diff --git a/frontend/src/components/auth/MyAvatar.vue b/frontend/src/components/auth/MyAvatar.vue
index 315c1b0d..82e5ef00 100644
--- a/frontend/src/components/auth/MyAvatar.vue
+++ b/frontend/src/components/auth/MyAvatar.vue
@@ -8,7 +8,7 @@
   <OverlayPanel ref="userPanel" class="w-full md:w-24rem">
     <div class="mb-3">
       <p class="font-semibold">
-        {{ username }} [{{ isAdmin ? t('role.admin') : t('role.guest') }}]
+        {{ displayName }} [{{ isAdmin ? t('role.admin') : t('role.guest') }}]
       </p>
       <i18n-t keypath="user-avatar.from-ip" tag="p">
         <template v-slot:ip>
@@ -33,7 +33,7 @@ import { useSessionStore } from '@/stores/session'
 import { ref } from 'vue'
 
 const { t } = useI18n()
-const { username, ip, isGuest, isAdmin } = storeToRefs(useSessionStore())
+const { displayName, ip, isGuest, isAdmin } = storeToRefs(useSessionStore())
 
 const userPanel = ref()
 
diff --git a/frontend/src/components/auth/UserAvatar.vue b/frontend/src/components/auth/UserAvatar.vue
deleted file mode 100644
index 20f1a619..00000000
--- a/frontend/src/components/auth/UserAvatar.vue
+++ /dev/null
@@ -1,32 +0,0 @@
-<template>
-  <Avatar
-    icon="pi pi-user"
-    class="mr-2"
-    :style="{ 'background-color': colorizeUser(props.user).color, color: 'white' }"
-    shape="circle"
-    v-tooltip.left="tooltip"
-  />
-</template>
-
-<script setup lang="ts">
-import Avatar from 'primevue/avatar'
-import type { User } from '@/stores/users'
-import { computed } from 'vue'
-import { colorizeUser } from '@/stores/users'
-import { useSessionStore } from '@/stores/session'
-import { useI18n } from 'vue-i18n'
-
-const props = defineProps<{ user: User }>()
-const { t } = useI18n()
-
-const sessionStore = useSessionStore()
-
-const tooltip = computed(() => {
-  if (props.user.id === sessionStore.id) {
-    return t('user-avatar.you')
-  }
-
-  const v = props.user.display_name
-  return props.user.ip ? `${v} connecting from ${props.user.ip}` : v
-})
-</script>
diff --git a/frontend/src/components/parts/ActiveUsers.vue b/frontend/src/components/parts/ActiveUsers.vue
index fcdf36ea..a6527f74 100644
--- a/frontend/src/components/parts/ActiveUsers.vue
+++ b/frontend/src/components/parts/ActiveUsers.vue
@@ -1,6 +1,10 @@
 <template>
   <AvatarGroup v-if="entries.length > 1">
-    <UserAvatar :user="user" v-for="user in entries.slice(0, visibleMemberCount)" :key="user.id" />
+    <ClientAvatar
+      :client="client"
+      v-for="client in entries.slice(0, visibleMemberCount)"
+      :key="client.id"
+    />
     <Avatar
       v-if="entries.length > visibleMemberCount"
       :label="'+' + (entries.length - visibleMemberCount)"
@@ -11,14 +15,14 @@
 </template>
 
 <script setup lang="ts">
-import { useUserStore } from '@/stores/users'
-import UserAvatar from '@/components/auth/UserAvatar.vue'
+import { useUserClientStore } from '@/stores/users'
+import ClientAvatar from '@/components/parts/ClientAvatar.vue'
 import Avatar from 'primevue/avatar'
 import AvatarGroup from 'primevue/avatargroup'
 import { computed } from 'vue'
 import { breakpointsPrimeFlex, useBreakpoints } from '@vueuse/core'
 
-const { entries } = useUserStore()
+const { entries } = useUserClientStore()
 
 const { sm, md, lg } = useBreakpoints(breakpointsPrimeFlex)
 
diff --git a/frontend/src/components/parts/ClientAvatar.vue b/frontend/src/components/parts/ClientAvatar.vue
new file mode 100644
index 00000000..7c014109
--- /dev/null
+++ b/frontend/src/components/parts/ClientAvatar.vue
@@ -0,0 +1,40 @@
+<template>
+  <Avatar
+    icon="pi pi-user"
+    class="mr-2"
+    :style="{ 'background-color': colorizeUserClient(props.client).color, color: 'white' }"
+    shape="circle"
+    v-tooltip.left="tooltip"
+  />
+</template>
+
+<script setup lang="ts">
+import Avatar from 'primevue/avatar'
+import type { UserClient } from '@/stores/users'
+import { computed } from 'vue'
+import { colorizeUserClient } from '@/stores/users'
+import { useSessionStore } from '@/stores/session'
+import { useI18n } from 'vue-i18n'
+import { storeToRefs } from 'pinia'
+
+const props = defineProps<{ client: UserClient }>()
+const { t } = useI18n()
+
+const { clientId, userId } = storeToRefs(useSessionStore())
+
+const tooltip = computed(() => {
+  // Same user, different client
+  if (props.client.user_id === userId.value && props.client.id !== clientId.value) {
+    return t('user-avatar.you.different-client')
+  }
+
+  // Same user, same client
+  if (props.client.id === clientId.value) {
+    return t('user-avatar.you.same-client')
+  }
+
+  // Someone else's client
+  const v = props.client.user_display_name
+  return props.client.ip ? `${v} connecting from ${props.client.ip}` : v
+})
+</script>
diff --git a/frontend/src/components/search/SearchResultFocusDialog.vue b/frontend/src/components/search/SearchResultFocusDialog.vue
index 1b502464..d3b361e8 100644
--- a/frontend/src/components/search/SearchResultFocusDialog.vue
+++ b/frontend/src/components/search/SearchResultFocusDialog.vue
@@ -9,7 +9,7 @@
     <Button
       outlined
       icon="pi pi pi-folder-open"
-      v-if="dialogRef.data.result.pathFolder"
+      v-if="isAdmin && dialogRef.data.result.pathFolder"
       @click="openLocalPath(dialogRef.data.result.pathFolder)"
       :label="t('common.button.open-folder')"
     />
@@ -17,23 +17,34 @@
     <Button
       outlined
       icon="pi pi-file-o"
-      v-if="dialogRef.data.result.pathAbsolute"
+      v-if="isAdmin && dialogRef.data.result.pathAbsolute"
       @click="openLocalPath(dialogRef.data.result.pathAbsolute)"
       :label="t('common.button.open-file')"
     />
+
+    <Button
+      outlined
+      icon="pi pi-heart"
+      v-if="isGuest && dialogRef.data.result.id"
+      @click="suggestSearchResult(dialogRef.data.result.id)"
+      :label="t('search-result-focus-dialog.actions.suggest')"
+    />
   </div>
 </template>
 
 <script setup lang="ts">
-import { inject } from 'vue'
 import type { Component } from 'vue'
+import { inject } from 'vue'
 import type { HitFieldset } from '@/plugins/search/result'
 import Button from 'primevue/button'
-import { openLocalPath } from '@/plugins/api'
+import { openLocalPath, suggestSearchResult } from '@/plugins/api'
 import { useI18n } from 'vue-i18n'
+import { useSessionStore } from '@/stores/session'
 
 const { t } = useI18n()
 
+const { isAdmin, isGuest } = useSessionStore()
+
 const dialogRef = inject('dialogRef') as {
   data: {
     component: Component
diff --git a/frontend/src/locales/en.yaml b/frontend/src/locales/en.yaml
index 2cd5fbf6..f450653e 100644
--- a/frontend/src/locales/en.yaml
+++ b/frontend/src/locales/en.yaml
@@ -488,6 +488,8 @@ search-query-toolbar:
 
 search-result-focus-dialog:
   header: Result focus view
+  actions:
+    suggest: Suggest to admin
 
 result-item-component:
   button:
@@ -705,7 +707,9 @@ user-avatar:
   from-ip: Connecting from IP {ip}.
   login: Login
   logout: Logout
-  you: This is you
+  you:
+    same-client: You
+    different-client: You (different tab)
   form:
     master-password:
       title: Master password
diff --git a/frontend/src/plugins/api.ts b/frontend/src/plugins/api.ts
index e348d1e3..180b9d8a 100644
--- a/frontend/src/plugins/api.ts
+++ b/frontend/src/plugins/api.ts
@@ -35,3 +35,10 @@ export async function openLocalPath(path: string) {
     body: JSON.stringify({ path })
   })
 }
+
+export async function suggestSearchResult(id: string) {
+  return await fetchApi('/api/suggestions', {
+    method: 'POST',
+    body: JSON.stringify({ id })
+  })
+}
diff --git a/frontend/src/stores/session.ts b/frontend/src/stores/session.ts
index a8bcf945..97c99cff 100644
--- a/frontend/src/stores/session.ts
+++ b/frontend/src/stores/session.ts
@@ -1,37 +1,43 @@
 import { defineStore } from 'pinia'
-import { computed, ref, nextTick } from 'vue'
+import { computed, ref } from 'vue'
 import { fetchApi } from '@/plugins/api'
-import { useUserStore } from '@/stores/users'
+import { GuestRole, useUserClientStore } from '@/stores/users'
 import { useFilesStore } from '@/stores/files'
 import { websocket } from '@/websocket'
+import type { UserRoles } from '@/stores/users'
 
 const DefaultUsername = 'Unknown user'
 const DefaultIp = 'Unknown IP'
 
 export const useSessionStore = defineStore('session', () => {
-  const id = ref<string | undefined>(undefined)
-  const username = ref(DefaultUsername)
+  const clientId = ref<string | undefined>(undefined)
+
+  const userId = ref<string | undefined>(undefined)
+  const displayName = ref(DefaultUsername)
+  const role = ref<'admin' | 'guest'>('guest')
   const ip = ref(DefaultIp)
-  const isAdmin = ref(false)
-  const isGuest = computed(() => !isAdmin.value)
 
-  const { clear: clearUsers } = useUserStore()
+  const isAdmin = computed(() => role.value === 'admin')
+  const isGuest = computed(() => role.value === 'guest')
+
+  const { clear: clearUsers } = useUserClientStore()
   const { clear: clearFiles } = useFilesStore()
 
   const hello = async () => {
     try {
       const r = await fetchApi<{
-        username: string
-        ip: string
-        role: 'admin' | 'guest'
-      }>('/api/auth/hello')
-      username.value = r.username
-      ip.value = r.ip
-      isAdmin.value = r.role === 'admin'
+        id: string
+        display_name: string
+        role: UserRoles
+      }>('/api/auth', {
+        method: 'POST'
+      })
+      userId.value = r.id
+      displayName.value = r.display_name
+      role.value = r.role
     } catch (e) {
-      username.value = DefaultUsername
-      ip.value = DefaultIp
-      isAdmin.value = false
+      displayName.value = DefaultUsername
+      role.value = GuestRole
 
       console.error('Server hello failed', e)
     }
@@ -39,8 +45,8 @@ export const useSessionStore = defineStore('session', () => {
 
   const goodbye = async () => {
     try {
-      await fetchApi('/api/auth/goodbye', {
-        method: 'POST'
+      await fetchApi('/api/auth', {
+        method: 'DELETE'
       })
     } catch (e) {
       console.error('Server goodbye failed', e)
@@ -65,8 +71,10 @@ export const useSessionStore = defineStore('session', () => {
     hello,
     goodbye,
     reconsider,
-    id,
-    username,
+    clientId,
+    userId,
+    displayName,
+    role,
     ip,
     isAdmin,
     isGuest
diff --git a/frontend/src/stores/users.ts b/frontend/src/stores/users.ts
index ff62bb0a..dda66c36 100644
--- a/frontend/src/stores/users.ts
+++ b/frontend/src/stores/users.ts
@@ -2,19 +2,26 @@ import { defineStore } from 'pinia'
 import { setupStore } from '@/stores/base'
 import uniqolor from 'uniqolor'
 
-export type UserRoles = 'admin' | 'user'
+export const AdminRole = 'admin'
+export type AdminRole = typeof AdminRole
+export const GuestRole = 'guest'
+export type GuestRole = typeof GuestRole
 
-export interface User {
+export type UserRoles = AdminRole | GuestRole
+
+export interface UserClient {
   id: string
-  display_name: string
-  role: UserRoles
   ip?: string
+
+  user_id: string
+  user_display_name: string
+  user_role: UserRoles
 }
 
-export const useUserStore = defineStore('users', setupStore<User>())
+export const useUserClientStore = defineStore('clients', setupStore<UserClient>())
 
-export const colorizeUser = (
-  user: User
+export const colorizeUserClient = (
+  user: UserClient
 ): {
   color: string
   isLight: boolean
diff --git a/frontend/src/views/OtpAuthView.vue b/frontend/src/views/OtpAuthView.vue
index fb6f93c3..3e1db91a 100644
--- a/frontend/src/views/OtpAuthView.vue
+++ b/frontend/src/views/OtpAuthView.vue
@@ -22,6 +22,7 @@ import Message from 'primevue/message'
 import { onMounted, ref } from 'vue'
 import { fetchApi } from '@/plugins/api'
 import { useRoute, useRouter } from 'vue-router'
+import { useSessionStore } from '@/stores/session'
 
 const { t } = useI18n()
 
@@ -29,6 +30,7 @@ const errorMessage = ref<string | null>(null)
 
 const route = useRoute()
 const router = useRouter()
+const { hello } = useSessionStore()
 
 onMounted(async () => {
   try {
@@ -40,6 +42,8 @@ onMounted(async () => {
       })
     })
 
+    await hello()
+
     await router.replace({ name: 'app' })
   } catch (e: any) {
     errorMessage.value = e.message
diff --git a/frontend/src/websocket/index.ts b/frontend/src/websocket/index.ts
index 5d3f223a..623058f5 100644
--- a/frontend/src/websocket/index.ts
+++ b/frontend/src/websocket/index.ts
@@ -5,7 +5,7 @@ import type { PushMessage } from '@/websocket/messages/global'
 import { PushMessageType } from '@/websocket/messages/global'
 import router from '@/router'
 import { createTagFromString, useTagStore } from '@/stores/tags'
-import { useUserStore } from '@/stores/users'
+import { useUserClientStore } from '@/stores/users'
 import { useSessionStore } from '@/stores/session'
 
 export function getWebsocketUrl() {
@@ -23,6 +23,7 @@ export function getWebsocketUrl() {
 export const websocket = useWebSocket(getWebsocketUrl(), {
   immediate: false,
   autoReconnect: true,
+
   async onMessage(ws, event) {
     const payload = JSON.parse(event.data) as PushMessage
 
