diff --git a/src/app/_services/auth.service.spec.ts b/src/app/_services/auth.service.spec.ts
new file mode 100644
index 0000000..f1251ca
--- /dev/null
+++ b/src/app/_services/auth.service.spec.ts
@@ -0,0 +1,16 @@
+import { TestBed } from '@angular/core/testing';
+
+import { AuthService } from './auth.service';
+
+describe('AuthService', () => {
+  let service: AuthService;
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({});
+    service = TestBed.inject(AuthService);
+  });
+
+  it('should be created', () => {
+    expect(service).toBeTruthy();
+  });
+});
diff --git a/src/app/_services/auth.service.ts b/src/app/_services/auth.service.ts
new file mode 100644
index 0000000..2aeaf15
--- /dev/null
+++ b/src/app/_services/auth.service.ts
@@ -0,0 +1,119 @@
+import { Injectable } from '@angular/core';
+import { UnsafeKeyStore } from '../_helpers';
+import { hobaParseChallengeHeader } from '../../assets/js/hoba.js';
+import { signChallenge } from '../../assets/js/hoba-pgp.js';
+
+const origin = 'http://localhost:4444';
+
+@Injectable({
+  providedIn: 'root'
+})
+export class AuthService {
+  pgpKeyStore = new UnsafeKeyStore();
+  sessionToken = undefined;
+  sessionLoginCount = 0;
+
+  constructor() {}
+
+  setState(s): void {
+    (document.getElementById('state') as HTMLInputElement).value = s;
+  }
+
+  getWithToken(): void {
+    const xhr = new XMLHttpRequest();
+    xhr.responseType = 'text';
+    xhr.open('GET', origin + window.location.search.substring(1));
+    xhr.setRequestHeader('Authorization', 'Bearer ' + this.sessionToken);
+    xhr.setRequestHeader('Content-Type', 'application/json');
+    xhr.setRequestHeader('x-cic-automerge', 'none');
+    xhr.addEventListener('load', (e) => {
+      if (xhr.status === 401) {
+        throw new Error('login rejected');
+      }
+      this.sessionLoginCount++;
+      this.setState('click to perform login ' + this.sessionLoginCount + ' with token ' + this.sessionToken);
+      console.log('received', xhr.responseText);
+      return;
+    });
+    xhr.send();
+  }
+
+  sendResponse(hobaResponseEncoded): void {
+    const xhr = new XMLHttpRequest();
+    // xhr.responseType = 'arraybuffer';
+    xhr.responseType = 'text';
+    xhr.open('GET', origin + window.location.search.substring(1));
+    xhr.setRequestHeader('Authorization', 'HOBA ' + hobaResponseEncoded);
+    xhr.setRequestHeader('Content-Type', 'application/json');
+    xhr.setRequestHeader('x-cic-automerge', 'none');
+    xhr.addEventListener('load', (e) => {
+      if (xhr.status === 401) {
+        throw new Error('login rejected');
+      }
+      this.sessionToken = xhr.getResponseHeader('Token');
+      this.sessionLoginCount++;
+      this.setState('click to perform login ' + this.sessionLoginCount + ' with token ' + this.sessionToken);
+      console.log('received', xhr.responseText);
+      return;
+    });
+    xhr.send();
+  }
+
+  getChallenge(callback): void {
+    const xhr = new XMLHttpRequest();
+    xhr.responseType = 'arraybuffer';
+    xhr.open('GET', origin + window.location.search.substring(1));
+    xhr.onload = (e) => {
+      if (xhr.status === 401) {
+        const authHeader = xhr.getResponseHeader('WWW-Authenticate');
+        const o = hobaParseChallengeHeader(authHeader);
+        callback(o);
+      }
+    };
+    xhr.send();
+  }
+
+
+  login(): boolean {
+    if (this.sessionToken !== undefined) {
+      try {
+        this.getWithToken();
+        return true;
+      } catch (e) {
+        console.error('login token failed', e);
+      }
+    } else {
+      try {
+        const o = this.getChallenge(this.loginResponse);
+        return true;
+      } catch (e) {
+        console.error('login challenge failed', e);
+      }
+    }
+    return false;
+  }
+
+
+  async loginResponse(o): Promise<void> {
+    const r = await signChallenge(o.challenge, o.realm, origin, this.pgpKeyStore);
+    this.sendResponse(r);
+  }
+
+  loginView(): void {
+    document.getElementById('one').style.display = 'none';
+    document.getElementById('two').style.display = 'block';
+    this.setState('click to log in with PGP key ' + this.pgpKeyStore.keyId().toHex());
+  }
+
+  async setKey(privateKeyArmored): Promise<boolean> {
+    console.log('settings pk' + privateKeyArmored);
+    try {
+      await this.pgpKeyStore.set(privateKeyArmored);
+    } catch (e) {
+      console.error('failed setting key', e);
+      return false;
+    }
+    this.loginView();
+    return true;
+  }
+}
diff --git a/src/app/_services/index.ts b/src/app/_services/index.ts
new file mode 100644
index 0000000..2a719d1
--- /dev/null
+++ b/src/app/_services/index.ts
@@ -0,0 +1 @@
+export * from './auth.service';