Replace token-based admin auth with JWT session authentication

- Add AdminUser model (bcrypt hashed passwords) and admin_users table
- Add AdminJWTService for HS256 JWT sessions (24h TTL)
- Add AdminSessionAuth middleware for /api/v1/admin/* routes
- Add admin handlers: login, logout, me, change-password, users CRUD
- Keys and model management routes now require admin JWT session
- Remove ADMIN_TOKEN, add ADMIN_USERNAME, ADMIN_PASSWORD env vars
- Update frontend: username/password login, admin_session storage, AdminUsers CRUD view

internal/api/handlers/admin/login.go

@@ -0,0 +1,71 @@
+package admin
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+
+	"github.com/llamalink/llamalink/internal/auth"
+	"github.com/llamalink/llamalink/internal/db"
+)
+
+type LoginHandler struct {
+	db         *gorm.DB
+	jwtService *auth.AdminJWTService
+}
+
+func NewLoginHandler(db *gorm.DB, jwtService *auth.AdminJWTService) *LoginHandler {
+	return &LoginHandler{db: db, jwtService: jwtService}
+}
+
+type LoginRequest struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required,min=8"`
+}
+
+func (h *LoginHandler) Login(c *gin.Context) {
+	var req LoginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": gin.H{"code": "validation_error", "message": "username and password are required (password min 8 chars)"}})
+		return
+	}
+
+	var user db.AdminUser
+	if err := h.db.Where("username = ?", req.Username).First(&user).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": gin.H{"code": "invalid_credentials", "message": "Invalid username or password"}})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": gin.H{"code": "internal_error", "message": "Internal server error"}})
+		return
+	}
+
+	if err := auth.ValidateAdminPassword(&user, req.Password); err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": gin.H{"code": "invalid_credentials", "message": "Invalid username or password"}})
+		return
+	}
+
+	token, expiresAt, err := h.jwtService.IssueToken(&user)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": gin.H{"code": "internal_error", "message": "Failed to issue session token"}})
+		return
+	}
+
+	h.db.Model(&user).Update("last_login_at", time.Now())
+
+	c.JSON(http.StatusOK, gin.H{
+		"token":      token,
+		"expires_at": expiresAt.Unix(),
+		"user": gin.H{
+			"id":        user.ID,
+			"username":  user.Username,
+			"is_active": user.IsActive,
+		},
+	})
+}
+
+func (h *LoginHandler) Logout(c *gin.Context) {
+	c.Status(http.StatusOK)
+}

internal/api/handlers/admin/me.go

@@ -0,0 +1,93 @@
+package admin
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/gorm"
+
+	"github.com/llamalink/llamalink/internal/api/middleware"
+	"github.com/llamalink/llamalink/internal/db"
+)
+
+type MeHandler struct {
+	db *gorm.DB
+}
+
+func NewMeHandler(db *gorm.DB) *MeHandler {
+	return &MeHandler{db: db}
+}
+
+func (h *MeHandler) Me(c *gin.Context) {
+	claims := middleware.GetAdminClaims(c)
+	if claims == nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": gin.H{"code": "unauthorized", "message": "Not authenticated"}})
+		return
+	}
+
+	var user db.AdminUser
+	if err := h.db.Where("username = ?", claims.Username).First(&user).Error; err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": gin.H{"code": "unauthorized", "message": "User not found"}})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"id":           user.ID,
+		"username":     user.Username,
+		"is_active":   user.IsActive,
+		"created_at":   user.CreatedAt,
+		"last_login_at": user.LastLoginAt,
+	})
+}
+
+type ChangePasswordRequest struct {
+	CurrentPassword string `json:"current_password" binding:"required"`
+	NewPassword     string `json:"new_password" binding:"required,min=8"`
+}
+
+func (h *MeHandler) ChangePassword(c *gin.Context) {
+	claims := middleware.GetAdminClaims(c)
+	if claims == nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": gin.H{"code": "unauthorized", "message": "Not authenticated"}})
+		return
+	}
+
+	var req ChangePasswordRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": gin.H{"code": "validation_error", "message": "current_password and new_password required (min 8 chars)"}})
+		return
+	}
+
+	userID, err := uuid.Parse(claims.Subject)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": gin.H{"code": "invalid_request", "message": "Invalid token claims"}})
+		return
+	}
+
+	var user db.AdminUser
+	if err := h.db.Where("id = ?", userID).First(&user).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": gin.H{"code": "not_found", "message": "User not found"}})
+		return
+	}
+
+	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.CurrentPassword)); err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": gin.H{"code": "invalid_credentials", "message": "Current password is incorrect"}})
+		return
+	}
+
+	newHash, err := bcrypt.GenerateFromPassword([]byte(req.NewPassword), bcrypt.DefaultCost)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": gin.H{"code": "internal_error", "message": "Failed to hash password"}})
+		return
+	}
+
+	h.db.Model(&user).Updates(map[string]interface{}{
+		"password_hash": string(newHash),
+		"updated_at":    time.Now(),
+	})
+
+	c.Status(http.StatusOK)
+}

