diff --git a/file-service/src/handlers.rs b/file-service/src/handlers.rs
index cb6d926..7d8fb22 100644
--- a/file-service/src/handlers.rs
+++ b/file-service/src/handlers.rs
@@ -3,7 +3,7 @@ use http::{Error, StatusCode};
 use std::{collections::HashMap, future::Future};
 use warp::http::Response;
 
-use crate::{pages, App, FileHandle, FileId, FileInfo, ReadFileError, SessionToken};
+use crate::{pages, App, AuthToken, FileHandle, FileId, FileInfo, ReadFileError, SessionToken};
 
 pub async fn handle_index(
     app: App,
@@ -70,10 +70,20 @@ pub async fn file(
     }
 }
 
-pub async fn handle_auth(_form: HashMap<String, String>) -> Result<http::Response<String>, Error> {
-    Response::builder()
-        .status(StatusCode::NOT_IMPLEMENTED)
-        .body("".to_owned())
+pub async fn handle_auth(
+    app: App,
+    form: HashMap<String, String>,
+) -> Result<http::Response<String>, Error> {
+    match form.get("token") {
+        Some(token) => match app
+            .auth_token(AuthToken::from(AuthToken::from(token.clone())))
+            .await
+        {
+            Ok(_session_token) => render_gallery_page(app).await,
+            Err(_) => render_auth_page(Some(format!("invalid auth token"))),
+        },
+        None => render_auth_page(Some(format!("no token available"))),
+    }
 }
 
 pub async fn handle_upload(
diff --git a/file-service/src/main.rs b/file-service/src/main.rs
index 191db78..6dd12f5 100644
--- a/file-service/src/main.rs
+++ b/file-service/src/main.rs
@@ -24,7 +24,9 @@ mod pages;
 mod store;
 
 pub use handlers::handle_index;
-pub use store::{App, AuthDB, FileHandle, FileId, FileInfo, ReadFileError, SessionToken, Store};
+pub use store::{
+    App, AuthDB, AuthToken, FileHandle, FileId, FileInfo, ReadFileError, SessionToken, Store,
+};
 
 /*
 async fn authenticate_user(app: App, auth_token: String) -> Result<Username, warp::Rejection> {
@@ -155,6 +157,7 @@ pub async fn main() {
 
     let auth = warp::path!("auth")
         .and(warp::post())
+        .and(with_app(app.clone()))
         .and(warp::filters::body::form())
         .then(handle_auth);
 
diff --git a/file-service/src/store/mod.rs b/file-service/src/store/mod.rs
index e757643..907c4ee 100644
--- a/file-service/src/store/mod.rs
+++ b/file-service/src/store/mod.rs
@@ -100,6 +100,41 @@ impl Deref for Username {
     }
 }
 
+#[derive(Clone, Debug, Serialize, Deserialize, Hash, PartialEq, Eq)]
+pub struct AuthToken(String);
+
+impl From<String> for AuthToken {
+    fn from(s: String) -> Self {
+        Self(s)
+    }
+}
+
+impl From<&str> for AuthToken {
+    fn from(s: &str) -> Self {
+        Self(s.to_owned())
+    }
+}
+
+impl From<AuthToken> for PathBuf {
+    fn from(s: AuthToken) -> Self {
+        Self::from(&s)
+    }
+}
+
+impl From<&AuthToken> for PathBuf {
+    fn from(s: &AuthToken) -> Self {
+        let AuthToken(s) = s;
+        Self::from(s)
+    }
+}
+
+impl Deref for AuthToken {
+    type Target = String;
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize, Hash, PartialEq, Eq)]
 pub struct SessionToken(String);
 
@@ -196,10 +231,12 @@ impl App {
         }
     }
 
+    pub async fn auth_token(&self, token: AuthToken) -> Result<SessionToken, AuthError> {
+        self.authdb.read().await.auth_token(token).await
+    }
+
     pub async fn auth_session(&self, token: SessionToken) -> Result<Username, AuthError> {
-        let authdb = self.authdb.read();
-        // authdb.auth_session(token).await
-        unimplemented!()
+        self.authdb.read().await.auth_session(token).await
     }
 
     pub async fn list_files(&self) -> Result<HashSet<FileId>, ReadFileError> {
@@ -230,7 +267,11 @@ impl AuthDB {
         Ok(Self { pool })
     }
 
-    pub async fn auth_session(&self, _token: SessionToken) -> Result<Username, AuthError> {
+    async fn auth_token(&self, _token: AuthToken) -> Result<SessionToken, AuthError> {
+        unimplemented!()
+    }
+
+    async fn auth_session(&self, _token: SessionToken) -> Result<Username, AuthError> {
         /*
         let conn = self.pool.acquire().await.map_err(|_| AuthError::SqlError)?;
         conn.transaction(|tr| {})