diff --git a/como_api/src/controllers/auth.rs b/como_api/src/controllers/auth.rs
index be727ac..ebe65be 100644
--- a/como_api/src/controllers/auth.rs
+++ b/como_api/src/controllers/auth.rs
@@ -4,7 +4,8 @@ use crate::router::AppState;
 
 use axum::extract::{FromRef, FromRequestParts, Query, State};
 
-use axum::headers::Cookie;
+use axum::headers::authorization::Basic;
+use axum::headers::{Authorization, Cookie};
 use axum::http::request::Parts;
 use axum::http::StatusCode;
 
@@ -111,31 +112,29 @@ where
         let cookie: Option<TypedHeader<Cookie>> = parts.extract().await.unwrap();
         let session_cookie = cookie.as_ref().and_then(|cookie| cookie.get(COOKIE_NAME));
         if let None = session_cookie {
-            // let introspection_state = IntrospectionState::from_ref(state);
+            let basic: Option<TypedHeader<Authorization<Basic>>> = parts.extract().await.unwrap();
 
-            // let basic: Option<TypedHeader<Authorization<Basic>>> = parts.extract().await.unwrap();
+            if let Some(basic) = basic {
+                let token = services
+                    .auth_service
+                    .login_token(basic.username(), basic.password())
+                    .await
+                    .into_response()
+                    .map_err(|_| {
+                        (
+                            StatusCode::INTERNAL_SERVER_ERROR,
+                            "could not get token from basic",
+                        )
+                    })?;
 
-            // if let Some(basic) = basic {
-            //     let config = IntrospectionConfig::from_ref(&introspection_state);
+                return Ok(UserFromSession {
+                    user: User { id: token },
+                });
+            }
 
-            //     let res = introspect(
-            //         &config.introspection_uri,
-            //         &config.authority,
-            //         &config.authentication,
-            //         basic.password(),
-            //     )
-            //     .await
-            //     .unwrap();
-
-            //     return Ok(UserFromSession {
-            //         user: User {
-            //             id: res.sub().unwrap().into(),
-            //         },
-            //     });
-            // }
-            todo!()
-
-            //return Err(anyhow::anyhow!("No session was found")).into_response();
+            return Err(anyhow::anyhow!("No session was found"))
+                .into_response()
+                .map_err(|_| (StatusCode::INTERNAL_SERVER_ERROR, "did not find a cookie"))?;
         }
 
         let session_cookie = session_cookie.unwrap();
@@ -146,7 +145,12 @@ where
             .get_user_from_session(session_cookie)
             .await
             .into_response()
-            .map_err(|_| (StatusCode::INTERNAL_SERVER_ERROR, "failed with error"))?;
+            .map_err(|_| {
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    "failed to decode session cookie",
+                )
+            })?;
 
         Ok(UserFromSession {
             user: User { id: user.id },
diff --git a/como_auth/src/auth.rs b/como_auth/src/auth.rs
index ea9281f..d524b46 100644
--- a/como_auth/src/auth.rs
+++ b/como_auth/src/auth.rs
@@ -15,6 +15,7 @@ use crate::{
 #[async_trait]
 pub trait Auth {
     async fn login(&self) -> anyhow::Result<Url>;
+    async fn login_token(&self, user: &str, password: &str) -> anyhow::Result<String>;
     async fn login_authorized(&self, code: &str, state: &str) -> anyhow::Result<(HeaderMap, Url)>;
     async fn get_user_from_session(&self, cookie: &str) -> anyhow::Result<User>;
 }
@@ -91,6 +92,9 @@ impl Auth for ZitadelAuthService {
                 .context("failed to parse login_authorized zitadel return url")?,
         ))
     }
+    async fn login_token(&self, _user: &str, password: &str) -> anyhow::Result<String> {
+        self.introspection.get_id_token(password).await
+    }
     async fn get_user_from_session(&self, cookie: &str) -> anyhow::Result<User> {
         match self.session.get_user(cookie).await? {
             Some(u) => Ok(User { id: u }),
@@ -114,6 +118,10 @@ impl Auth for NoopAuthService {
         todo!()
     }
 
+    async fn login_token(&self, user: &str, password: &str) -> anyhow::Result<String> {
+        todo!()
+    }
+
     async fn get_user_from_session(&self, _cookie: &str) -> anyhow::Result<User> {
         todo!()
     }
diff --git a/como_infrastructure/src/configs/mod.rs b/como_infrastructure/src/configs/mod.rs
index 03981b0..620c779 100644
--- a/como_infrastructure/src/configs/mod.rs
+++ b/como_infrastructure/src/configs/mod.rs
@@ -9,8 +9,6 @@ pub struct AppConfig {
     pub database_type: DatabaseType,
     #[clap(long, env)]
     pub rust_log: String,
-    #[clap(long, env)]
-    pub token_secret: String,
     #[clap(long, env, default_value = "3001")]
     pub api_port: u32,
     #[clap(long, env, default_value = "true")]