diff --git a/front-api/Gemfile b/front-api/Gemfile
index b62bf7b..28560e4 100644
--- a/front-api/Gemfile
+++ b/front-api/Gemfile
@@ -1,16 +1,16 @@
 source 'https://rubygems.org'
 
-
+gem 'bcrypt', '~> 3.1.7'
 
 platform :jruby do
   gem 'activerecord-jdbcpostgresql-adapter'
   gem 'jruby-openssl'
-  
+
 end
 
 platform :ruby do
   gem 'pg'
-  
+
   gem "activerecord"
 end
 
diff --git a/front-api/Gemfile.lock b/front-api/Gemfile.lock
index ee90f61..976bd50 100644
--- a/front-api/Gemfile.lock
+++ b/front-api/Gemfile.lock
@@ -21,6 +21,8 @@ GEM
       tzinfo (~> 1.1)
     arel (6.0.0)
     backports (3.6.4)
+    bcrypt (3.1.10)
+    bcrypt (3.1.10-java)
     builder (3.2.2)
     i18n (0.7.0)
     jdbc-postgres (9.3.1102)
@@ -66,6 +68,7 @@ PLATFORMS
 DEPENDENCIES
   activerecord
   activerecord-jdbcpostgresql-adapter
+  bcrypt (~> 3.1.7)
   jruby-openssl
   json
   pg
diff --git a/front-api/controllers/user.rb b/front-api/controllers/user.rb
new file mode 100644
index 0000000..56b8be9
--- /dev/null
+++ b/front-api/controllers/user.rb
@@ -0,0 +1,20 @@
+get '/user/auth' do
+  # TODO: do something that makes sense here
+  res = User.find_by(id: 1).try(:authenticate, 'spassword')      # => false
+  res.to_json
+end
+
+post '/user' do
+  request.body.rewind
+  json = request.body.read
+
+  user = User.new()
+  user.from_json(json, false)
+
+  if user.save
+    "ok"
+  else
+    status 400
+    user.errors.to_json
+  end
+end
diff --git a/front-api/db/migrate/20150218053655_create_users.rb b/front-api/db/migrate/20150218053655_create_users.rb
new file mode 100644
index 0000000..d700789
--- /dev/null
+++ b/front-api/db/migrate/20150218053655_create_users.rb
@@ -0,0 +1,10 @@
+class CreateUsers < ActiveRecord::Migration
+  def change
+    create_table :users do |t|
+      t.string :first_name
+      t.string :last_name
+      t.string :email
+      t.string :password_digest
+    end
+  end
+end
diff --git a/front-api/db/schema.rb b/front-api/db/schema.rb
index c09d243..e839303 100644
--- a/front-api/db/schema.rb
+++ b/front-api/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20150207120207) do
+ActiveRecord::Schema.define(version: 20150218053655) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -86,10 +86,8 @@ ActiveRecord::Schema.define(version: 20150207120207) do
   end
 
   create_table "sub_categories", force: :cascade do |t|
-    t.string   "name"
-    t.integer  "category_id"
-    t.datetime "created_at",  null: false
-    t.datetime "updated_at",  null: false
+    t.string  "name"
+    t.integer "category_id"
   end
 
   create_table "units", force: :cascade do |t|
@@ -99,4 +97,11 @@ ActiveRecord::Schema.define(version: 20150207120207) do
     t.string "number_of_pieces_suffix"
   end
 
+  create_table "users", force: :cascade do |t|
+    t.string "first_name"
+    t.string "last_name"
+    t.string "email"
+    t.string "password_digest"
+  end
+
 end
diff --git a/front-api/models/user.rb b/front-api/models/user.rb
new file mode 100644
index 0000000..b49bc16
--- /dev/null
+++ b/front-api/models/user.rb
@@ -0,0 +1,9 @@
+class User < ActiveRecord::Base
+  has_secure_password
+  validates_presence_of :first_name, :last_name, :password, :email, :password_confirmation
+
+  validates :email, :uniqueness => {:case_sensitive => false, :message => "Email already exists!"},
+    format: { with: /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\z/i, message: "invalid email" }
+
+  validates :password, confirmation: true, length: { in:6..20, too_short: 'password needs to be at least 6 characters long' }
+end