@@ -52,17 +53,17 @@ export const websocket = useWebSocket(getWebsocketUrl(), {
         await router.push({ name: payload.target })
         break
 
-      case PushMessageType.UserCurrent:
-      case PushMessageType.UserWelcome:
-        useUserStore().update(payload)
+      case PushMessageType.UserClient:
+      case PushMessageType.ClientWelcome:
+        useUserClientStore().update(payload)
         break
 
-      case PushMessageType.UserGoodbye:
-        useUserStore().removeById(payload.id)
+      case PushMessageType.ClientGoodbye:
+        useUserClientStore().removeById(payload.id)
         break
 
-      case PushMessageType.AboutYou:
-        useSessionStore().id = payload.id
+      case PushMessageType.ClientId:
+        useSessionStore().clientId = payload.id
         break
     }
   }
diff --git a/frontend/src/websocket/messages/about_you.ts b/frontend/src/websocket/messages/about_you.ts
index bd360b89..79175b16 100644
--- a/frontend/src/websocket/messages/about_you.ts
+++ b/frontend/src/websocket/messages/about_you.ts
@@ -1,6 +1,6 @@
 import { PushMessageType } from '@/websocket/messages/global'
 
-export interface AboutYouPushMessage {
-  type: PushMessageType.AboutYou
+export interface ClientIdPushMessage {
+  type: PushMessageType.ClientId
   id: string
 }
diff --git a/frontend/src/websocket/messages/global.ts b/frontend/src/websocket/messages/global.ts
index dbbabb35..dfb09880 100644
--- a/frontend/src/websocket/messages/global.ts
+++ b/frontend/src/websocket/messages/global.ts
@@ -3,24 +3,24 @@ import type { MetricUpdatePushMessage } from '@/websocket/messages/metric_update
 import type { ProcessingStatusPushMessage } from '@/websocket/messages/processing_status'
 import type { ForceNavigatePushMessage } from '@/websocket/messages/force_navigate'
 import type { TagUpdatePushMessage } from '@/websocket/messages/tag_update'
-import type { UserWelcomePushMessage } from '@/websocket/messages/user_welcome'
-import type { UserGoodbyePushMessage } from '@/websocket/messages/user_goodbye'
-import type { AboutYouPushMessage } from '@/websocket/messages/about_you'
-import type { UserCurrentPushMessage } from '@/websocket/messages/user_current'
+import type { ClientWelcomePushMessage } from '@/websocket/messages/user_welcome'
+import type { ClientGoodbyePushMessage } from '@/websocket/messages/user_goodbye'
+import type { ClientIdPushMessage } from '@/websocket/messages/about_you'
+import type { UserClientPushMessage } from '@/websocket/messages/user_client'
 
 // TypeScript discriminator hell
 // for websocket messages, anything to satisfy the god of types.
 
 export enum PushMessageType {
+  ClientId = 'client_id',
   FileStatus = 'file_status',
   MetricUpdate = 'metric_update',
   TagUpdate = 'tag_update',
   ProcessingStatus = 'processing_status',
   ForceNavigate = 'force_navigate',
-  UserWelcome = 'user_welcome',
-  UserGoodbye = 'user_goodbye',
-  UserCurrent = 'user_current',
-  AboutYou = 'about_you'
+  ClientWelcome = 'client_welcome',
+  ClientGoodbye = 'client_goodbye',
+  UserClient = 'user_client'
 }
 
 export type PushMessage =
@@ -29,7 +29,7 @@ export type PushMessage =
   | TagUpdatePushMessage
   | ProcessingStatusPushMessage
   | ForceNavigatePushMessage
-  | UserWelcomePushMessage
-  | UserGoodbyePushMessage
-  | UserCurrentPushMessage
-  | AboutYouPushMessage
+  | ClientWelcomePushMessage
+  | ClientGoodbyePushMessage
+  | UserClientPushMessage
+  | ClientIdPushMessage
diff --git a/frontend/src/websocket/messages/user_client.ts b/frontend/src/websocket/messages/user_client.ts
new file mode 100644
index 00000000..040cfad7
--- /dev/null
+++ b/frontend/src/websocket/messages/user_client.ts
@@ -0,0 +1,12 @@
+import { PushMessageType } from '@/websocket/messages/global'
+import type { UserRoles } from '@/stores/users'
+
+export interface UserClientPushMessage {
+  type: PushMessageType.UserClient
+  id: string
+  ip?: string
+
+  user_id: string
+  user_display_name: string
+  user_role: UserRoles
+}
diff --git a/frontend/src/websocket/messages/user_current.ts b/frontend/src/websocket/messages/user_current.ts
deleted file mode 100644
index 5a864604..00000000
--- a/frontend/src/websocket/messages/user_current.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-import { PushMessageType } from '@/websocket/messages/global'
-import type { UserRoles } from '@/stores/users'
-
-export interface UserCurrentPushMessage {
-  type: PushMessageType.UserCurrent
-  id: string
-  display_name: string
-  role: UserRoles
-  ip?: string
-}
diff --git a/frontend/src/websocket/messages/user_goodbye.ts b/frontend/src/websocket/messages/user_goodbye.ts
index 87e244e5..669783d2 100644
--- a/frontend/src/websocket/messages/user_goodbye.ts
+++ b/frontend/src/websocket/messages/user_goodbye.ts
@@ -1,6 +1,6 @@
 import { PushMessageType } from '@/websocket/messages/global'
 
-export interface UserGoodbyePushMessage {
-  type: PushMessageType.UserGoodbye
+export interface ClientGoodbyePushMessage {
+  type: PushMessageType.ClientGoodbye
   id: string
 }
diff --git a/frontend/src/websocket/messages/user_welcome.ts b/frontend/src/websocket/messages/user_welcome.ts
index ec87fbfd..cb0294d7 100644
--- a/frontend/src/websocket/messages/user_welcome.ts
+++ b/frontend/src/websocket/messages/user_welcome.ts
@@ -1,10 +1,12 @@
 import { PushMessageType } from '@/websocket/messages/global'
 import type { UserRoles } from '@/stores/users'
 
-export interface UserWelcomePushMessage {
-  type: PushMessageType.UserWelcome
+export interface ClientWelcomePushMessage {
+  type: PushMessageType.ClientWelcome
   id: string
-  display_name: string
-  role: UserRoles
   ip?: string
+
+  user_id: string
+  user_display_name: string
+  user_role: UserRoles
 }
diff --git a/service/http/service.http b/service/http/service.http
new file mode 100644
index 00000000..6582d9d8
--- /dev/null
+++ b/service/http/service.http
@@ -0,0 +1,132 @@
+### End / destroy current session
+// @no-log
+// @no-redirect
+
+DELETE {{webservice}}/api/auth
+Content-Type: application/json
+Accept: application/json
+
+{}
+
+### Initialize session
+// @no-log
+// @no-redirect
+
+POST {{webservice}}/api/auth
+Content-Type: application/json
+Accept: application/json
+
+{}
+
+### Set session display name
+// @no-log
+// @no-redirect
+
+PUT {{webservice}}/api/auth/display-name
+Content-Type: application/json
+Accept: application/json
+
+{
+  "display_name": "test"
+}
+
+### Auth with password
+// @no-log
+// @no-redirect
+
+POST {{webservice}}/api/auth/password
+Content-Type: application/json
+Accept: application/json
+
+{
+  "password": "test"
+}
+
+### List all active clients
+// @no-log
+// @no-redirect
+
+GET {{webservice}}/api/clients
+Content-Type: application/json
+Accept: application/json
+
+### List all active users
+// @no-log
+// @no-redirect
+
+GET {{webservice}}/api/users
+Content-Type: application/json
+Accept: application/json
+
+
+### Log config
+// @no-log
+// @no-redirect
+
+PUT {{webservice}}/api/config/log
+Content-Type: application/json
+Accept: application/json
+
+{
+  "level": "debug",
+  "enable_runtime_logfile": false,
+  "enable_processed_logfile": false
+}
+
+### Behaviors config
+// @no-log
+// @no-redirect
+
+PUT {{webservice}}/api/config/behaviour
+Content-Type: application/json
+Accept: application/json
+
+{
+  "autostart_webservice": true,
+  "open_browser_on_start": false,
+  "show_service_gui": false
+}
+
+### Add collector target
+// @no-log
+// @no-redirect
+
+POST {{webservice}}/api/config/collector/targets
+Content-Type: application/json
+Accept: application/json
+
+{
+  "id": "test",
+  "Type": "filesystem",
+  "Uri": "/tmp",
+  "parser_performance": "high",
+  "parser_delay": 0,
+  "exclude_system_folders": true,
+  "exclude_dot_folders": true
+}
+
+### Update collector target
+// @no-log
+// @no-redirect
+
+PUT {{webservice}}/api/config/collector/targets/test
+Content-Type: application/json
+Accept: application/json
+
+{
+  "Type": "filesystem",
+  "Uri": "/tmp",
+  "parser_performance": "default",
+  "parser_delay": 0,
+  "exclude_system_folders": true,
+  "exclude_dot_folders": true
+}
+
+### Delete collector target
+// @no-log
+// @no-redirect
+
+DELETE {{webservice}}/api/config/collector/targets/test
+Content-Type: application/json
+Accept: application/json
+
diff --git a/service/internal/access/auth.go b/service/internal/access/auth.go
deleted file mode 100644
index 298cc740..00000000
--- a/service/internal/access/auth.go
+++ /dev/null
@@ -1,77 +0,0 @@
-package access
-
-import (
-	"encoding/json"
-	"github.com/adrianrudnik/ablegram/crypt"
-	"github.com/google/uuid"
-	"time"
-)
-
-const TokenVersion = 1
-
-const AdminRole = "admin"
-const GuestRole = "guest"
-
-type Auth struct {
-	otp *Otp
-}
-
-func NewAuth(otp *Otp) *Auth {
-	return &Auth{
-		otp: otp,
-	}
-}
-
-func (a *Auth) ValidateToken(v string) bool {
-	bv, err := crypt.Decrypt(v)
-	if err != nil {
-		return false
-	}
-
-	// Ensure we can unmarshal the token
-	t := AuthToken{}
-	err = json.Unmarshal([]byte(bv), &t)
-	if err != nil {
-		return false
-	}
-
-	// Ensure the token version is up-to-date
-	if t.Version != TokenVersion {
-		return false
-	}
-
-	return true
-}
-
-func (a *Auth) ConvertOtpToToken(v string) (string, error) {
-	if !a.otp.ValidateOtp(v) {
-		return "", ErrInvalidOtp
-	}
-
-	defer a.otp.InvalidateOtp(v)
-
-	return a.CreateToken()
-}
-
-func (a *Auth) CreateToken() (string, error) {
-	b, err := json.Marshal(newAuthToken())
-	if err != nil {
-		return "", ErrTokenGenerationFailed
-	}
-
-	return crypt.Encrypt(b)
-}
-
-type AuthToken struct {
-	Version int       `json:"version"`
-	Time    time.Time `json:"time"`
-	ID      uuid.UUID `json:"id"`
-}
-
-func newAuthToken() *AuthToken {
-	return &AuthToken{
-		Version: TokenVersion,
-		Time:    time.Now(),
-		ID:      uuid.New(),
-	}
-}
diff --git a/service/internal/access/errors.go b/service/internal/access/errors.go
deleted file mode 100644
index 7b2f29f3..00000000
--- a/service/internal/access/errors.go
+++ /dev/null
@@ -1,6 +0,0 @@
-package access
-
-import "errors"
-
-var ErrInvalidOtp = errors.New("invalid otp")
-var ErrTokenGenerationFailed = errors.New("token generation failed")
diff --git a/service/internal/auth/error.go b/service/internal/auth/error.go
new file mode 100644
index 00000000..4e63b396
--- /dev/null
+++ b/service/internal/auth/error.go
@@ -0,0 +1,5 @@
+package auth
+
+import "errors"
+
+var ErrInvalidOtp = errors.New("invalid otp")
diff --git a/service/internal/access/logger.go b/service/internal/auth/log.go
similarity index 87%
rename from service/internal/access/logger.go
rename to service/internal/auth/log.go
index ddb95e20..40a6e5cb 100644
--- a/service/internal/access/logger.go
+++ b/service/internal/auth/log.go
@@ -1,4 +1,4 @@
-package access
+package auth
 
 import (
 	"github.com/rs/zerolog"
diff --git a/service/internal/access/otp.go b/service/internal/auth/otp.go
similarity index 63%
rename from service/internal/access/otp.go
rename to service/internal/auth/otp.go
index d9e67062..5b5df187 100644
--- a/service/internal/access/otp.go
+++ b/service/internal/auth/otp.go
@@ -1,4 +1,4 @@
-package access
+package auth
 
 import (
 	"crypto/rand"
@@ -9,20 +9,20 @@ import (
 
 const OtpDefaultLifetime = 5 * time.Minute
 
-// Otp offers a simple way for the app to announce one-time-passes for use on the API.
+// OtpManager offers a simple way for the app to announce one-time-passes for use on the API.
 // It circumvents the need for a configured password to gain admin access.
-type Otp struct {
+type OtpManager struct {
 	tokens    map[string]time.Time
 	tokenLock sync.RWMutex
 }
 
-func NewOtp() *Otp {
-	return &Otp{
+func NewOtpManager() *OtpManager {
+	return &OtpManager{
 		tokens: make(map[string]time.Time),
 	}
 }
 
-func (o *Otp) CreateOtp() string {
+func (o *OtpManager) CreateOtp() string {
 	buf := make([]byte, 64)
 	_, err := rand.Read(buf)
 	if err != nil {
@@ -39,7 +39,11 @@ func (o *Otp) CreateOtp() string {
 	return token
 }
 
-func (o *Otp) ValidateOtp(token string) bool {
+func (o *OtpManager) ValidateOtp(token string) bool {
+	// Whatever happens, the OTP will be invalidated.
+	// LIFO of defers will keep the locking clean.
+	defer o.InvalidateOtp(token)
+
 	o.tokenLock.RLock()
 	defer o.tokenLock.RUnlock()
 