internal/api/handlers/admin/users.go

@@ -0,0 +1,190 @@
+package admin
+
+import (
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/gorm"
+
+	"github.com/llamalink/llamalink/internal/api/middleware"
+	"github.com/llamalink/llamalink/internal/db"
+)
+
+type UsersHandler struct {
+	db *gorm.DB
+}
+
+func NewUsersHandler(db *gorm.DB) *UsersHandler {
+	return &UsersHandler{db: db}
+}
+
+type CreateUserRequest struct {
+	Username string `json:"username" binding:"required,min=3,max=64"`
+	Password string `json:"password" binding:"required,min=8"`
+}
+
+type UpdateUserRequest struct {
+	Password *string `json:"password"`
+	IsActive *bool   `json:"is_active"`
+}
+
+func (h *UsersHandler) List(c *gin.Context) {
+	var users []db.AdminUser
+	if err := h.db.Order("created_at DESC").Find(&users).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": gin.H{"code": "internal_error", "message": "Failed to list users"}})
+		return
+	}
+
+	result := make([]gin.H, len(users))
+	for i, u := range users {
+		result[i] = gin.H{
+			"id":            u.ID,
+			"username":      u.Username,
+			"is_active":    u.IsActive,
+			"created_at":   u.CreatedAt,
+			"last_login_at": u.LastLoginAt,
+		}
+	}
+	c.JSON(http.StatusOK, result)
+}
+
+func (h *UsersHandler) Create(c *gin.Context) {
+	claims := middleware.GetAdminClaims(c)
+	if claims == nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": gin.H{"code": "unauthorized", "message": "Not authenticated"}})
+		return
+	}
+
+	var req CreateUserRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": gin.H{"code": "validation_error", "message": "username (3-64 chars) and password (min 8 chars) required"}})
+		return
+	}
+
+	username := strings.ToLower(strings.TrimSpace(req.Username))
+
+	var count int64
+	h.db.Model(&db.AdminUser{}).Where("username = ?", username).Count(&count)
+	if count > 0 {
+		c.JSON(http.StatusConflict, gin.H{"error": gin.H{"code": "conflict", "message": "Username already exists"}})
+		return
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": gin.H{"code": "internal_error", "message": "Failed to hash password"}})
+		return
+	}
+
+	user := &db.AdminUser{
+		ID:           uuid.New(),
+		Username:     username,
+		PasswordHash: string(hash),
+		IsActive:     true,
+	}
+
+	if err := h.db.Create(user).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": gin.H{"code": "internal_error", "message": "Failed to create user"}})
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{
+		"id":         user.ID,
+		"username":   user.Username,
+		"is_active": user.IsActive,
+		"created_at": user.CreatedAt,
+	})
+}
+
+func (h *UsersHandler) Update(c *gin.Context) {
+	claims := middleware.GetAdminClaims(c)
+	if claims == nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": gin.H{"code": "unauthorized", "message": "Not authenticated"}})
+		return
+	}
+
+	idStr := c.Param("id")
+	id, err := uuid.Parse(idStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": gin.H{"code": "validation_error", "message": "Invalid user ID"}})
+		return
+	}
+
+	currentUser, _ := uuid.Parse(claims.Subject)
+	if currentUser == id {
+		c.JSON(http.StatusBadRequest, gin.H{"error": gin.H{"code": "validation_error", "message": "Cannot modify your own account via this endpoint"}})
+		return
+	}
+
+	var req UpdateUserRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": gin.H{"code": "validation_error", "message": "Invalid request body"}})
+		return
+	}
+
+	var user db.AdminUser
+	if err := h.db.Where("id = ?", id).First(&user).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": gin.H{"code": "not_found", "message": "User not found"}})
+		return
+	}
+
+	updates := map[string]interface{}{"updated_at": time.Now()}
+	if req.Password != nil && *req.Password != "" {
+		if len(*req.Password) < 8 {
+			c.JSON(http.StatusBadRequest, gin.H{"error": gin.H{"code": "validation_error", "message": "Password must be at least 8 characters"}})
+			return
+		}
+		hash, err := bcrypt.GenerateFromPassword([]byte(*req.Password), bcrypt.DefaultCost)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": gin.H{"code": "internal_error", "message": "Failed to hash password"}})
+			return
+		}
+		updates["password_hash"] = string(hash)
+	}
+	if req.IsActive != nil {
+		updates["is_active"] = *req.IsActive
+	}
+
+	h.db.Model(&user).Updates(updates)
+
+	c.JSON(http.StatusOK, gin.H{
+		"id":         user.ID,
+		"username":   user.Username,
+		"is_active": user.IsActive,
+		"updated_at": user.UpdatedAt,
+	})
+}
+
+func (h *UsersHandler) Delete(c *gin.Context) {
+	claims := middleware.GetAdminClaims(c)
+	if claims == nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": gin.H{"code": "unauthorized", "message": "Not authenticated"}})
+		return
+	}
+
+	idStr := c.Param("id")
+	id, err := uuid.Parse(idStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": gin.H{"code": "validation_error", "message": "Invalid user ID"}})
+		return
+	}
+
+	currentUser, _ := uuid.Parse(claims.Subject)
+	if currentUser == id {
+		c.JSON(http.StatusBadRequest, gin.H{"error": gin.H{"code": "validation_error", "message": "Cannot delete your own account"}})
+		return
+	}
+
+	var user db.AdminUser
+	if err := h.db.Where("id = ?", id).First(&user).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": gin.H{"code": "not_found", "message": "User not found"}})
+		return
+	}
+
+	h.db.Delete(&user)
+	c.Status(http.StatusNoContent)
+}

