diff --git a/api/advent22_api/config.py b/api/advent22_api/config.py
index 1c901fd..b1e1ac6 100644
--- a/api/advent22_api/config.py
+++ b/api/advent22_api/config.py
@@ -5,8 +5,13 @@ from .dav_common import dav_get_textfile_content
 from .settings import SETTINGS
 
 
+class User(BaseModel):
+    name: str
+    password: str
+
+
 class Config(BaseModel):
-    admin_password: str
+    admin: User
     solution: str
 
 
diff --git a/api/advent22_api/routers/__init__.py b/api/advent22_api/routers/__init__.py
index 53178bd..867db6b 100644
--- a/api/advent22_api/routers/__init__.py
+++ b/api/advent22_api/routers/__init__.py
@@ -1,9 +1,10 @@
 from fastapi import APIRouter
 
-from . import abspacken, days, general
+from . import abspacken, days, general, user
 
 router = APIRouter(prefix="/api")
 
 router.include_router(abspacken.router)
 router.include_router(days.router)
 router.include_router(general.router)
+router.include_router(user.router)
diff --git a/api/advent22_api/routers/abspacken.py b/api/advent22_api/routers/abspacken.py
index 86a1225..eb30c99 100644
--- a/api/advent22_api/routers/abspacken.py
+++ b/api/advent22_api/routers/abspacken.py
@@ -1,6 +1,8 @@
 import asyncio
 
-from fastapi import APIRouter, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, status
+
+from .user import require_admin
 
 router = APIRouter(prefix="/abspacken", tags=["abspacken"])
 
@@ -15,7 +17,8 @@ async def get_kurix(kgs: float) -> float:
 @router.post("/uwe")
 async def uwe(
     kgs: float = 10,
-    firma: str = "Vodafone"
+    firma: str = "Vodafone",
+    _: None = Depends(require_admin),
 ) -> str:
     kurix = await get_kurix(kgs)
 
diff --git a/api/advent22_api/routers/user.py b/api/advent22_api/routers/user.py
new file mode 100644
index 0000000..af697e0
--- /dev/null
+++ b/api/advent22_api/routers/user.py
@@ -0,0 +1,31 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi.security import HTTPBasic, HTTPBasicCredentials
+
+from ..config import Config, get_config
+
+router = APIRouter(prefix="/user", tags=["user"])
+security = HTTPBasic()
+
+
+async def is_admin(
+    credentials: HTTPBasicCredentials = Depends(security),
+    config: Config = Depends(get_config),
+) -> bool:
+    if config.admin.name == credentials.username:
+        if config.admin.password == credentials.password:
+            return True
+    return False
+
+
+async def require_admin(
+    is_admin: bool = Depends(is_admin),
+) -> None:
+    if not is_admin:
+        raise HTTPException(status.HTTP_401_UNAUTHORIZED)
+
+
+@router.get("/admin")
+def check_admin(
+    _: None = Depends(require_admin),
+) -> None:
+    return None