@@ -49,14 +53,14 @@ func (o *Otp) ValidateOtp(token string) bool {
 	}
 
 	if expiry.Before(time.Now()) {
-		delete(o.tokens, token)
+
 		return false
 	}
 
 	return true
 }
 
-func (o *Otp) InvalidateOtp(token string) {
+func (o *OtpManager) InvalidateOtp(token string) {
 	o.tokenLock.Lock()
 	defer o.tokenLock.Unlock()
 
diff --git a/service/internal/access/password.go b/service/internal/auth/password.go
similarity index 97%
rename from service/internal/access/password.go
rename to service/internal/auth/password.go
index dfac1e03..7e4b077b 100644
--- a/service/internal/access/password.go
+++ b/service/internal/auth/password.go
@@ -1,4 +1,4 @@
-package access
+package auth
 
 import (
 	"encoding/base64"
diff --git a/service/internal/auth/role.go b/service/internal/auth/role.go
new file mode 100644
index 00000000..3e685ad2
--- /dev/null
+++ b/service/internal/auth/role.go
@@ -0,0 +1,7 @@
+package auth
+
+// AdminRole is given to users that authenticate with either the OTP or the configured master password.
+const AdminRole = "admin"
+
+// GuestRole is given to anyone saying hello via POST /api/auth.
+const GuestRole = "guest"
diff --git a/service/internal/auth/token.go b/service/internal/auth/token.go
new file mode 100644
index 00000000..f992aff8
--- /dev/null
+++ b/service/internal/auth/token.go
@@ -0,0 +1,100 @@
+package auth
+
+import (
+	"encoding/json"
+	"github.com/adrianrudnik/ablegram/crypt"
+	"github.com/google/uuid"
+	"time"
+)
+
+const TokenVersion = 3
+
+type TokenManager struct {
+	otp *OtpManager
+}
+
+func NewTokenManager(otp *OtpManager) *TokenManager {
+	return &TokenManager{
+		otp: otp,
+	}
+}
+
+func (a *TokenManager) ValidateToken(v string) (*AuthToken, bool) {
+	bv, err := crypt.Decrypt(v)
+	if err != nil {
+		return nil, false
+	}
+
+	// Ensure we can unmarshal the token
+	t := AuthToken{}
+	err = json.Unmarshal([]byte(bv), &t)
+	if err != nil {
+		return nil, false
+	}
+
+	// Ensure the token version is up-to-date
+	if t.Version != TokenVersion {
+		return nil, false
+	}
+
+	return &t, true
+}
+
+func (a *TokenManager) ConvertOtpToAdminToken(v string) (*AuthToken, error) {
+	if !a.otp.ValidateOtp(v) {
+		return nil, ErrInvalidOtp
+	}
+
+	defer a.otp.InvalidateOtp(v)
+
+	t := NewGuestAuthToken()
+	t.Role = AdminRole
+	t.DisplayName = "Admin"
+
+	return t, nil
+}
+
+type AuthToken struct {
+	// Token specifics
+	Version int       `json:"version"`
+	Time    time.Time `json:"time"`
+
+	// User specifics
+	ID          uuid.UUID `json:"id"`
+	Role        string    `json:"role"`
+	DisplayName string    `json:"display_name"`
+}
+
+func (t *AuthToken) Encrypt() string {
+	b, err := json.Marshal(t)
+	if err != nil {
+		panic(err)
+	}
+
+	v, err := crypt.Encrypt(b)
+	if err != nil {
+		panic(err)
+	}
+
+	return v
+}
+
+func NewGuestAuthToken() *AuthToken {
+	return &AuthToken{
+		Version: TokenVersion,
+		Time:    time.Now(),
+
+		ID:          uuid.New(),
+		Role:        GuestRole,
+		DisplayName: "Guest",
+	}
+}
+
+func NewAdminToken() *AuthToken {
+	t := NewGuestAuthToken()
+
+	t.Role = AdminRole
+	t.DisplayName = "Admin"
+
+	return t
+}
diff --git a/service/internal/auth/user.go b/service/internal/auth/user.go
new file mode 100644
index 00000000..9c311b3e
--- /dev/null
+++ b/service/internal/auth/user.go
@@ -0,0 +1,74 @@
+package auth
+
+import (
+	"github.com/google/uuid"
+	"sync"
+)
+
+// User represents a configured end-user of the system. This is based on the unique ID given
+// after saying hello via POST /api/auth. The role is controlled by the system. The display name
+// can be configured by the user.
+type User struct {
+	UserID      uuid.UUID `json:"id"`
+	DisplayName string    `json:"display_name"`
+	Role        string    `json:"role"`
+}
+
+func NewUser(userID uuid.UUID, displayName string, role string) *User {
+	return &User{
+		UserID:      userID,
+		DisplayName: displayName,
+		Role:        role,
+	}
+}
+
+// UserList represents a list of users.
+// Currently used to keep a list of all connected users, based on their websocket connection.
+type UserList struct {
+	mutex sync.RWMutex
+	users map[uuid.UUID]*User
+}
+
+func NewUserList() *UserList {
+	return &UserList{
+		users: make(map[uuid.UUID]*User),
+	}
+}
+
+func (s *UserList) All() []User {
+	s.mutex.RLock()
+	defer s.mutex.RUnlock()
+
+	var ul []User
+
+	for _, users := range s.users {
+		ul = append(ul, *users)
+	}
+
+	return ul
+}
+
+func (s *UserList) Add(u *User) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	s.users[u.UserID] = u
+}
+
+func (s *UserList) Get(id uuid.UUID) *User {
+	s.mutex.RLock()
+	defer s.mutex.RUnlock()
+
+	if user, ok := s.users[id]; ok {
+		return user
+	}
+
+	return nil
+}
+
+func (s *UserList) Delete(id uuid.UUID) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	delete(s.users, id)
+}
diff --git a/service/internal/collector/paths_linux.go b/service/internal/collector/path_linux.go
similarity index 100%
rename from service/internal/collector/paths_linux.go
rename to service/internal/collector/path_linux.go
diff --git a/service/internal/collector/paths_mac.go b/service/internal/collector/path_mac.go
similarity index 100%
rename from service/internal/collector/paths_mac.go
rename to service/internal/collector/path_mac.go
diff --git a/service/internal/collector/paths_windows.go b/service/internal/collector/path_windows.go
similarity index 100%
rename from service/internal/collector/paths_windows.go
rename to service/internal/collector/path_windows.go
diff --git a/service/internal/config/config.go b/service/internal/config/config.go
index ca5be4bf..556a4b85 100644
--- a/service/internal/config/config.go
+++ b/service/internal/config/config.go
@@ -37,6 +37,10 @@ func newConfig() *Config {
 			Targets: make(map[string]CollectorTarget, 0),
 		},
 
+		Device: DeviceConfig{
+			Targets: make(map[string]DeviceTarget, 0),
+		},
+
 		Webservice: WebserviceConfig{
 			MasterPassword:  "",
 			TryPorts:        []int{10000, 20000, 30000, 40000, 50000, 10001},
diff --git a/service/internal/config/types.go b/service/internal/config/type.go
similarity index 89%
rename from service/internal/config/types.go
rename to service/internal/config/type.go
index 3e53aef8..0e4750a4 100644
--- a/service/internal/config/types.go
+++ b/service/internal/config/type.go
@@ -6,6 +6,7 @@ type Config struct {
 	Log        LogConfig        `yaml:"log" json:"log"`
 	Behaviour  BehaviourConfig  `yaml:"behaviour" json:"behaviour"`
 	Collector  CollectorConfig  `yaml:"collector" json:"collector"`
+	Device     DeviceConfig     `yaml:"device" json:"device"`
 	Indexer    IndexerConfig    `yaml:"indexer" json:"indexer"`
 	Webservice WebserviceConfig `yaml:"webservice" json:"webservice"`
 
@@ -37,6 +38,26 @@ type CollectorConfig struct {
 	Targets map[string]CollectorTarget `yaml:"targets" json:"targets"`
 }
 
+type CollectorTarget struct {
+	ID                   string `yaml:"id" json:"id"`
+	Type                 string `yaml:"type" json:"type"`
+	Uri                  string `yaml:"uri" json:"uri"`
+	ParserPerformance    string `yaml:"parser_performance" json:"parser_performance"`
+	ParserWorkerDelay    int    `yaml:"parser_delay" json:"parser_delay"`
+	ExcludeSystemFolders bool   `yaml:"exclude_system_folders" json:"exclude_system_folders"`
+	ExcludeDotFolders    bool   `yaml:"exclude_dot_folders" json:"exclude_dot_folders"`
+}
+
+type DeviceConfig struct {
+	Targets map[string]DeviceTarget `yaml:"targets" json:"targets"`
+}
+
+type DeviceTarget struct {
+	ID   string `yaml:"id" json:"id"`
+	Type string `yaml:"type" json:"type"`
+	Uri  string `yaml:"uri" json:"uri"`
+}
+
 type IndexerConfig struct {
 	WorkerDelayInMs int `yaml:"worker_delay_in_ms" json:"worker_delay_in_ms"`
 }
@@ -47,13 +68,3 @@ type WebserviceConfig struct {
 	MasterPassword  string `yaml:"master_password" json:"master_password"`
 	TrustedPlatform string `yaml:"trusted_platform" json:"trusted_platform"`
 }
-
-type CollectorTarget struct {
-	ID                   string `yaml:"id" json:"id"`
-	Type                 string `yaml:"type" json:"type"`
-	Uri                  string `yaml:"uri" json:"uri"`
-	ParserPerformance    string `yaml:"parser_performance" json:"parser_performance"`
-	ParserWorkerDelay    int    `yaml:"parser_delay" json:"parser_delay"`
-	ExcludeSystemFolders bool   `yaml:"exclude_system_folders" json:"exclude_system_folders"`
-	ExcludeDotFolders    bool   `yaml:"exclude_dot_folders" json:"exclude_dot_folders"`
-}
diff --git a/service/internal/device/endpoint.go b/service/internal/device/endpoint.go
new file mode 100644
index 00000000..3dcb2bf5
--- /dev/null
+++ b/service/internal/device/endpoint.go
@@ -0,0 +1,40 @@
+package suggest
+
+import (
+	"github.com/google/uuid"
+	"net/url"
+	"sync"
+)
+
+type Endpoint struct {
+	ID    uuid.UUID         `json:"id"`
+	Label string            `json:"label"`
+	Uri   string            `json:"uri"`
+	Extra map[string]string `json:"extra"`
+	mutex sync.RWMutex
+}
+
+func (e *Endpoint) ParsedUri() (*url.URL, error) {
+	return url.Parse(e.Uri)
+}
+
+func (e *Endpoint) SetExtra(key, value string) {
+	e.mutex.Lock()
+	defer e.mutex.Unlock()
+
+	e.Extra[key] = value
+}
+
+func (e *Endpoint) RemoveExtra(key string) {
+	e.mutex.Lock()
+	defer e.mutex.Unlock()
+
+	delete(e.Extra, key)
+}
+
+func (e *Endpoint) GetExtra(key string) string {
+	e.mutex.RLock()
+	defer e.mutex.RUnlock()
+
+	return e.Extra[key]
+}
diff --git a/service/internal/device/list.go b/service/internal/device/list.go
new file mode 100644
index 00000000..e25b7a39
--- /dev/null
+++ b/service/internal/device/list.go
@@ -0,0 +1,55 @@
+package suggest
+
+import (
+	"github.com/google/uuid"
+	"sync"
+)
+
+type EndpointList struct {
+	mutex     sync.RWMutex
+	endpoints map[uuid.UUID]*Endpoint
+}
+
+func NewList() *EndpointList {
+	return &EndpointList{
+		endpoints: make(map[uuid.UUID]*Endpoint),
+	}
+}
+
+func (s *EndpointList) All() []Endpoint {
+	s.mutex.RLock()
+	defer s.mutex.RUnlock()
+
+	var suggestions []Endpoint
+
+	for _, endpoint := range s.endpoints {
+		suggestions = append(suggestions, *endpoint)
+	}
+
+	return suggestions
+}
+
+func (s *EndpointList) Add(endpoint *Endpoint) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	s.endpoints[endpoint.ID] = endpoint
+}
+
+func (s *EndpointList) Get(id uuid.UUID) *Endpoint {
+	s.mutex.RLock()
+	defer s.mutex.RUnlock()
+
+	if endpoint, ok := s.endpoints[id]; ok {
+		return endpoint
+	}
+
+	return nil
+}
+
+func (s *EndpointList) Delete(id uuid.UUID) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	delete(s.endpoints, id)
+}
diff --git a/service/internal/device/push3api/client.go b/service/internal/device/push3api/client.go
new file mode 100644
index 00000000..e369a85a
--- /dev/null
+++ b/service/internal/device/push3api/client.go
@@ -0,0 +1,59 @@
+package push3api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+)
+
+type Client struct {
+	Uri   string
+	Token string
+
+	client *http.Client
+}
+
+func NewClient(uri string, token string) *Client {
+	return &Client{
+		Uri:   strings.TrimRight(strings.TrimSpace(uri), "/"),
+		Token: token,
+		client: &http.Client{
+			Timeout: 3 * time.Second,
+		},
+	}
+}
+
+// IsAuthorized checks if the client is authorized to access the Push 3 API.
+func (c *Client) IsAuthorized() (bool, error) {
+	if c.Token == "" {
+		return false, nil
+	}
+
+	req, err := http.NewRequest("GET", fmt.Sprintf("%s/%s", c.Uri, "/api/v1/access-allowed"), nil)
+	if err != nil {
+		return false, err
+	}
+
+	resp, err := c.executeRequest(req, true)
+	if err != nil {
+		return false, err
+	}
+
+	return resp.StatusCode == http.StatusOK, nil
+}
+
+// executeRequest executes a request to the Push 3 API, with a possible token, if set.
+func (c *Client) executeRequest(req *http.Request, authenticate bool) (*http.Response, error) {
+	if authenticate && c.Token != "" {
+		req.AddCookie(&http.Cookie{
+			Name:     "Ableton-Challenge-Response-Token",
+			Value:    c.Token,
+			Path:     "/",
+			HttpOnly: true,
+			SameSite: http.SameSiteStrictMode,
+		})
+	}
+
+	return c.client.Do(req)
+}
diff --git a/service/internal/device/push3api/fat.go b/service/internal/device/push3api/fat.go
new file mode 100644
index 00000000..6a1fb9b7
--- /dev/null
+++ b/service/internal/device/push3api/fat.go
@@ -0,0 +1,17 @@
+package push3api
+
+type FileAllocation struct {
+	table map[*FileAllocation]bool
+}
+
+type FileAllocationEntry struct {
+	Path  string `json:"path"`
+	IsDir bool   `json:"is_dir"`
+	Size  int    `json:"size"`
+}
+
+func NewFileAllocation() *FileAllocation {
+	return &FileAllocation{
+		table: make(map[*FileAllocation]bool),
+	}
+}
diff --git a/service/internal/push3/config.go b/service/internal/device/push3api/types.go
similarity index 72%
rename from service/internal/push3/config.go
rename to service/internal/device/push3api/types.go
index 923b469e..4ea8849a 100644
--- a/service/internal/push3/config.go
+++ b/service/internal/device/push3api/types.go
@@ -1,3 +1,3 @@
-package push3
+package push3api
 
 type AbletonChallengeResponseToken = string
diff --git a/service/internal/parser/logger.go b/service/internal/parser/log.go
similarity index 100%
rename from service/internal/parser/logger.go
rename to service/internal/parser/log.go
diff --git a/service/internal/pusher/client.go b/service/internal/pusher/client.go
index 0913489f..30cbf3e5 100644
--- a/service/internal/pusher/client.go
+++ b/service/internal/pusher/client.go
@@ -1,25 +1,40 @@
 package pusher
 
 import (
+	"github.com/adrianrudnik/ablegram/internal/util"
 	"github.com/google/uuid"
 	"github.com/gorilla/websocket"
+	"net"
 	"time"
 )
 