internal/api/handlers/keys.go

@@ -6,7 +6,6 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 
-	"github.com/llamalink/llamalink/internal/api/middleware"
 	"github.com/llamalink/llamalink/internal/auth"
 )
 
@@ -97,18 +96,6 @@ func (h *KeysHandler) RevokeKey(c *gin.Context) {
 		return
 	}
 
-	// Can't revoke own key
-	currentKey := middleware.GetAPIKey(c)
-	if currentKey.ID == id {
-		c.JSON(http.StatusBadRequest, gin.H{
-			"error": gin.H{
-				"code":    "validation_error",
-				"message": "Cannot revoke your own admin key",
-			},
-		})
-		return
-	}
-
 	if err := h.authService.Revoke(id); err != nil {
 		if err == auth.ErrKeyNotFound {
 			c.JSON(http.StatusNotFound, gin.H{"error": "key not found"})

internal/api/middleware/auth.go

@@ -14,6 +14,7 @@ import (
 const (
 	ApiKeyCtx   = "api_key"
 	ApiKeyIDCtx = "api_key_id"
+	AdminCtx    = "admin_user"
 )
 
 func APIKeyAuth(authService *auth.Service) gin.HandlerFunc {
@@ -142,6 +143,46 @@ func AdminTokenAuth(token string) gin.HandlerFunc {
 	}
 }
 
+func AdminSessionAuth(jwtService *auth.AdminJWTService) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		authHeader := c.GetHeader("Authorization")
+		if authHeader == "" {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
+				"error": gin.H{
+					"code":    "unauthorized",
+					"message": "Authorization header required",
+				},
+			})
+			return
+		}
+
+		token := strings.TrimPrefix(authHeader, "Bearer ")
+		if token == authHeader || strings.HasPrefix(token, auth.TokenPrefix) {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
+				"error": gin.H{
+					"code":    "unauthorized",
+					"message": "Admin session required",
+				},
+			})
+			return
+		}
+
+		claims, err := jwtService.VerifyToken(token)
+		if err != nil {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
+				"error": gin.H{
+					"code":    "unauthorized",
+					"message": "Invalid or expired session",
+				},
+			})
+			return
+		}
+
+		c.Set(AdminCtx, claims)
+		c.Next()
+	}
+}
+
 func GetAPIKeyID(c *gin.Context) uuid.UUID {
 	id, _ := c.Get(ApiKeyIDCtx)
 	return id.(uuid.UUID)
@@ -154,3 +195,11 @@ func GetAPIKey(c *gin.Context) *db.ApiKey {
 	}
 	return key.(*db.ApiKey)
 }
+
+func GetAdminClaims(c *gin.Context) *auth.AdminClaims {
+	claims, _ := c.Get(AdminCtx)
+	if claims == nil {
+		return nil
+	}
+	return claims.(*auth.AdminClaims)
+}

