)
+  return IfErrNil(err, c)
+}
+
+func GetApiStreamIdLinks(c *fiber.Ctx) error {
+  sql, args, err := sq.Select("*").
+   From("stream_link").
+   Where("stream_id=?", c.Params("id")).ToSql()
+
+  err = data.SelectJson[data.Link](c, err, sql, args...)
+
+  return IfErrNil(err, c)
+}
+
+func PostApiLogin(c *fiber.Ctx) error {
+  var result data.User
+
+  login, err := ReceivePost[data.Login](c)
+  if(err != nil) { return IfErrNil(err, c) }
+
+  sql, args, err := sq.Select("username, password").
+      From("user").Where("username=?", login.Username).ToSql()
+
+  if err != nil { return IfErrNil(err, c) }
+
+  err = data.DB.Get(&result, sql, args...)
+  if err != nil { return IfErrNil(err, c) }
+
+  if login.Username == result.Username && login.Password == result.Password {
+    return c.Redirect("/")
+  } else {
+    return c.Redirect("/login/")
+  }
+}
+
+func PostApiLink(c *fiber.Ctx) error {
+  var sql string
+  var args []interface{}
+
+  link, err := ReceivePost[data.Link](c)
+  if err != nil { goto fail }
+
+  sql, args, err = sq.Insert("stream_blah").Columns("stream_id", "url", "description").Values(link.StreamId, link.Url, link.Description).ToSql()
+
+  err = data.Insert(err, sql, args...)
+  return c.Redirect("/live/")
+
+  fail:
+     return IfErrNil(err, c)
+}
+
+
+func Setup(app *fiber.App) {
+  STORE = session.New()
+
+  app.Get("/api/stream/", GetApiStream)
+  app.Get("/api/stream/:id", GetApiStreamId)
+  app.Get("/api/stream/:id/links", GetApiStreamIdLinks)
+  app.Post("/api/login", PostApiLogin)
+  app.Post("/api/link", PostApiLink)
+
+  app.Get("/test/:name/", func (c *fiber.Ctx) error {
+    return c.Render(c.Params("name"), fiber.Map{
+      "Title": "Hello, World!",
+    })
+  })
+
+}
+
+func Shutdown() {
+  log.Println("Shutting down controllers...")
+}
diff --git a/data/models.go b/data/models.go
index 43c4e15..7fa90b2 100644
--- a/data/models.go
+++ b/data/models.go
@@ -1,8 +1,14 @@
 package data
 
 type Login struct {
-	Username string `db:"username" validate:"required"`
-	Password string `db:"password" validate:"required"`
+  Username string `db:"username" validate:"required"`
+  Password string `db:"password" validate:"required"`
+}
+
+type User struct {
+  Username string `db:"username" validate:"required"`
+  Email string `db:"email" validate:"required email"`
+  Password string `db:"password" validate:"required"`
 }
 
 type Link struct {
diff --git a/main.go b/main.go
index 0bea608..a4d0c27 100644
--- a/main.go
+++ b/main.go
@@ -34,6 +34,7 @@ func main() {
 
   app.Static("/", "./public")
 
+  // this sets up graceful shutdown
   go func() {
 	  if err := app.Listen(":5001"); err != nil {
 		  log.Panic(err)
diff --git a/migrations/20250625041155_auth_users.sql b/migrations/20250625041155_auth_users.sql
new file mode 100644
index 0000000..7f0cc42
--- /dev/null
+++ b/migrations/20250625041155_auth_users.sql
@@ -0,0 +1,9 @@
+-- +goose Up
+-- +goose StatementBegin
+CREATE TABLE user (id INTEGER PRIMARY KEY, username TEXT UNIQUE NOT NULL, email TEXT UNIQUE, password TEXT NOT NULL);
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+DROP TABLE user;
+-- +goose StatementEnd