diff --git a/internal/photos/api/main.go b/internal/photos/api/main.go
index 7fb9933..e465f1d 100644
--- a/internal/photos/api/main.go
+++ b/internal/photos/api/main.go
@@ -2,11 +2,13 @@ package photosapi
 
 import (
 	"context"
+	"crypto/ed25519"
 	"errors"
 	"math/rand"
 	"net/http"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -19,13 +21,15 @@ var (
 )
 
 type Service struct {
-	Gin           *gin.Engine
-	DB            *gorm.DB
-	Config        *ServiceConfig
-	StorageTmp    *Storage
-	StorageUpload *Storage
-	LogOk         *Logger
-	LogErr        *Logger
+	Gin                  *gin.Engine
+	DB                   *gorm.DB
+	Config               *ServiceConfig
+	StorageTmp           *Storage
+	StorageUpload        *Storage
+	LogOk                *Logger
+	LogErr               *Logger
+	SessionKey           ed25519.PrivateKey
+	SessionKeyValidation ed25519.PublicKey
 }
 
 type ServiceConfig struct {
@@ -34,14 +38,34 @@ type ServiceConfig struct {
 	StorePath string
 }
 
+func GetOrGenerateKey(storePath string) ed25519.PrivateKey {
+	p := filepath.Join(storePath, "photo.key")
+	key, err := os.ReadFile(p)
+	if errors.Is(err, os.ErrNotExist) {
+		_, key, err = ed25519.GenerateKey(nil)
+		if err != nil {
+			panic(err)
+		}
+		err = os.WriteFile(p, key, 0600)
+		if err != nil {
+			panic(err)
+		}
+	}
+	return key
+}
+
 func New(config *ServiceConfig) *Service {
+	key := GetOrGenerateKey(config.StorePath)
+	pubKey := key.Public().(ed25519.PublicKey)
 	return &Service{
-		Gin:           gin.New(),
-		Config:        config,
-		StorageTmp:    NewStorage(config.StorePath, "tmp"),
-		StorageUpload: NewStorage(config.StorePath, "upload"),
-		LogOk:         &Logger{os.Stdout, "Photos"},
-		LogErr:        &Logger{os.Stderr, "Photos"},
+		Gin:                  gin.New(),
+		Config:               config,
+		StorageTmp:           NewStorage(config.StorePath, "tmp"),
+		StorageUpload:        NewStorage(config.StorePath, "upload"),
+		LogOk:                &Logger{os.Stdout, "Photos"},
+		LogErr:               &Logger{os.Stderr, "Photos"},
+		SessionKey:           key,
+		SessionKeyValidation: pubKey,
 	}
 }
 
@@ -78,7 +102,6 @@ func (s *Service) Run() error {
 	s.PrepareStore()
 	s.SetupRoutes()
 	s.SetupDB()
-	go s.SessionCleaner()
 
 	srv := &http.Server{
 		Addr:    s.Config.Listen,