internal/api/router.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 	"github.com/llamalink/llamalink/internal/api/handlers"
+	"github.com/llamalink/llamalink/internal/api/handlers/admin"
 	"github.com/llamalink/llamalink/internal/api/middleware"
 	"github.com/llamalink/llamalink/internal/auth"
 	"github.com/llamalink/llamalink/internal/config"
@@ -30,6 +31,7 @@ func New(cfg *config.Config, db *gorm.DB, llamaManager *llama.Manager) *gin.Engi
 	quotaSvc := quota.NewService(db)
 	webhookSvc := quota.NewWebhookService(db)
 	proxy := llama.NewProxy(llamaManager)
+	adminJWTService := auth.NewAdminJWTService(cfg.JWTSecret, cfg.AdminSessionTTL)
 
 	// Initialize handlers
 	healthHandler := handlers.NewHealthHandler(db, llamaManager)
@@ -37,6 +39,9 @@ func New(cfg *config.Config, db *gorm.DB, llamaManager *llama.Manager) *gin.Engi
 	keysHandler := handlers.NewKeysHandler(authService)
 	modelsHandler := handlers.NewModelsHandler(llamaManager)
 	usageHandler := handlers.NewUsageHandler(db, quotaSvc)
+	adminLoginHandler := admin.NewLoginHandler(db, adminJWTService)
+	adminMeHandler := admin.NewMeHandler(db)
+	adminUsersHandler := admin.NewUsersHandler(db)
 
 	// Health endpoints (public)
 	r.GET("/health", healthHandler.Health)
@@ -50,10 +55,9 @@ func New(cfg *config.Config, db *gorm.DB, llamaManager *llama.Manager) *gin.Engi
 	chat.Use(middleware.APIKeyAuth(authService))
 	chat.POST("/completions", chatHandler.ChatCompletions)
 
-	// Keys management (admin only)
+	// Keys management (admin session required)
 	keys := v1.Group("/keys")
-	keys.Use(middleware.APIKeyAuth(authService))
-	keys.Use(middleware.AdminOnly())
+	keys.Use(middleware.AdminSessionAuth(adminJWTService))
 	keys.GET("", keysHandler.ListKeys)
 	keys.POST("", keysHandler.CreateKey)
 	keys.DELETE("/:id", keysHandler.RevokeKey)
@@ -66,10 +70,9 @@ func New(cfg *config.Config, db *gorm.DB, llamaManager *llama.Manager) *gin.Engi
 	models.GET("/active", modelsHandler.GetActiveModel)
 	models.GET("/:name", modelsHandler.GetActiveModel) // alias for compatibility
 
-	// Model load (admin only)
+	// Model load (admin session required)
 	modelLoad := v1.Group("/models")
-	modelLoad.Use(middleware.APIKeyAuth(authService))
-	modelLoad.Use(middleware.AdminOnly())
+	modelLoad.Use(middleware.AdminSessionAuth(adminJWTService))
 	modelLoad.POST("/:name/load", modelsHandler.LoadModel)
 
 	// Usage (requires API key auth)
@@ -110,5 +113,18 @@ func New(cfg *config.Config, db *gorm.DB, llamaManager *llama.Manager) *gin.Engi
 		c.Data(http.StatusOK, "text/html; charset=utf-8", index)
 	})
 
+	// Admin API v1 (JWT session auth)
+	adminV1 := v1.Group("/admin")
+	adminV1.POST("/login", adminLoginHandler.Login)
+	adminV1.POST("/logout", adminLoginHandler.Logout)
+	adminSession := adminV1.Group("")
+	adminSession.Use(middleware.AdminSessionAuth(adminJWTService))
+	adminSession.GET("/me", adminMeHandler.Me)
+	adminSession.POST("/change-password", adminMeHandler.ChangePassword)
+	adminSession.GET("/users", adminUsersHandler.List)
+	adminSession.POST("/users", adminUsersHandler.Create)
+	adminSession.PUT("/users/:id", adminUsersHandler.Update)
+	adminSession.DELETE("/users/:id", adminUsersHandler.Delete)
+
 	return r
 }