-type PushClient struct {
-	ID          string
-	DisplayName string
-	Role        string
-	Conn        *websocket.Conn
-	Tx          chan interface{}
-	pushChan    *PushManager
+// Client represents a single connection to the system.
+type Client struct {
+	ID     uuid.UUID
+	UserID uuid.UUID
+
+	Conn     *websocket.Conn
+	Tx       chan interface{}
+	pushChan *PushManager
+}
+
+// UserClient represents a user that is currently connected to the system.
+// A client can have multiple connections (e.g. multiple tabs).
+type UserClient struct {
+	ClientId uuid.UUID `json:"id"`
+	ClientIP net.IP    `json:"ip"`
+	UserId   uuid.UUID `json:"user_id"`
 }
 
-var writeTimeout = 5 * time.Second
+const writeTimeout = 10 * time.Second
+const pongWait = 15 * time.Second
+const pingPeriod = (pongWait * 9) / 10
+
+func NewClient(id uuid.UUID, userId uuid.UUID, connection *websocket.Conn, pushChan *PushManager) *Client {
+	return &Client{
+		ID:     id,
+		UserID: userId,
 
-func NewPushClient(id uuid.UUID, connection *websocket.Conn, pushChan *PushManager) *PushClient {
-	return &PushClient{
-		ID:   id.String(),
 		Conn: connection,
 
 		pushChan: pushChan,
@@ -27,13 +42,14 @@ func NewPushClient(id uuid.UUID, connection *websocket.Conn, pushChan *PushManag
 	}
 }
 
-func (c *PushClient) Send() {
-	// Set up a ticker to produce the ping message in intervals
-	pingTicker := time.NewTicker(5 * time.Second)
+func (c *Client) Send() {
+	pingTicker := time.NewTicker(pingPeriod)
 
 	defer func() {
 		pingTicker.Stop()
-		c.Conn.Close()
+
+		err := c.Conn.Close()
+		Logger.Debug().Err(err).Msg("Ending client tx routing")
 	}()
 
 	for {
@@ -52,7 +68,7 @@ func (c *PushClient) Send() {
 				return
 			}
 
-			if !CanClientReceive(msg, c) {
+			if !c.pushChan.canClientReceive(msg, c) {
 				continue
 			}
 
@@ -65,27 +81,36 @@ func (c *PushClient) Send() {
 		case <-pingTicker.C:
 			err := c.Conn.SetWriteDeadline(time.Now().Add(writeTimeout))
 			if err != nil {
-				Logger.Warn().Err(err).Msg("Could not set write deadline for client on ping")
+				Logger.Warn().Err(err).Msg("Could not set write deadline for client on ping tick")
 			}
 
-			err = c.Conn.WriteMessage(websocket.PingMessage, nil)
-			if err != nil {
-				Logger.Warn().Err(err).Msg("Could not write ping message to client")
+			if err := c.Conn.WriteMessage(websocket.PingMessage, []byte{}); err != nil {
+				Logger.Debug().Err(err).Msg("Could not send ping message to client")
+				return
 			}
 		}
 	}
 }
 
-func (c *PushClient) Receive() {
+func (c *Client) Receive() {
 	// Ensure a failing routine cleans up the client
 	defer func() {
 		c.pushChan.removeClient <- c
-		c.Conn.Close()
+		err := c.Conn.Close()
+		Logger.Debug().Err(err).Msg("Ending client rx routing")
 	}()
 
+	c.Conn.SetReadLimit(512)
+	err := c.Conn.SetReadDeadline(time.Now().Add(pongWait))
+	if err != nil {
+		Logger.Warn().Err(err).Msg("Failed to set read deadline on websocket")
+		return
+	}
+
 	c.Conn.SetPongHandler(func(string) error {
-		err := c.Conn.SetReadDeadline(time.Now().Add(1 * time.Minute))
+		err := c.Conn.SetReadDeadline(time.Now().Add(pongWait))
 		if err != nil {
+			Logger.Warn().Err(err).Msg("Failed to set read deadline in pong handler")
 			return err
 		}
 		return nil
@@ -100,3 +125,11 @@ func (c *PushClient) Receive() {
 		}
 	}
 }
+
+func (c *Client) GetIP(real bool) net.IP {
+	if !real {
+		return util.GetFakeClientIP()
+	}
+
+	return c.Conn.RemoteAddr().(*net.TCPAddr).IP
+}
diff --git a/service/internal/pusher/guard.go b/service/internal/pusher/guard.go
new file mode 100644
index 00000000..c5191276
--- /dev/null
+++ b/service/internal/pusher/guard.go
@@ -0,0 +1,31 @@
+package pusher
+
+import "github.com/adrianrudnik/ablegram/internal/auth"
+
+func (pm *PushManager) canClientReceive(msg any, client *Client) bool {
+	// Guard role routed messages
+	if msg, ok := msg.(RoleRoutedMessage); ok {
+		user := pm.users.Get(client.UserID)
+		if msg.GetRole() != user.Role {
+			return false
+		}
+	}
+
+	// Guard user routed messages
+	if msg, ok := msg.(UserRouterMessage); ok {
+		user := pm.users.Get(client.UserID)
+		if _, ok := msg.GetUsers()[user.UserID]; !ok {
+			return false
+		}
+	}
+
+	return true
+}
+
+func (pm *PushManager) reduceMessageForClient(msg any, client *Client) any {
+	if v, ok := msg.(FilteredMessage); ok && pm.users.Get(client.UserID).Role == auth.GuestRole {
+		return v.FilteredVariant()
+	} else {
+		return msg
+	}
+}
diff --git a/service/internal/pusher/guards.go b/service/internal/pusher/guards.go
deleted file mode 100644
index b768b81d..00000000
--- a/service/internal/pusher/guards.go
+++ /dev/null
@@ -1,19 +0,0 @@
-package pusher
-
-func CanClientReceive(msg any, client *PushClient) bool {
-	// Guard role routed messages
-	if msg, ok := msg.(RoleRoutedMessage); ok {
-		if msg.GetRole() != client.Role {
-			return false
-		}
-	}
-
-	// Guard user routed messages
-	if msg, ok := msg.(UserRouterMessage); ok {
-		if _, ok := msg.GetUsers()[client.ID]; !ok {
-			return false
-		}
-	}
-
-	return true
-}
diff --git a/service/internal/pusher/interfaces.go b/service/internal/pusher/interface.go
similarity index 78%
rename from service/internal/pusher/interfaces.go
rename to service/internal/pusher/interface.go
index f0170ba3..0f9e89a7 100644
--- a/service/internal/pusher/interfaces.go
+++ b/service/internal/pusher/interface.go
@@ -1,11 +1,13 @@
 package pusher
 
+import "github.com/google/uuid"
+
 type RoleRoutedMessage interface {
 	GetRole() string
 }
 
 type UserRouterMessage interface {
-	GetUsers() map[string]bool
+	GetUsers() map[uuid.UUID]bool
 }
 
 type RecordMessage interface {
diff --git a/service/internal/pusher/logger.go b/service/internal/pusher/log.go
similarity index 100%
rename from service/internal/pusher/logger.go
rename to service/internal/pusher/log.go
diff --git a/service/internal/pusher/manager.go b/service/internal/pusher/manager.go
index 226f6166..0bf847f7 100644
--- a/service/internal/pusher/manager.go
+++ b/service/internal/pusher/manager.go
@@ -1,6 +1,7 @@
 package pusher
 
 import (
+	"github.com/adrianrudnik/ablegram/internal/auth"
 	"github.com/adrianrudnik/ablegram/internal/config"
 	"github.com/adrianrudnik/ablegram/internal/pushermsg"
 	"github.com/adrianrudnik/ablegram/internal/workload"
@@ -10,117 +11,142 @@ import (
 )
 
 type PushManager struct {
-	config                *config.Config
-	clients               map[*PushClient]bool
-	clientsLock           sync.RWMutex
-	addClient             chan *PushClient
-	removeClient          chan *PushClient
-	broadcast             <-chan workload.PushMessage
+	config *config.Config
+
+	clients     map[*Client]bool
+	clientsLock sync.RWMutex
+
+	users *auth.UserList
+
+	addClient    chan *Client
+	removeClient chan *Client
+	broadcast    <-chan workload.PushMessage
+
 	history               []workload.PushMessage
 	historyLock           sync.RWMutex
 	triggerHistoryCleanup func()
 }
 
-func NewPushManager(conf *config.Config, pushChan <-chan workload.PushMessage) *PushManager {
+func NewPushManager(conf *config.Config, ul *auth.UserList, pushChan <-chan workload.PushMessage) *PushManager {
 	return &PushManager{
 		config:       conf,
-		clients:      make(map[*PushClient]bool),
-		addClient:    make(chan *PushClient),
-		removeClient: make(chan *PushClient),
+		clients:      make(map[*Client]bool),
+		users:        ul,
+		addClient:    make(chan *Client),
+		removeClient: make(chan *Client),
 		broadcast:    pushChan,
 		history:      make([]interface{}, 0, 500),
 	}
 }
 
-func (c *PushManager) Run() {
-	c.StartHistoryCompactor()
+func (pm *PushManager) Run() {
+	pm.StartHistoryCompactor()
 
 	for {
 		select {
-		case client := <-c.addClient:
-			c.AddClient(client)
+		case client := <-pm.addClient:
+			pm.AddClient(client)
 
 			// Admins get the IP detail, though we do not want it for demo mode,
 			// as anyone could become admin and there is no need to expose the real IP to other demo admins.
-			ip := client.Conn.RemoteAddr().String()
-			if c.config.Behaviour.DemoMode {
-				ip = "127.0.0.128"
-			}
-
-			c.Broadcast(pushermsg.NewUserWelcomePush(client.ID, client.Role, client.DisplayName, ip))
-			c.Broadcast(pushermsg.NewAboutYouPush(client.ID))
-
-			// Send a current list of active users towards the newly connected one
-			c.clientsLock.RLock()
-			for kClient := range c.clients {
-				kIp := client.Conn.RemoteAddr().String()
-				if c.config.Behaviour.DemoMode {
-					kIp = "127.0.0.129"
-				}
-
-				c.Broadcast(pushermsg.NewUserCurrentPush(client.ID, kClient.ID, kClient.Role, kClient.DisplayName, kIp))
+			ip := client.GetIP(!pm.config.Behaviour.DemoMode)
+			user := pm.users.Get(client.UserID)
+
+			// Notify all clients about the new user
+			pm.Broadcast(pushermsg.NewClientWelcomePush(
+				client.ID, ip, client.UserID, user.Role, user.DisplayName,
+			))
+
+			//// Notify the
+			pm.Broadcast(pushermsg.NewClientIdPush(client.ID))
+
+			// Send over a list of all currently connected clients
+			for _, connClient := range pm.GetClients() {
+				pm.Broadcast(pushermsg.NewUserClientPush(
+					user.UserID,
+					connClient.ID,
+					connClient.GetIP(!pm.config.Behaviour.DemoMode),
+					connClient.UserID,
+					user.Role,
+					user.DisplayName,
+				))
 			}
-			c.clientsLock.RUnlock()
 
-		case client := <-c.removeClient:
-			c.Broadcast(pushermsg.NewUserGoodbyePush(client.ID))
-			c.RemoveClient(client)
+		case client := <-pm.removeClient:
+			pm.Broadcast(pushermsg.NewClientGoodbyePush(client.ID))
+			pm.RemoveClient(client)
 
-		case message := <-c.broadcast:
-			c.Broadcast(message)
+		case message := <-pm.broadcast:
+			pm.Broadcast(message)
 		}
 	}
 }
 
-func (c *PushManager) AddClient(client *PushClient) {
+func (pm *PushManager) AddClient(client *Client) {
 	// Ensure the client is not already registered
-	c.clientsLock.RLock()
-	if _, ok := c.clients[client]; ok {
-		Logger.Warn().Str("client", client.ID).Msg("Websocket client already registered")
-		c.clientsLock.RUnlock()
+	pm.clientsLock.RLock()
+	if _, ok := pm.clients[client]; ok {
+		Logger.Warn().Str("client", client.ID.String()).Msg("Websocket client already registered")
+		pm.clientsLock.RUnlock()
 		return
 	}
-	c.clientsLock.RUnlock()
+	pm.clientsLock.RUnlock()
 
 	// Register the new client
-	c.clientsLock.Lock()
-	c.clients[client] = true
-	c.clientsLock.Unlock()
+	pm.clientsLock.Lock()
+	pm.clients[client] = true
+	pm.clientsLock.Unlock()
 
-	Logger.Info().Str("client", client.ID).Msg("Websocket client registered")
+	Logger.Info().Str("client", client.ID.String()).Msg("Websocket client registered")
 
 	// Send over the channels history to the client, to get the frontend into the correct state
-	c.historyLock.RLock()
-	for _, msg := range c.history {
-		if !CanClientReceive(msg, client) {
+	pm.historyLock.RLock()
+	for _, msg := range pm.history {
+		if !pm.canClientReceive(msg, client) {
 			continue
 		}
 
-		if v, ok := msg.(FilteredMessage); ok && client.Role == GuestRole {
-			msg = v.FilteredVariant()
-		}
-
-		client.Tx <- msg
+		client.Tx <- pm.reduceMessageForClient(msg, client)
 	}
 
-	count := len(c.history)
-	c.historyLock.RUnlock()
+	count := len(pm.history)
+	pm.historyLock.RUnlock()
 
-	Logger.Info().Int("messages", count).Str("client", client.ID).Msg("Websocket client received history")
+	Logger.Info().
+		Int("messages", count).
+		Str("client", client.ID.String()).
+		Msg("Websocket client received history")
 }
 
-func (c *PushManager) RemoveClient(client *PushClient) {
-	c.clientsLock.Lock()
-	if _, ok := c.clients[client]; ok {
-		delete(c.clients, client)
+func (pm *PushManager) RemoveClient(client *Client) {
+	pm.clientsLock.Lock()
+	defer pm.clientsLock.Unlock()
+
+	userId := client.UserID
+
+	// Remove the client, end the send channel
+	if _, ok := pm.clients[client]; ok {
+		delete(pm.clients, client)
 		close(client.Tx)
 
