diff --git a/lib/CF.pm b/lib/CF.pm
index a1fb659afaa48af3283ffc0505fc9c3dba7000fc..93e3429c1ba69b120b27c36b52c5aefb6f0d1002 100644
--- a/lib/CF.pm
+++ b/lib/CF.pm
@@ -69,6 +69,8 @@ sub startup {
                 my $user = $c->schema->resultset('User')->find_or_create(
                     $c->user, { key => 'uuid'}
                 );
+                $user->set_secret();
+
                 $c->stash->{user}{id} = $user->id;
 
                 return $c->$cb() if ! scalar @{ $scopes };
diff --git a/lib/CF/Schema/Result/User.pm b/lib/CF/Schema/Result/User.pm
index 3bf40ca88ed7fee5c78810350cd6f51cf6615b05..5f0207d21ea3661cd1c9805127f6fcfa5ebfd30e 100644
--- a/lib/CF/Schema/Result/User.pm
+++ b/lib/CF/Schema/Result/User.pm
@@ -5,6 +5,8 @@ use warnings;
 
 use base 'DBIx::Class::Core';
 
+use Data::Random qw(rand_chars);
+
 our $VERSION = 1;
 
 __PACKAGE__->table('users');
@@ -20,6 +22,7 @@ __PACKAGE__->add_columns(
         uuid
         is_active
         username
+        secret
         name
         main_group_name
         keepalive
@@ -51,4 +54,18 @@ sub formatted {
 
 }
 
+sub set_secret {
+    my $self = shift;
+    my $new  = shift;
+
+    return if $self->secret and not $new;
+
+    my $secret = rand_chars( set => 'alphanumeric', size => 16 );
+
+    $self->update({
+        secret => $secret
+    });
+
+}
+
 1;
diff --git a/openapi.yaml b/openapi.yaml
index 4915664b307bd882c9e8af539860e23073e18777..79731d4f7a57c146146c5268dcd49e74a2a92d0c 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -114,6 +114,8 @@ components:
             type: string
         username:
             type: string
+        secret:
+            type: string
         is_banned:
             type: boolean
     Announcement:
diff --git a/sql/1/up.sql b/sql/1/up.sql
index b7e777035a6c568cf3ed21ad2b23941ed9d2a057..76c7bda471d877267a9e760f0fd2cf7465cba1a8 100644
--- a/sql/1/up.sql
+++ b/sql/1/up.sql
@@ -19,6 +19,7 @@ create table "users" (
     "uuid" varchar(36) not null,
     "is_active" bool not null default 'true',
     "username" text,
+    "secret" text,
     "name" text,
     "main_group_name" text,
     "keepalive" timestamp,