internal/auth/admin.go

@@ -0,0 +1,86 @@
+package auth
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"golang.org/x/crypto/bcrypt"
+
+	"github.com/llamalink/llamalink/internal/db"
+)
+
+var (
+	ErrInvalidAdminCredentials = errors.New("invalid username or password")
+	ErrAdminNotFound         = errors.New("admin user not found")
+	ErrAdminInactive         = errors.New("admin user is inactive")
+)
+
+type AdminClaims struct {
+	Username string `json:"username"`
+	jwt.RegisteredClaims
+}
+
+type AdminJWTService struct {
+	secret []byte
+	ttl    time.Duration
+}
+
+func NewAdminJWTService(secret []byte, ttlSeconds int) *AdminJWTService {
+	return &AdminJWTService{
+		secret: secret,
+		ttl:    time.Duration(ttlSeconds) * time.Second,
+	}
+}
+
+func (s *AdminJWTService) IssueToken(user *db.AdminUser) (string, time.Time, error) {
+	expiresAt := time.Now().Add(s.ttl)
+	claims := &AdminClaims{
+		Username: user.Username,
+		RegisteredClaims: jwt.RegisteredClaims{
+			Subject:   user.ID.String(),
+			ExpiresAt: jwt.NewNumericDate(expiresAt),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	tokenStr, err := token.SignedString(s.secret)
+	return tokenStr, expiresAt, err
+}
+
+func (s *AdminJWTService) VerifyToken(tokenStr string) (*AdminClaims, error) {
+	token, err := jwt.ParseWithClaims(tokenStr, &AdminClaims{}, func(token *jwt.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, errors.New("unexpected signing method")
+		}
+		return s.secret, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	claims, ok := token.Claims.(*AdminClaims)
+	if !ok || !token.Valid {
+		return nil, errors.New("invalid token")
+	}
+	return claims, nil
+}
+
+func ValidateAdminPassword(user *db.AdminUser, password string) error {
+	if !user.IsActive {
+		return ErrAdminInactive
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
+		return ErrInvalidAdminCredentials
+	}
+	return nil
+}
+
+func GenerateSecureToken(length int) (string, error) {
+	bytes := make([]byte, length)
+	if _, err := rand.Read(bytes); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(bytes), nil
+}

internal/config/config.go

@@ -33,7 +33,10 @@ type Config struct {
 	RateLimitStorage   string // "memory" or "redis"
 
 	// Auth
-	AdminToken string
+	AdminUsername string
+	AdminPassword string
+	JWTSecret    []byte
+	AdminSessionTTL int // seconds
 
 	// Logging
 	LogLevel  string
@@ -58,10 +61,19 @@ func Load() *Config {
 		ModelSwapCooldown:         intEnv("MODEL_SWAP_COOLDOWN", 2),
 		RateLimitPerMinute:        intEnv("RATE_LIMIT_PER_MINUTE", 60),
 		RateLimitStorage:          getEnv("RATE_LIMIT_STORAGE", "memory"),
-		AdminToken:                getEnv("ADMIN_TOKEN", "changeme"),
+		AdminUsername:             getEnv("ADMIN_USERNAME", "admin"),
+		AdminPassword:             getEnv("ADMIN_PASSWORD", ""),
+		AdminSessionTTL:           intEnv("ADMIN_SESSION_TTL", 86400),
 		LogLevel:                  getEnv("LOG_LEVEL", "info"),
 		LogFormat:                 getEnv("LOG_FORMAT", "json"),
 	}
+
+	secretKey := getEnv("LLAMALINK_SECRET_KEY", "change-me-in-production")
+	if secretKey == "change-me-in-production" {
+		slog.Warn("LLAMALINK_SECRET_KEY is using the default value — set a secure random string in production")
+	}
+	c.JWTSecret = []byte(secretKey)
+
 	return c
 }
 

internal/config/config_test.go

@@ -32,7 +32,8 @@ func TestLoad(t *testing.T) {
 func TestLoadEnvOverride(t *testing.T) {
 	t.Setenv("LLAMALINK_PORT", "9000")
 	t.Setenv("LLAMALINK_ENV", "production")
-	t.Setenv("ADMIN_TOKEN", "secret-token")
+	t.Setenv("ADMIN_USERNAME", "admin")
+	t.Setenv("ADMIN_PASSWORD", "secret-password")
 
 	cfg := Load()
 