-		Logger.Info().Str("id", client.ID).Msg("Websocket client unregistered")
+		Logger.Info().Str("id", client.ID.String()).Msg("Websocket client unregistered")
+	}
+
+	// If this was the last connected client with the given user ID, remove the user from the list
+	// as he no longer has any active connections.
+	wasLast := true
+	for c, _ := range pm.clients {
+		if c.UserID == userId {
+			wasLast = false
+		}
+	}
+
+	if wasLast {
+		pm.users.Delete(userId)
 	}
-	c.clientsLock.Unlock()
 }
 
-func (c *PushManager) Broadcast(message interface{}) {
+func (pm *PushManager) Broadcast(message interface{}) {
 	// Append the message to the history, it the interface tells us to, or if the interface is missing
 	record := true // we keep everything that has no details about a specific behaviour
 	if v, ok := message.(RecordMessage); ok {
@@ -128,61 +154,57 @@ func (c *PushManager) Broadcast(message interface{}) {
 	}
 
 	if record {
-		c.historyLock.Lock()
-		c.history = append(c.history, message)
-		c.historyLock.Unlock()
+		pm.historyLock.Lock()
+		pm.history = append(pm.history, message)
+		pm.historyLock.Unlock()
 	}
 
 	// Distribute message to all connected clients
-	c.clientsLock.RLock()
-	for client := range c.clients {
-		if !CanClientReceive(message, client) {
+	pm.clientsLock.RLock()
+	for client := range pm.clients {
+		if !pm.canClientReceive(message, client) {
 			continue
 		}
 
-		if v, ok := message.(FilteredMessage); ok && client.Role == GuestRole {
-			client.Tx <- v.FilteredVariant()
-		} else {
-			client.Tx <- message
-		}
+		client.Tx <- pm.reduceMessageForClient(message, client)
 	}
-	c.clientsLock.RUnlock()
+	pm.clientsLock.RUnlock()
 
 	if record {
-		c.triggerHistoryCleanup()
+		pm.triggerHistoryCleanup()
 	}
 }
 
-func (c *PushManager) StartHistoryCompactor() {
+func (pm *PushManager) StartHistoryCompactor() {
 	// Establish a debounced history cleaner
-	c.triggerHistoryCleanup, _ = lo.NewDebounce(250*time.Millisecond, func() {
-		c.historyLock.Lock()
+	pm.triggerHistoryCleanup, _ = lo.NewDebounce(250*time.Millisecond, func() {
+		pm.historyLock.Lock()
 
-		startCount := len(c.history)
+		startCount := len(pm.history)
 
 		// Make the latest messages to first ones in the slice
-		lo.Reverse(c.history)
+		lo.Reverse(pm.history)
 
 		// Only keep the newest processing update
-		c.history = FilterAllExceptFirst(c.history, func(v interface{}) bool {
+		pm.history = FilterAllExceptFirst(pm.history, func(v interface{}) bool {
 			_, ok := v.(*pushermsg.ProcessingStatusPush)
 			return ok
 		})
 
 		// Only keep the newest tag update
-		c.history = FilterAllExceptFirst(c.history, func(v interface{}) bool {
+		pm.history = FilterAllExceptFirst(pm.history, func(v interface{}) bool {
 			_, ok := v.(*pushermsg.TagUpdatePush)
 			return ok
 		})
 
 		// Only keep the newest metrics update
-		c.history = FilterAllExceptFirst(c.history, func(v interface{}) bool {
+		pm.history = FilterAllExceptFirst(pm.history, func(v interface{}) bool {
 			_, ok := v.(*pushermsg.MetricUpdatePush)
 			return ok
 		})
 
 		// Filter all file updates, keep the newest one per file
-		m := lo.Uniq(lo.FilterMap(c.history, func(v interface{}, _ int) (string, bool) {
+		m := lo.Uniq(lo.FilterMap(pm.history, func(v interface{}, _ int) (string, bool) {
 			x, ok := v.(*pushermsg.FileStatusPush)
 			if !ok {
 				return "", false
@@ -192,19 +214,32 @@ func (c *PushManager) StartHistoryCompactor() {
 		}))
 
 		for _, hit := range m {
-			c.history = FilterAllExceptFirst(c.history, func(v interface{}) bool {
+			pm.history = FilterAllExceptFirst(pm.history, func(v interface{}) bool {
 				x, ok := v.(*pushermsg.FileStatusPush)
 				return ok && x.ID == hit
 			})
 		}
 
-		lo.Reverse(c.history)
+		lo.Reverse(pm.history)
 
 		// Increase capacity again
-		c.history = append(make([]any, 0, len(c.history)+500), c.history...)
+		pm.history = append(make([]any, 0, len(pm.history)+500), pm.history...)
 
-		Logger.Debug().Int("before", startCount).Int("after", len(c.history)).Msg("Websocket history compacted")
+		Logger.Debug().Int("before", startCount).Int("after", len(pm.history)).Msg("Websocket history compacted")
 
-		c.historyLock.Unlock()
+		pm.historyLock.Unlock()
 	})
 }
+
+func (pm *PushManager) GetClients() []Client {
+	pm.clientsLock.RLock()
+	defer pm.clientsLock.RUnlock()
+
+	// Create a static list of clients, so we can release the lock again
+	clients := make([]Client, 0, len(pm.clients))
+	for client := range pm.clients {
+		clients = append(clients, *client)
+	}
+
+	return clients
+}
diff --git a/service/internal/pusher/types.go b/service/internal/pusher/types.go
deleted file mode 100644
index 11e17c1c..00000000
--- a/service/internal/pusher/types.go
+++ /dev/null
@@ -1,4 +0,0 @@
-package pusher
-
-const AdminRole = "admin"
-const GuestRole = "guest"
diff --git a/service/internal/pusher/user.go b/service/internal/pusher/user.go
new file mode 100644
index 00000000..ed7042ae
--- /dev/null
+++ b/service/internal/pusher/user.go
@@ -0,0 +1 @@
+package pusher
diff --git a/service/internal/pusher/websocket.go b/service/internal/pusher/websocket.go
index 42fd0454..b15b5858 100644
--- a/service/internal/pusher/websocket.go
+++ b/service/internal/pusher/websocket.go
@@ -1,6 +1,7 @@
 package pusher
 
 import (
+	"github.com/adrianrudnik/ablegram/internal/auth"
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 	"github.com/gorilla/websocket"
@@ -15,25 +16,24 @@ var upgrader = websocket.Upgrader{
 	},
 }
 
-func (c *PushManager) ConnectClientWebsocket(ctx *gin.Context) {
+func (pm *PushManager) ConnectClientWebsocket(ctx *gin.Context) {
 	// Generate a unique client ID and communicate it back to the client.
+	// Same user might connect multiple times (e.g. multiple tabs), so we need to distinguish them.
 	clientId := uuid.New()
 
-	ws, err := upgrader.Upgrade(ctx.Writer, ctx.Request, http.Header{
-		"X-You-Are": []string{clientId.String()},
-	})
-	ctx.Header("X", clientId.String())
-
+	ws, err := upgrader.Upgrade(ctx.Writer, ctx.Request, nil)
 	if err != nil {
 		Logger.Error().Err(err).Msg("Failed to upgrade client to websocket")
 		return
 	}
-	client := NewPushClient(clientId, ws, c)
 
-	client.DisplayName = ctx.GetString("displayName")
-	client.Role = ctx.GetString("role")
+	client := NewClient(clientId, ctx.MustGet("userId").(uuid.UUID), ws, pm)
+	client.UserID = ctx.MustGet("userId").(uuid.UUID)
+
+	// Add the user to the known list
+	pm.users.Add(auth.NewUser(client.UserID, ctx.GetString("userDisplayName"), ctx.GetString("userRole")))
 
-	c.addClient <- client
+	pm.addClient <- client
 
 	go client.Send()
 	go client.Receive()
diff --git a/service/internal/pushermsg/about_you.go b/service/internal/pushermsg/about_you.go
deleted file mode 100644
index 4040e321..00000000
--- a/service/internal/pushermsg/about_you.go
+++ /dev/null
@@ -1,25 +0,0 @@
-package pushermsg
-
-// AboutYouPush is a message sent to a single client to inform him about his own ID in the backend.
-// This is later used to upgrade websockets on a guest => admin migration to upgrade the pusher client as well.
-type AboutYouPush struct {
-	Type string `json:"type"`
-	ID   string `json:"id"`
-}
-
-// GetUsers ensures this message is only routed towards the given client ID.
-func (p *AboutYouPush) GetUsers() map[string]bool {
-	return map[string]bool{p.ID: true}
-}
-
-// KeepInHistory ensures the message is not kept in history.
-func (p *AboutYouPush) KeepInHistory() bool {
-	return false
-}
-
-func NewAboutYouPush(id string) *AboutYouPush {
-	return &AboutYouPush{
-		Type: "about_you",
-		ID:   id,
-	}
-}
diff --git a/service/internal/pushermsg/user_goodbye.go b/service/internal/pushermsg/client_goodbye.go
similarity index 50%
rename from service/internal/pushermsg/user_goodbye.go
rename to service/internal/pushermsg/client_goodbye.go
index a307af24..99bea9fc 100644
--- a/service/internal/pushermsg/user_goodbye.go
+++ b/service/internal/pushermsg/client_goodbye.go
@@ -1,19 +1,21 @@
 package pushermsg
 
-type UserGoodbyePush struct {
+import "github.com/google/uuid"
+
+type ClientGoodbyePush struct {
 	Type string `json:"type"`
 	ID   string `json:"id"`
 }
 
 // KeepInHistory ensures the message is not kept in history, as there is no need to, new or reconnecting clients are
 // only interested in the current state.
-func (p *UserGoodbyePush) KeepInHistory() bool {
+func (p *ClientGoodbyePush) KeepInHistory() bool {
 	return false
 }
 
-func NewUserGoodbyePush(id string) *UserGoodbyePush {
-	return &UserGoodbyePush{
-		Type: "user_goodbye",
-		ID:   id,
+func NewClientGoodbyePush(id uuid.UUID) *ClientGoodbyePush {
+	return &ClientGoodbyePush{
+		Type: "client_goodbye",
+		ID:   id.String(),
 	}
 }
diff --git a/service/internal/pushermsg/client_id.go b/service/internal/pushermsg/client_id.go
new file mode 100644
index 00000000..e260c81e
--- /dev/null
+++ b/service/internal/pushermsg/client_id.go
@@ -0,0 +1,26 @@
+package pushermsg
+
+import "github.com/google/uuid"
+
+// ClientIdPush is a message that announces the current client ID over the connected websocket the ID belongs to.
+type ClientIdPush struct {
+	Type string `json:"type"`
+	ID   string `json:"id"`
+}
+
+// GetUsers ensures this message is only routed towards the given client ID.
+func (p *ClientIdPush) GetUsers() map[string]bool {
+	return map[string]bool{p.ID: true}
+}
+
+// KeepInHistory ensures the message is not kept in history.
+func (p *ClientIdPush) KeepInHistory() bool {
+	return false
+}
+
+func NewClientIdPush(id uuid.UUID) *ClientIdPush {
+	return &ClientIdPush{
+		Type: "client_id",
+		ID:   id.String(),
+	}
+}
diff --git a/service/internal/pushermsg/client_state.go b/service/internal/pushermsg/client_state.go
new file mode 100644
index 00000000..aa8b600e
--- /dev/null
+++ b/service/internal/pushermsg/client_state.go
@@ -0,0 +1,53 @@
+package pushermsg
+
+import (
+	"github.com/google/uuid"
+	"net"
+)
+
+// UserClientPush communicates a specific state of a client to a specifc user.
+// Used to send the initial client connection state towards new websocket connections.
+// Is separate to the ClientWelcomePush as it is only sent to a specific user and is guarded by the GetUsers() interface.
+type UserClientPush struct {
+	Type string `json:"type"`
+
+	ClientId string `json:"id"`
+	ClientIP string `json:"ip"`
+
+	UserId          string `json:"user_id"`
+	UserRole        string `json:"user_role"`
+	UserDisplayName string `json:"user_display_name"`
+
+	toUserId string
+}
+
+// GetUsers ensures this message is only routed towards the given client ID.
+func (p *UserClientPush) GetUsers() map[string]bool {
+	return map[string]bool{p.toUserId: true}
+}
+
+// KeepInHistory ensures the message is not kept in history.
+func (p *UserClientPush) KeepInHistory() bool {
+	return false
+}
+
+func (p *UserClientPush) FilteredVariant() interface{} {
+	v := *p
+	v.ClientIP = ""
+
+	return v
+}
+
+func NewUserClientPush(toUserId uuid.UUID, clientId uuid.UUID, clientIp net.IP, userId uuid.UUID, userRole string, userDisplayName string) *UserClientPush {
+	return &UserClientPush{
+		Type:     "user_client",
+		toUserId: toUserId.String(),
+
+		ClientId: clientId.String(),
+		ClientIP: clientIp.String(),
+
+		UserId:          userId.String(),
+		UserRole:        userRole,
+		UserDisplayName: userDisplayName,
+	}
+}
diff --git a/service/internal/pushermsg/client_welcome.go b/service/internal/pushermsg/client_welcome.go
new file mode 100644
index 00000000..a9ffa9f0
--- /dev/null
+++ b/service/internal/pushermsg/client_welcome.go
@@ -0,0 +1,40 @@
+package pushermsg
+
+import (
+	"github.com/google/uuid"
+	"net"
+)
+
+// ClientWelcomePush is a message that communicates a new user client connecting to all other connected users.
+type ClientWelcomePush struct {
+	Type        string `json:"type"`
+	ID          string `json:"id"`
+	Role        string `json:"role"`
+	DisplayName string `json:"display_name"`
+	IP          string `json:"ip"`
+}
+
+func (p *ClientWelcomePush) FilteredVariant() interface{} {
+	v := *p
+	v.IP = ""
+
+	return v
+}
+
+// KeepInHistory ensures the message is not kept in history, as we can send the idempotent list on connect
+func (p *ClientWelcomePush) KeepInHistory() bool {
+	return false
+}
+
+func NewClientWelcomePush(clientId uuid.UUID, clientIp net.IP, userId uuid.UUID, userRole string, userDisplayName string) *UserClientPush {
+	return &UserClientPush{
+		Type: "client_welcome",
+
+		ClientId: clientId.String(),
+		ClientIP: clientIp.String(),
+
+		UserId:          userId.String(),
+		UserRole:        userRole,
+		UserDisplayName: userDisplayName,
+	}
+}
diff --git a/service/internal/pushermsg/suggestion_created.go b/service/internal/pushermsg/suggestion_created.go
new file mode 100644
index 00000000..c7817575
--- /dev/null
+++ b/service/internal/pushermsg/suggestion_created.go
@@ -0,0 +1,17 @@
+package pushermsg
+
+type SuggestionCreated struct {
+	Type string `json:"type"`
+	ID   string `json:"id"`
+}
+
+func (p *SuggestionCreated) GetRole() string {
+	return "admin"
+}
+
+func NewSuggestionCreated(to, id, role, displayName, ip string) *SuggestionCreated {
+	return &SuggestionCreated{
+		Type: "suggestion_created",
+		ID:   id,
+	}
+}
diff --git a/service/internal/pushermsg/user_current.go b/service/internal/pushermsg/user_current.go
deleted file mode 100644
index 72406763..00000000
--- a/service/internal/pushermsg/user_current.go
+++ /dev/null
@@ -1,43 +0,0 @@
-package pushermsg
-
-// UserCurrentPush is a message that communicates a user's current state to a single client.
-type UserCurrentPush struct {
-	Type        string `json:"type"`
-	To          string `json:"to"`
-	ID          string `json:"id"`
-	Role        string `json:"role"`
-	DisplayName string `json:"display_name"`
-	IP          string `json:"ip"`
-}
-
-// GetUsers ensures this message is only routed towards the given client ID.
-func (p *UserCurrentPush) GetUsers() map[string]bool {
-	return map[string]bool{p.To: true}
-}
-
-// KeepInHistory ensures the message is not kept in history.
-func (p *UserCurrentPush) KeepInHistory() bool {
-	return false
-}
-
-func (p *UserCurrentPush) FilteredVariant() interface{} {
-	return &UserCurrentPush{
-		Type:        p.Type,
-		To:          p.To,
-		ID:          p.ID,
-		Role:        p.Role,
-		DisplayName: p.DisplayName,
-		IP:          "",
-	}
-}
-
-func NewUserCurrentPush(to, id, role, displayName, ip string) *UserCurrentPush {
-	return &UserCurrentPush{
-		Type:        "user_current",
-		To:          to,
-		ID:          id,
-		Role:        role,
-		DisplayName: displayName,
-		IP:          ip,
-	}
-}
diff --git a/service/internal/pushermsg/user_welcome.go b/service/internal/pushermsg/user_welcome.go
deleted file mode 100644
index 579d1a52..00000000
--- a/service/internal/pushermsg/user_welcome.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package pushermsg
-
-type UserWelcomePush struct {
-	Type        string `json:"type"`
-	ID          string `json:"id"`
-	Role        string `json:"role"`
-	DisplayName string `json:"display_name"`
-	IP          string `json:"ip"`
-}
-
-func (p *UserWelcomePush) FilteredVariant() interface{} {
-	return &UserWelcomePush{
-		Type:        p.Type,
-		ID:          p.ID,
-		Role:        p.Role,
-		DisplayName: p.DisplayName,
-		IP:          "",
-	}
-}
-
-// KeepInHistory ensures the message is not kept in history, as we can send the idempotent list on connect
-func (p *UserWelcomePush) KeepInHistory() bool {
-	return false
-}
-
-func NewUserWelcomePush(id, role, displayName, ip string) *UserWelcomePush {
-	return &UserWelcomePush{
-		Type:        "user_welcome",
-		ID:          id,
-		Role:        role,
-		DisplayName: displayName,
-		IP:          ip,
-	}
-}
diff --git a/service/internal/sourcer/abletonsrc/sample_ref_parser.go b/service/internal/sourcer/abletonsrc/sample_ref_parser.go
index c55bb1c6..35e69740 100644
--- a/service/internal/sourcer/abletonsrc/sample_ref_parser.go
+++ b/service/internal/sourcer/abletonsrc/sample_ref_parser.go
@@ -21,11 +21,6 @@ func ParseSampleReferences(
 ) []*workload.DocumentPayload {
 	docs := make([]*workload.DocumentPayload, 0, 10)
 
-	// Skip v10 files for now, that's some workload to work through.
-	if !data.IsMinorVersion(11) {
-		return docs
-	}
-
 	xqDoc, err := xmlquery.Parse(strings.NewReader(data.Raw))
 	if err != nil {
 		return docs
@@ -33,25 +28,65 @@ func ParseSampleReferences(
 
 	// Can be very nested
 	for _, n := range xmlquery.Find(xqDoc, "//SampleRef") {
-		var sampleRef XmlSampleRef11
-		err := xml.Unmarshal([]byte(n.OutputXML(true)), &sampleRef)
-		if err != nil {
-			Logger.Warn().Err(err).Msg("Failed to parse by xpath")
-			continue
-		}
-
-		// Skip all paths that are of a relative type
-		if sampleRef.FileReference.RelativePathType.Value != 0 {
-			continue
-		}
-
 		tb := tc.NewBucket()
 		tb.Add("type:ableton-sample-reference")
 
 		doc := NewSampleReferenceDocument()
-		doc.SampleAbsPath = sampleRef.FileReference.Path.Value
-		doc.SampleFilename = filepath.Base(sampleRef.FileReference.Path.Value)
-		doc.SampleOriginalFileSize = sampleRef.FileReference.OriginalFileSize.Value
+
+		if data.IsFromMinorVersion(11) {
+			var sampleRef11 XmlSampleRef11
+
+			err := xml.Unmarshal([]byte(n.OutputXML(true)), &sampleRef11)
+			if err != nil {
+				Logger.Warn().Err(err).Msg("Failed to parse by xpath")
+				continue
+			}
+
+			// Skip all paths that are of a relative type
+			/* Past me: why?
+			if sampleRef11.FileReference.RelativePathType.Value != 0 {
+				continue
+			}
+			*/
+
+			doc.SampleAbsPath = sampleRef11.FileReference.Path.Value
+			doc.SampleFilename = filepath.Base(sampleRef11.FileReference.Path.Value)
+			doc.SampleOriginalFileSize = sampleRef11.FileReference.OriginalFileSize.Value
+
+			doc.Enrich(doc.SampleFilename)
+			doc.Enrich(strings.TrimSuffix(doc.SampleFilename, filepath.Ext(doc.SampleFilename)))
+
+			doc.SampleAbsPath = sampleRef11.FileReference.Path.Value
+			doc.SampleFilename = filepath.Base(sampleRef11.FileReference.Path.Value)
+			doc.SampleOriginalFileSize = sampleRef11.FileReference.OriginalFileSize.Value
+
+			doc.Enrich(doc.SampleFilename)
+			doc.Enrich(strings.TrimSuffix(doc.SampleFilename, filepath.Ext(doc.SampleFilename)))
+		} else {
+			var sampleRef9 XmlSampleRef9
+
+			err := xml.Unmarshal([]byte(n.OutputXML(true)), &sampleRef9)
+			if err != nil {
+				Logger.Warn().Err(err).Msg("Failed to parse by xpath")
+				continue
+			}
+
+			// Let's prefer the SearchHint in this version, it contains more valuable information
+			doc.SampleAbsPath = strings.Join(sampleRef9.FileReference.SearchHint.PathHintFolders(), "/")
+			doc.SampleFilename = filepath.Base(sampleRef9.FileReference.Name.Value)
+			doc.SampleOriginalFileSize = sampleRef9.FileReference.SearchHint.FileSize.Value
+
+			doc.Enrich(doc.SampleFilename)
+			doc.Enrich(strings.TrimSuffix(doc.SampleFilename, filepath.Ext(doc.SampleFilename)))
+
+			for _, p := range sampleRef9.FileReference.RelativePathFolders() {
+				doc.Enrich(p)
+			}
+
+			for _, p := range sampleRef9.FileReference.SearchHint.PathHintFolders() {
+				doc.Enrich(p)
+			}
+		}
 
 		doc.LoadFileReference(path, tb)
 		doc.LoadDisplayName([]string{
diff --git a/service/internal/sourcer/abletonsrc/sample_ref_xml.go b/service/internal/sourcer/abletonsrc/sample_ref_xml.go
index 287c5c1c..1a5f4326 100644
--- a/service/internal/sourcer/abletonsrc/sample_ref_xml.go
+++ b/service/internal/sourcer/abletonsrc/sample_ref_xml.go
@@ -38,6 +38,7 @@ type XmlFileRef11 struct {
 	RelativePathType XmlIntValue    `xml:"RelativePathType"`
 	RelativePath     XmlStringValue `xml:"RelativePath"`
 	Path             XmlStringValue `xml:"Path"`
+	Name             XmlStringValue `xml:"Name"`
 	OriginalFileSize XmlIntValue    `xml:"OriginalFileSize"`
 }
 
@@ -113,27 +114,54 @@ type XmlFileRef11 struct {
 </SampleRef>
 */
 
-type XmlSampleRef10Node struct {
-	SampleReference XmlSampleRef10 `xml:"SampleRef"`
+type XmlSampleRef9Node struct {
+	SampleReference XmlSampleRef9 `xml:"SampleRef"`
 }
 
-type XmlSampleRef10 struct {
-	XmlFileRef10
+type XmlSampleRef9 struct {
+	XmlFileRef9Node
 	DefaultSampleRate XmlIntValue `xml:"DefaultSampleRate"`
 	DefaultDuration   XmlIntValue `xml:"DefaultDuration"`
 }
 
-type XmlFileRef10Node struct {
-	FileReference XmlFileRef11 `xml:"FileRef"`
+type XmlFileRef9Node struct {
+	FileReference XmlFileRef9 `xml:"FileRef"`
+}
+
+type XmlFileRef9 struct {
+	SearchHint       XmlSearchHint9            `xml:"SearchHint"`
+	HasRelativePath  XmlBooleanValue           `xml:"HasRelativePath"`
+	RelativePathType XmlIntValue               `xml:"RelativePathType"`
+	RelativePath     []XmlFileRef9RelativePath `xml:"RelativePath>RelativePathElement"`
+	Name             XmlStringValue            `xml:"Name"`
 }
 
-type XmlFileRef10 struct {
-	HasRelativePath  XmlBooleanValue          `xml:"HasRelativePath"`
-	RelativePathType XmlIntValue              `xml:"RelativePathType"`
-	RelativePath     []XmlFileRefRelativePath `xml:"RelativePath>RelativePathElement"`
+func (x *XmlFileRef9) RelativePathFolders() []string {
+	var parts []string
+
+	for _, e := range x.RelativePath {
+		parts = append(parts, e.Folder)
+	}
+
+	return parts
+}
+
+type XmlSearchHint9 struct {
+	PathHint []XmlFileRef9RelativePath `xml:"PathHint>RelativePathElement"`
+	FileSize XmlIntValue               `xml:"FileSize"`
+}
+
+func (x *XmlSearchHint9) PathHintFolders() []string {
+	var parts []string
+
+	for _, e := range x.PathHint {
+		parts = append(parts, e.Folder)
+	}
+
+	return parts
 }
 
-type XmlFileRefRelativePath struct {
+type XmlFileRef9RelativePath struct {
 	Id     int64  `xml:"Id,attr"`
 	Folder string `xml:"Dir,attr"`
 }
diff --git a/service/internal/stats/logger.go b/service/internal/stats/log.go
similarity index 100%
rename from service/internal/stats/logger.go
rename to service/internal/stats/log.go
diff --git a/service/internal/stats/stats.go b/service/internal/stats/stat.go
similarity index 100%
rename from service/internal/stats/stats.go
rename to service/internal/stats/stat.go
diff --git a/service/internal/suggest/entry.go b/service/internal/suggest/entry.go
new file mode 100644
index 00000000..9b9cc1d6
--- /dev/null
+++ b/service/internal/suggest/entry.go
@@ -0,0 +1,9 @@
+package suggest
+
+import "github.com/google/uuid"
+
+type Entry struct {
+	ID     uuid.UUID `json:"id"`
+	Owner  uuid.UUID `json:"owner"`
+	Target string    `json:"target"`
+}
diff --git a/service/internal/suggest/list.go b/service/internal/suggest/list.go
new file mode 100644
index 00000000..7302e062
--- /dev/null
+++ b/service/internal/suggest/list.go
@@ -0,0 +1,55 @@
+package suggest
+
+import (
+	"github.com/google/uuid"
+	"sync"
+)
+
+type List struct {
+	mutex       sync.RWMutex
+	suggestions map[uuid.UUID]Entry
+}
+
+func NewList() *List {
+	return &List{
+		suggestions: make(map[uuid.UUID]Entry),
+	}
+}
+
+func (s *List) All() []Entry {
+	s.mutex.RLock()
+	defer s.mutex.RUnlock()
+
+	var suggestions []Entry
+
+	for _, suggestion := range s.suggestions {
+		suggestions = append(suggestions, suggestion)
+	}
+
+	return suggestions
+}
+
+func (s *List) Add(suggestion *Entry) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	s.suggestions[suggestion.ID] = *suggestion
+}
+
+func (s *List) Get(id uuid.UUID) *Entry {
+	s.mutex.RLock()
+	defer s.mutex.RUnlock()
+
+	if suggestion, ok := s.suggestions[id]; ok {
+		return &suggestion
+	}
+
+	return nil
+}
+
+func (s *List) Delete(id uuid.UUID) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	delete(s.suggestions, id)
+}
diff --git a/service/internal/tagger/logger.go b/service/internal/tagger/log.go
similarity index 100%
rename from service/internal/tagger/logger.go
rename to service/internal/tagger/log.go
diff --git a/service/internal/ui/logger.go b/service/internal/ui/log.go
similarity index 100%
rename from service/internal/ui/logger.go
rename to service/internal/ui/log.go
diff --git a/service/internal/ui/opener.go b/service/internal/ui/opener.go
index ce6fea51..75c02a2e 100644
--- a/service/internal/ui/opener.go
+++ b/service/internal/ui/opener.go
@@ -2,13 +2,13 @@ package ui
 
 import (
 	"fmt"
-	"github.com/adrianrudnik/ablegram/internal/access"
+	"github.com/adrianrudnik/ablegram/internal/auth"
 	"github.com/adrianrudnik/ablegram/internal/config"
 	"github.com/icza/gox/osx"
 	"net/url"
 )
 
-func GenerateLocalAdminUrl(c *config.Config, otp *access.Otp) string {
+func GenerateLocalAdminUrl(c *config.Config, otp *auth.OtpManager) string {
 	port := c.Webservice.ChosenPort
 
 	if c.IsDevelopmentEnv {
@@ -19,7 +19,7 @@ func GenerateLocalAdminUrl(c *config.Config, otp *access.Otp) string {
 	return fmt.Sprintf("http://localhost:%d/auth/otp?token=%s", port, url.QueryEscape(otpToken))
 }
 