@@ -44,8 +45,12 @@ func TestLoadEnvOverride(t *testing.T) {
 		t.Errorf("expected env production, got %s", cfg.LlamalinkEnv)
 	}
 
-	if cfg.AdminToken != "secret-token" {
-		t.Errorf("expected AdminToken secret-token, got %s", cfg.AdminToken)
+	if cfg.AdminUsername != "admin" {
+		t.Errorf("expected AdminUsername admin, got %s", cfg.AdminUsername)
+	}
+
+	if cfg.AdminPassword != "secret-password" {
+		t.Errorf("expected AdminPassword secret-password, got %s", cfg.AdminPassword)
 	}
 }
 

internal/db/models.go

@@ -27,6 +27,25 @@ func (a *StringArray) Scan(value interface{}) error {
 	return json.Unmarshal(b, a)
 }
 
+type AdminUser struct {
+	ID           uuid.UUID  `gorm:"type:uuid;primaryKey" json:"id"`
+	Username     string     `gorm:"size:64;uniqueIndex;not null" json:"username"`
+	PasswordHash string     `gorm:"size:255;not null" json:"-"`
+	IsActive     bool       `gorm:"default:true" json:"is_active"`
+	CreatedAt   time.Time  `json:"created_at"`
+	UpdatedAt   time.Time  `json:"updated_at"`
+	LastLoginAt *time.Time `json:"last_login_at,omitempty"`
+}
+
+func (AdminUser) TableName() string { return "admin_users" }
+
+func (u *AdminUser) BeforeCreate(tx *gorm.DB) error {
+	if u.ID == uuid.Nil {
+		u.ID = uuid.New()
+	}
+	return nil
+}
+
 type ApiKey struct {
 	ID          uuid.UUID  `gorm:"type:uuid;primaryKey" json:"id"`
 	Name        string     `gorm:"size:255;not null" json:"name"`

internal/db/seed.go

@@ -1,42 +1,59 @@
 package db
 
 import (
+	"crypto/rand"
+	"encoding/hex"
 	"log/slog"
+	"strings"
 
 	"golang.org/x/crypto/bcrypt"
 	"github.com/google/uuid"
 	"gorm.io/gorm"
 )
 
-func SeedAdminKey(db *gorm.DB, adminToken string) error {
-	var count int64
-	db.Model(&ApiKey{}).Count(&count)
+func generateRandomPassword(length int) (string, error) {
+	bytes := make([]byte, length)
+	if _, err := rand.Read(bytes); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(bytes)[:length], nil
+}
 
+func SeedAdminUser(db *gorm.DB, username, password string) error {
+	var count int64
+	db.Model(&AdminUser{}).Count(&count)
 	if count > 0 {
-		slog.Info("admin key already exists, skipping seed")
+		slog.Info("admin user already exists, skipping seed")
 		return nil
 	}
 
-	hash, err := bcrypt.GenerateFromPassword([]byte(adminToken), bcrypt.DefaultCost)
+	pwd := password
+	if pwd == "" {
+		var err error
+		pwd, err = generateRandomPassword(24)
+		if err != nil {
+			return err
+		}
+		slog.Warn("no ADMIN_PASSWORD set — generated random password (save this, it won't be shown again)")
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(pwd), bcrypt.DefaultCost)
 	if err != nil {
 		return err
 	}
 
-	admin := ApiKey{
-		ID:        uuid.New(),
-		Name:      "admin",
-		KeyHash:   string(hash),
-		KeyPrefix: "admin-",
-		Scopes:    StringArray{"chat", "models", "usage", "admin"},
-		IsActive:  true,
-		IsAdmin:   true,
+	admin := AdminUser{
+		ID:           uuid.New(),
+		Username:     strings.ToLower(username),
+		PasswordHash: string(hash),
+		IsActive:    true,
 	}
 
 	if err := db.Create(&admin).Error; err != nil {
 		return err
 	}
 
-	slog.Info("admin key seeded", "prefix", admin.KeyPrefix)
-	slog.Warn("ADMIN TOKEN: " + adminToken + " (save this!)")
+	slog.Info("admin user seeded", "username", admin.Username)
+	slog.Warn("ADMIN USER: username=" + username + " password=" + pwd + " (save this, it won't be shown again)")
 	return nil
 }