-func OpenFrontendAsAdmin(c *config.Config, otp *access.Otp) {
+func OpenFrontendAsAdmin(c *config.Config, otp *auth.OtpManager) {
 	err := osx.OpenDefault(GenerateLocalAdminUrl(c, otp))
 	if err != nil {
 		Logger.Warn().Err(err).Msg("Could not open default browser")
diff --git a/service/internal/util/anonymizer.go b/service/internal/util/anonymizer.go
new file mode 100644
index 00000000..0380311f
--- /dev/null
+++ b/service/internal/util/anonymizer.go
@@ -0,0 +1,7 @@
+package util
+
+import "net"
+
+func GetFakeClientIP() net.IP {
+	return net.IPv4(127, 0, 0, 129)
+}
diff --git a/service/internal/util/namelizer.go b/service/internal/util/namelizer.go
index d561a845..fc240a4d 100644
--- a/service/internal/util/namelizer.go
+++ b/service/internal/util/namelizer.go
@@ -2,12 +2,9 @@ package util
 
 import (
 	"github.com/samber/lo"
-	"regexp"
 	"strings"
 )
 
-var displayNameSanitizer = regexp.MustCompile(`[^a-zA-Z0-9\s]`)
-
 func Namelize(parts []string) string {
 	parts = lo.Filter(parts, func(x string, index int) bool {
 		return x != ""
@@ -38,14 +35,3 @@ func Namelize(parts []string) string {
 
 	return parts[0] + " (" + parts[1] + ")"
 }
-
-func SanitizeDisplayName(v string) string {
-	if len(v) > 16 {
-		v = v[:16]
-	}
-
-	bv := string(displayNameSanitizer.ReplaceAll([]byte(v), []byte("")))
-	bv = strings.TrimSpace(v)
-
-	return bv
-}
diff --git a/service/internal/webservice/logger.go b/service/internal/webservice/log.go
similarity index 100%
rename from service/internal/webservice/logger.go
rename to service/internal/webservice/log.go
diff --git a/service/internal/webservice/middleware_auth.go b/service/internal/webservice/middleware_auth.go
index 7169f1bb..2bb0fb24 100644
--- a/service/internal/webservice/middleware_auth.go
+++ b/service/internal/webservice/middleware_auth.go
@@ -1,39 +1,63 @@
 package webservice
 
 import (
-	"github.com/adrianrudnik/ablegram/internal/access"
-	"github.com/adrianrudnik/ablegram/internal/util"
+	"github.com/adrianrudnik/ablegram/internal/auth"
 	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
 	"net/http"
 )
 
-func AccessMiddleware(auth *access.Auth) gin.HandlerFunc {
+func AuthMiddleware(auth *auth.TokenManager) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		displayName := "Guest"   // used for UI display
-		role := access.GuestRole // used for authorization
-
-		// Resolve admin tokens
-		token, err := c.Cookie("ablegram-token")
-		if err == nil && auth.ValidateToken(token) {
-			role = access.AdminRole
-			displayName = "Admin"
+		// Try to read the raw token, if present
+		rawToken, err := getAuthCookie(c)
+		if err != nil {
+			// No token found, we are done here
+			setAuthContext(nil, c)
+			return
 		}
 
-		// Resolve a custom username
-		username, err := c.Cookie("ablegram-username")
-		if err == nil {
-			displayName = username
+		token, ok := auth.ValidateToken(rawToken)
+		if !ok {
+			// Invalid token, we are done here
+			setAuthContext(nil, c)
+			return
 		}
 
-		c.Set("displayName", util.SanitizeDisplayName(displayName))
-		c.Set("role", role)
+		setAuthContext(token, c)
 	}
 }
 
+// setAuthCookie initializes the required context variables for all available routes.
+func setAuthContext(token *auth.AuthToken, c *gin.Context) {
+	if (token == nil) || (token.ID == uuid.Nil) {
+		c.Set("user", false)
+		return
+	}
+
+	c.Set("user", true)
+	c.Set("userId", token.ID)
+	c.Set("userRole", token.Role)
+	c.Set("userDisplayName", token.DisplayName)
+	c.Set("userToken", token)
+}
+
+// isAdmin checks if there is a known user and if he has the admin role.
+// If not, the given context will be aborted with a 403 Forbidden and false will be returned.
 func isAdmin(c *gin.Context) bool {
-	if c.GetString("role") != "admin" {
-		c.JSON(http.StatusForbidden, gin.H{"error": "Forbidden"})
-		c.Abort()
+	if c.GetBool("user") && c.GetString("userRole") != auth.AdminRole {
+		c.AbortWithStatus(http.StatusForbidden)
+		return false
+	}
+
+	return true
+}
+
+// isSomeone checks if there is a known user.
+// If not, the given context will be aborted with a 403 Forbidden and false will be returned.
+func isSomeone(c *gin.Context) bool {
+	if !c.GetBool("user") {
+		c.AbortWithStatus(http.StatusForbidden)
 
 		return false
 	}
diff --git a/service/internal/webservice/push_client.go b/service/internal/webservice/push_client.go
deleted file mode 100644
index 86ef40db..00000000
--- a/service/internal/webservice/push_client.go
+++ /dev/null
@@ -1,2 +0,0 @@
-package webservice
-
diff --git a/service/internal/webservice/push_guard.go b/service/internal/webservice/push_guard.go
deleted file mode 100644
index 4a39eeb5..00000000
--- a/service/internal/webservice/push_guard.go
+++ /dev/null
@@ -1 +0,0 @@
-package webservice
diff --git a/service/internal/webservice/route_auth.go b/service/internal/webservice/route_auth.go
new file mode 100644
index 00000000..748f901d
--- /dev/null
+++ b/service/internal/webservice/route_auth.go
@@ -0,0 +1,157 @@
+package webservice
+
+import (
+	"fmt"
+	"github.com/adrianrudnik/ablegram/crypt"
+	"github.com/adrianrudnik/ablegram/internal/auth"
+	"github.com/adrianrudnik/ablegram/internal/config"
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+func registerAuthRoutes(rg *gin.RouterGroup, conf *config.Config, authMgr *auth.TokenManager) {
+	// Every client needs to say hello.
+	// The service will issue a cookie that the client needs to serve on every other request.
+	rg.POST("/auth", func(c *gin.Context) {
+		// Users that we identify through a token will receive their info back and some.
+		if c.GetBool("user") {
+
+			c.JSON(200, auth.User{
+				UserID:      c.MustGet("userId").(uuid.UUID),
+				DisplayName: c.GetString("userDisplayName"),
+				Role:        c.GetString("userRole"),
+			})
+
+			return
+		}
+
+		// Users that we could not identify will receive a token that they need to serve on every other request.
+		token := auth.NewGuestAuthToken()
+
+		setAuthCookie(c, token)
+
+		c.JSON(200, auth.User{
+			UserID:      token.ID,
+			DisplayName: token.DisplayName,
+			Role:        token.Role,
+		})
+	})
+
+	// Allows a current user to set a custom display name
+	rg.PUT("/auth/display-name", func(c *gin.Context) {
+		if ok := !isSomeone(c); !ok {
+			return
+		}
+
+		type userInput struct {
+			DisplayName string `json:"display_name" binding:"required,alphanumunicode,min=3,max=16"`
+		}
+
+		var input userInput
+
+		if err := c.ShouldBindJSON(&input); err != nil {
+			c.JSON(400, gin.H{"error": err.Error()})
+			return
+		}
+
+		// Get the current token and update the display name
+		t := c.MustGet("userToken").(*auth.AuthToken)
+		t.DisplayName = input.DisplayName
+
+		setAuthCookie(c, t)
+
+		c.JSON(200, gin.H{
+			"display_name": t.DisplayName,
+		})
+	})
+
+	rg.POST("/auth/otp", func(c *gin.Context) {
+		type userInput struct {
+			OtpToken string `json:"token" binding:"required"`
+		}
+
+		var input userInput
+
+		if err := c.ShouldBindJSON(&input); err != nil {
+			c.JSON(400, gin.H{"error": err.Error()})
+			return
+		}
+
+		t, err := authMgr.ConvertOtpToAdminToken(input.OtpToken)
+		if err != nil {
+			Logger.Warn().
+				Str("ip", c.ClientIP()).
+				Msg("Tried to authenticate with invalid OTP token")
+
+			c.JSON(403, gin.H{"error": err.Error()})
+			return
+		}
+
+		Logger.Info().
+			Str("user", t.ID.String()).
+			Str("ip", c.ClientIP()).
+			Msg("Authenticated with valid OTP token")
+
+		setAuthCookie(c, t)
+
+		c.JSON(200, gin.H{})
+	})
+
+	rg.POST("/auth/password", func(c *gin.Context) {
+		type userInput struct {
+			Password string `json:"password" binding:"required"`
+		}
+
+		var input userInput
+
+		if err := c.ShouldBindJSON(&input); err != nil {
+			c.JSON(400, gin.H{"error": err.Error()})
+			return
+		}
+
+		if conf.Webservice.MasterPassword == "" {
+			c.JSON(405, gin.H{"error": "Master password not enabled"})
+			return
+		}
+
+		pw, err := crypt.Decrypt(conf.Webservice.MasterPassword)
+		if err != nil {
+			c.JSON(500, gin.H{"error": "Could not decrypt master password"})
+			return
+		}
+
+		if input.Password != pw {
+			c.JSON(403, gin.H{"error": "Invalid password"})
+			return
+		}
+
+		t := auth.NewAdminToken()
+
+		setAuthCookie(c, t)
+
+		c.JSON(200, gin.H{})
+	})
+
+	// Allow anyone to delete the current session cookie, we do not care if a valid session exists.
+	rg.DELETE("/auth", func(c *gin.Context) {
+		c.SetCookie(getCookieName(), "", -1, "/", "", false, true)
+		c.JSON(200, gin.H{})
+	})
+}
+
+func getCookieName() string {
+	return fmt.Sprintf("ablegram-token-v%d", auth.TokenVersion)
+}
+
+func setAuthCookie(c *gin.Context, token *auth.AuthToken) {
+	c.SetCookie(getCookieName(), token.Encrypt(), 0, "/", "", false, true)
+}
+
+func getAuthCookie(c *gin.Context) (string, error) {
+	cookie, err := c.Cookie(getCookieName())
+	if err != nil {
+		return "", err
+	}
+
+	return cookie, nil
+}
diff --git a/service/internal/webservice/routes_config.go b/service/internal/webservice/route_config.go
similarity index 84%
rename from service/internal/webservice/routes_config.go
rename to service/internal/webservice/route_config.go
index b466803b..7b6abcf0 100644
--- a/service/internal/webservice/routes_config.go
+++ b/service/internal/webservice/route_config.go
@@ -12,11 +12,6 @@ func registerConfigRoutes(rg *gin.RouterGroup, conf *config.Config) {
 			return
 		}
 
-		if c.GetString("role") != "admin" {
-			c.JSON(http.StatusForbidden, gin.H{"error": "Forbidden"})
-			return
-		}
-
 		c.JSON(http.StatusOK, conf)
 	})
 
@@ -26,9 +21,9 @@ func registerConfigRoutes(rg *gin.RouterGroup, conf *config.Config) {
 		}
 
 		type userInput struct {
-			Level                  string `json:"level"`
-			EnableRuntimeLogfile   bool   `json:"enable_runtime_logfile"`
-			EnableProcessedLogfile bool   `json:"enable_processed_logfile"`
+			Level                  string `json:"level" binding:"required"`
+			EnableRuntimeLogfile   bool   `json:"enable_runtime_logfile" binding:"boolean"`
+			EnableProcessedLogfile bool   `json:"enable_processed_logfile" binding:"boolean"`
 		}
 
 		var input userInput
@@ -69,9 +64,9 @@ func registerConfigRoutes(rg *gin.RouterGroup, conf *config.Config) {
 		}
 
 		type userInput struct {
-			AutostartWebservice bool `json:"autostart_webservice"`
-			OpenBrowserOnStart  bool `json:"open_browser_on_start"`
-			ShowServiceGui      bool `json:"show_service_gui"`
+			AutostartWebservice bool `json:"autostart_webservice" binding:"boolean"`
+			OpenBrowserOnStart  bool `json:"open_browser_on_start" binding:"boolean"`
+			ShowServiceGui      bool `json:"show_service_gui" binding:"boolean"`
 		}
 
 		var input userInput
@@ -108,13 +103,13 @@ func registerConfigRoutes(rg *gin.RouterGroup, conf *config.Config) {
 		}
 
 		type userInput struct {
-			ID                   string `json:"id"`
-			Type                 string `json:"type"`
-			Uri                  string `json:"uri"`
-			ParserPerformance    string `json:"parser_performance"`
-			ParserWorkerDelay    int    `json:"parser_delay"`
-			ExcludeSystemFolders bool   `json:"exclude_system_folders"`
-			ExcludeDotFolders    bool   `json:"exclude_dot_folders"`
+			ID                   string `json:"id" binding:"required"`
+			Type                 string `json:"type" binding:"required,oneof=filesystem"`
+			Uri                  string `json:"uri" binding:"required"`
+			ParserPerformance    string `json:"parser_performance" binding:"required,oneof=low default high"`
+			ParserWorkerDelay    int    `json:"parser_delay" binding:"gte=0"`
+			ExcludeSystemFolders bool   `json:"exclude_system_folders" binding:"boolean"`
+			ExcludeDotFolders    bool   `json:"exclude_dot_folders" binding:"boolean"`
 		}
 
 		var input userInput
diff --git a/service/internal/webservice/routes_os.go b/service/internal/webservice/route_os.go
similarity index 81%
rename from service/internal/webservice/routes_os.go
rename to service/internal/webservice/route_os.go
index 11812680..8c56e012 100644
--- a/service/internal/webservice/routes_os.go
+++ b/service/internal/webservice/route_os.go
@@ -32,14 +32,18 @@ func registerOsRoutes(rg *gin.RouterGroup, conf *config.Config) {
 			return
 		}
 
-		var json OpenInput
-		if err := c.ShouldBindJSON(&json); err != nil {
+		type userInput struct {
+			Path string `json:"path" binding:"required"`
+		}
+
+		var input userInput
+		if err := c.ShouldBindJSON(&input); err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
 
 		if !conf.Behaviour.DemoMode {
-			ui.OpenDefault(json.Path)
+			ui.OpenDefault(input.Path)
 		}
 
 		c.JSON(http.StatusOK, gin.H{"status": "ok"})
diff --git a/service/internal/webservice/route_pusher.go b/service/internal/webservice/route_pusher.go
new file mode 100644
index 00000000..6335b894
--- /dev/null
+++ b/service/internal/webservice/route_pusher.go
@@ -0,0 +1,24 @@
+package webservice
+
+import (
+	"github.com/adrianrudnik/ablegram/internal/pusher"
+	"github.com/gin-gonic/gin"
+	"github.com/samber/lo"
+	"net/http"
+)
+
+func registerPusherRoutes(rg *gin.RouterGroup, pm *pusher.PushManager) {
+	rg.GET("/clients", func(c *gin.Context) {
+		if ok := isAdmin(c); !ok {
+			return
+		}
+
+		c.JSON(http.StatusOK, lo.Map(pm.GetClients(), func(client pusher.Client, _ int) pusher.UserClient {
+			return pusher.UserClient{
+				ClientId: client.ID,
+				ClientIP: client.GetIP(true),
+				UserId:   client.UserID,
+			}
+		}))
+	})
+}
diff --git a/service/internal/webservice/route_suggest.go b/service/internal/webservice/route_suggest.go
new file mode 100644
index 00000000..6083b6e2
--- /dev/null
+++ b/service/internal/webservice/route_suggest.go
@@ -0,0 +1,48 @@
+package webservice
+
+import (
+	"github.com/adrianrudnik/ablegram/internal/config"
+	"github.com/adrianrudnik/ablegram/internal/suggest"
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"net/http"
+)
+
+func registerSuggestRoutes(rg *gin.RouterGroup, conf *config.Config, sl *suggest.List) {
+	rg.GET("/remarks", func(c *gin.Context) {
+		if ok := isAdmin(c); !ok {
+			return
+		}
+
+		c.JSON(http.StatusOK, sl.All())
+	})
+
+	rg.POST("/remarks", func(c *gin.Context) {
+		// All users that said hello can suggest
+		if ok := isSomeone(c); !ok {
+			return
+		}
+
+		type userInput struct {
+			Target string `json:"target" binding:"required"`
+		}
+
+		var input userInput
+		if err := c.ShouldBindJSON(&input); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+
+		c.JSON(http.StatusOK, gin.H{"status": "ok"})
+	})
+
+	rg.DELETE("/remarks/:id", func(c *gin.Context) {
+		if ok := isAdmin(c); !ok {
+			return
+		}
+
+		sl.Delete(uuid.MustParse(c.Param("id")))
+
+		c.JSON(http.StatusOK, gin.H{"status": "ok"})
+	})
+}
diff --git a/service/internal/webservice/route_user.go b/service/internal/webservice/route_user.go
new file mode 100644
index 00000000..22308532
--- /dev/null
+++ b/service/internal/webservice/route_user.go
@@ -0,0 +1,18 @@
+package webservice
+
+import (
+	"github.com/adrianrudnik/ablegram/internal/auth"
+	"github.com/gin-gonic/gin"
+	"net/http"
+)
+
+func registerUserRoutes(rg *gin.RouterGroup, users *auth.UserList) {
+	rg.GET("/users", func(c *gin.Context) {
+		if ok := isAdmin(c); !ok {
+			return
+		}
+
+		// @todo Liste aller nutzer mit einer Liste aller verbindungen
+		c.JSON(http.StatusOK, users.All())
+	})
+}
diff --git a/service/internal/webservice/routes_access.go b/service/internal/webservice/routes_access.go
deleted file mode 100644
index 2fe37ace..00000000
--- a/service/internal/webservice/routes_access.go
+++ /dev/null
@@ -1,98 +0,0 @@
-package webservice
-
-import (
-	"github.com/adrianrudnik/ablegram/crypt"
-	"github.com/adrianrudnik/ablegram/internal/access"
-	"github.com/adrianrudnik/ablegram/internal/config"
-	"github.com/gin-gonic/gin"
-)
-
-func registerAccessRoutes(rg *gin.RouterGroup, conf *config.Config, auth *access.Auth) {
-	// Used to identify the current session against the server
-	rg.GET("/auth/hello", func(c *gin.Context) {
-		c.JSON(200, gin.H{
-			"username": c.MustGet("displayName").(string),
-			"ip":       c.ClientIP(),
-			"role":     c.MustGet("role").(string),
-		})
-	})
-
-	rg.POST("/auth/goodbye", func(c *gin.Context) {
-		c.SetCookie("ablegram-token", "", -1, "/", "", false, true)
-		c.JSON(200, gin.H{})
-	})
-
-	rg.POST("/auth/otp", func(c *gin.Context) {
-		type userInput struct {
-			OtpToken string `json:"token"`
-		}
-
-		var input userInput
-
-		if err := c.ShouldBindJSON(&input); err != nil {
-			c.JSON(400, gin.H{"error": err.Error()})
-			return
-		}
-
-		t, err := auth.ConvertOtpToToken(input.OtpToken)
-		if err != nil {
-			Logger.Warn().
-				Str("ip", c.ClientIP()).
-				Msg("Tried to authenticate with invalid OTP token")
-
-			c.JSON(403, gin.H{"error": err.Error()})
-			return
-		}
-
-		Logger.Info().
-			Str("ip", c.ClientIP()).
-			Msg("Authenticated with valid OTP token")
-
-		c.SetCookie("ablegram-token", t, 0, "/", "", false, true)
-
-		c.JSON(200, gin.H{})
-	})
-
-	rg.POST("/auth/password", func(c *gin.Context) {
-		type userInput struct {
-			Password string `json:"password"`
-		}
-
-		var input userInput
-
-		if err := c.ShouldBindJSON(&input); err != nil {
-			c.JSON(400, gin.H{"error": err.Error()})
-			return
-		}
-
-		if conf.Webservice.MasterPassword == "" {
-			c.JSON(405, gin.H{"error": "Master password not enabled"})
-			return
-		}
-
-		pw, err := crypt.Decrypt(conf.Webservice.MasterPassword)
-		if err != nil {
-			c.JSON(500, gin.H{"error": "Could not decrypt master password"})
-			return
-		}
-
-		if input.Password != pw {
-			c.JSON(403, gin.H{"error": "Invalid password"})
-			return
-		}
-
-		setAdminCookie(c, auth)
-
-		c.JSON(200, gin.H{})
-	})
-}
-
-func setAdminCookie(c *gin.Context, auth *access.Auth) {
-	token, err := auth.CreateToken()
-	if err != nil {
-		Logger.Error().Err(err).Msg("Could not create token")
-		return
-	}
-
-	c.SetCookie("ablegram-token", token, 0, "/", "", false, true)
-}
diff --git a/service/internal/webservice/server.go b/service/internal/webservice/server.go
index 1fccd65b..c974997d 100644
--- a/service/internal/webservice/server.go
+++ b/service/internal/webservice/server.go
@@ -2,10 +2,11 @@ package webservice
 
 import (
 	"embed"
-	"github.com/adrianrudnik/ablegram/internal/access"
+	"github.com/adrianrudnik/ablegram/internal/auth"
 	"github.com/adrianrudnik/ablegram/internal/config"
 	"github.com/adrianrudnik/ablegram/internal/indexer"
 	"github.com/adrianrudnik/ablegram/internal/pusher"
+	"github.com/adrianrudnik/ablegram/internal/suggest"
 	"github.com/adrianrudnik/ablegram/internal/tagger"
 	"github.com/adrianrudnik/ablegram/internal/ui"
 	"github.com/adrianrudnik/ablegram/internal/workload"
@@ -19,7 +20,7 @@ import (
 //go:embed .frontend/*
 var frontendFs embed.FS
 
-func Serve(conf *config.Config, auth *access.Auth, otp *access.Otp, indexer *indexer.Search, tc *tagger.TagCollector, pushChan chan workload.PushMessage, bindAddr string) error {
+func Serve(conf *config.Config, auth *auth.TokenManager, otp *auth.OtpManager, users *auth.UserList, indexer *indexer.Search, tc *tagger.TagCollector, suggest *suggest.List, pushChan chan workload.PushMessage, bindAddr string) error {
 	// Wrap route logging into correct format
 	// @see https://gin-gonic.com/docs/examples/define-format-for-the-log-of-routes/
 	gin.DebugPrintRouteFunc = func(httpMethod, absolutePath, handlerName string, nuHandlers int) {
@@ -35,7 +36,7 @@ func Serve(conf *config.Config, auth *access.Auth, otp *access.Otp, indexer *ind
 	r.Use(gin.Recovery())
 	r.Use(LoggerMiddleware())
 	r.Use(CacheMiddleware())
-	r.Use(AccessMiddleware(auth))
+	r.Use(AuthMiddleware(auth))
 
 	r.Use(cors.New(cors.Config{
 		AllowMethods:     []string{"GET", "POST", "OPTIONS", "PUT", "DELETE"},
@@ -52,10 +53,10 @@ func Serve(conf *config.Config, auth *access.Auth, otp *access.Otp, indexer *ind
 	r.TrustedPlatform = conf.Webservice.TrustedPlatform
 
 	pusher.Logger = Logger.With().Str("module", "pusher").Logger()
-	pushManager := pusher.NewPushManager(conf, pushChan)
+	pushManager := pusher.NewPushManager(conf, users, pushChan)
 	go pushManager.Run()
 
-	// Mount the embeded search frontend
+	// Mount the embedded search frontend
 	frontendFS := EmbedFolder(frontendFs, ".frontend")
 
 	// Mount the Vue frontend
@@ -70,7 +71,12 @@ func Serve(conf *config.Config, auth *access.Auth, otp *access.Otp, indexer *ind
 	// @see https://medium.com/@abhishekranjandev/building-a-production-grade-websocket-for-notifications-with-golang-and-gin-a-detailed-guide-5b676dcfbd5a
 	// @see https://github.com/tinkerbaj/chat-websocket-gin/blob/main/chat/chat.go
 
+	// Register the common websocket route
 	r.GET("/ws", func(c *gin.Context) {
+		if ok := isSomeone(c); !ok {
+			return
+		}
+
 		pushManager.ConnectClientWebsocket(c)
 	})
 
@@ -80,9 +86,10 @@ func Serve(conf *config.Config, auth *access.Auth, otp *access.Otp, indexer *ind
 	registerTagRoutes(api, tc)
 	registerConfigRoutes(api, conf)
 	registerOsRoutes(api, conf)
-
-	// Boot up auth and otp services
-	registerAccessRoutes(api, conf, auth)
+	registerSuggestRoutes(api, conf, suggest)
+	registerAuthRoutes(api, conf, auth)
+	registerUserRoutes(api, users)
+	registerPusherRoutes(api, pushManager)
 
 	// Register the bleve HTTP router
 	search := r.Group("/search")
diff --git a/service/internal/webservice/validation.go b/service/internal/webservice/validation.go
deleted file mode 100644
index c67620cb..00000000
--- a/service/internal/webservice/validation.go
+++ /dev/null
@@ -1,5 +0,0 @@
-package webservice
-
-type OpenInput struct {
-	Path string `json:"path" binding:"required"`
-}
diff --git a/service/internal/workload/files.go b/service/internal/workload/file.go
similarity index 100%
rename from service/internal/workload/files.go
rename to service/internal/workload/file.go
diff --git a/service/internal/workload/pushes.go b/service/internal/workload/push.go
similarity index 100%
rename from service/internal/workload/pushes.go
rename to service/internal/workload/push.go
diff --git a/service/main.go b/service/main.go
index 9c699596..b1d85698 100644
--- a/service/main.go
+++ b/service/main.go
@@ -9,13 +9,14 @@ import (
 	"fyne.io/fyne/v2/layout"
 	"fyne.io/fyne/v2/theme"
 	"fyne.io/fyne/v2/widget"
-	"github.com/adrianrudnik/ablegram/internal/access"
+	"github.com/adrianrudnik/ablegram/internal/auth"
 	"github.com/adrianrudnik/ablegram/internal/collector"
 	"github.com/adrianrudnik/ablegram/internal/config"
 	"github.com/adrianrudnik/ablegram/internal/indexer"
 	"github.com/adrianrudnik/ablegram/internal/parser"
 	"github.com/adrianrudnik/ablegram/internal/pushermsg"
 	"github.com/adrianrudnik/ablegram/internal/stats"
+	"github.com/adrianrudnik/ablegram/internal/suggest"
 	"github.com/adrianrudnik/ablegram/internal/tagger"
 	"github.com/adrianrudnik/ablegram/internal/ui"
 	"github.com/adrianrudnik/ablegram/internal/webservice"
@@ -98,8 +99,12 @@ func main() {
 	appTags.WirePusher(pushChan)
 
 	// Start up the auth and otp services
-	appOtp := access.NewOtp()
-	appAuth := access.NewAuth(appOtp)
+	appOtp := auth.NewOtpManager()
+	appAuth := auth.NewTokenManager(appOtp)
+	appUsers := auth.NewUserList()
+
+	// Start the suggestion service that allows guests to suggest stuff to admins
+	appSuggest := suggest.NewList()
 
 	// Kick of the webservice
 	go func() {
@@ -145,8 +150,10 @@ func main() {
 				appConfig,
 				appAuth,
 				appOtp,
+				appUsers,
 				appIndexer,
 				appTags,
+				appSuggest,
 				pushChan,
 				fmt.Sprintf(":%d", port),
 			)
diff --git a/website/docs/search/api/users.md b/website/docs/search/api/users.md
new file mode 100644
index 00000000..3dabf058
--- /dev/null
+++ b/website/docs/search/api/users.md
@@ -0,0 +1,56 @@
+---
+description: API endpoints for connected user management.
+---
+
+# Users and clients API
+
+The following endpoints are available to work with connected users and their associated users.
+
+## `/api/users`
+
+Returns a list of users.
+Requires admin privileges.
+Every user is represented by a unique ID and an either given or self-configured display name.
+The list only contains users that have at least a single client connected.
+
+```json
+[
+  {
+    "id": "80d8015d-3ec2-4227-a44e-7b6454c927a7",
+    "display_name": "Guest",
+    "role": "guest"
+  },
+  {
+    "id": "2e70ff7b-0c86-4913-9dee-3d3f4a601acc",
+    "display_name": "Admin",
+    "role": "admin"
+  }
+]
+```
+
+## `/api/clients`
+
+Returns a list of connected clients.
+Requires admin privileges.
+Every client is represented by a unique ID and their technical details, as well as the user they are connected to.
+The list only contains clients that are currently connected to the server.
+
+```json
+[
+  {
+    "id": "290319dc-2089-4496-a5bf-555b7f23931f",
+    "ip": "::1",
+    "user_id": "80d8015d-3ec2-4227-a44e-7b6454c927a7"
+  },
+  {
+    "id": "e6207fb4-4f5f-45ad-baad-9b7fd6d1bcb9",
+    "ip": "127.0.0.1",
+    "user_id": "2e70ff7b-0c86-4913-9dee-3d3f4a601acc"
+  },
+  {
+    "id": "127b1c53-387e-4bcf-b7e1-e7ff3a2fab95",
+    "ip": "::1",
+    "user_id": "80d8015d-3ec2-4227-a44e-7b6454c927a7"
+  }
+]
+```