diff --git a/Makefile b/Makefile
index 73b07ec..628d008 100644
--- a/Makefile
+++ b/Makefile
@@ -39,3 +39,6 @@ migrate-up:
 
 migrate-down:
 	migrate -database 'sqlite3://gralias.db' -path migrations down
+
+install-migrate:
+	go install -tags 'sqlite3' github.com/golang-migrate/migrate/v4/cmd/migrate@latest
diff --git a/gralias.db b/gralias.db
index 2c8a5e1..a48b678 100644
Binary files a/gralias.db and b/gralias.db differ
diff --git a/handlers/timer.go b/handlers/timer.go
index ed95a19..d16cd9e 100644
--- a/handlers/timer.go
+++ b/handlers/timer.go
@@ -21,15 +21,12 @@ var (
 func StartTurnTimer(roomID string, duration time.Duration) {
 	mu.Lock()
 	defer mu.Unlock()
-
 	if _, exists := timers[roomID]; exists {
 		return // Timer already running
 	}
-
 	ticker := time.NewTicker(1 * time.Second)
 	done := make(chan bool)
 	timers[roomID] = &roomTimer{ticker: ticker, done: done}
-
 	go func() {
 		for {
 			select {
diff --git a/migrations/001_initial_schema.up.sql b/migrations/001_initial_schema.up.sql
index d4080bc..a8d5ac1 100644
--- a/migrations/001_initial_schema.up.sql
+++ b/migrations/001_initial_schema.up.sql
@@ -20,7 +20,7 @@ CREATE TABLE rooms (
 CREATE TABLE players (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     room_id TEXT, -- nullable
-    username TEXT NOT NULL,
+    username TEXT NOT NULL UNIQUE,
     team TEXT NOT NULL DEFAULT '', -- 'red' or 'blue'
     role TEXT NOT NULL DEFAULT '', -- 'guesser' or 'mime'
     is_bot BOOLEAN NOT NULL DEFAULT FALSE,
@@ -67,3 +67,12 @@ CREATE TABLE settings (
     created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
     FOREIGN KEY (room_id) REFERENCES rooms(id)
 );
+
+CREATE TABLE sessions(
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    lifetime INTEGER NOT NULL DEFAULT 3600,
+    cookie_token TEXT NOT NULL DEFAULT '', -- encoded value
+    username TEXT NOT NULL,
+    FOREIGN KEY (username) REFERENCES players(username)
+);
diff --git a/models/auth.go b/models/auth.go
index 5dadf8a..0b6d83b 100644
--- a/models/auth.go
+++ b/models/auth.go
@@ -6,20 +6,25 @@ import (
 
 // each session contains the username of the user and the time at which it expires
 type Session struct {
-	Username    string
-	CurrentRoom string
-	Expiry      time.Time
+	ID uint32
+	// CurrentRoom string
+	// Expiry      time.Time
+	UpdatedAt   time.Time
+	Lifetime    uint32 // minutes
+	CookieToken string
+	Username    string // username is playerid
 }
 
 // we'll use this method later to determine if the session has expired
 func (s Session) IsExpired() bool {
-	return s.Expiry.Before(time.Now())
+	return time.Now().After(s.UpdatedAt.Add(time.Minute * time.Duration(s.Lifetime)))
+	// return s.Expiry.Before(time.Now())
 }
 
-func ListUsernames(ss map[string]*Session) []string {
-	resp := make([]string, 0, len(ss))
-	for _, s := range ss {
-		resp = append(resp, s.Username)
-	}
-	return resp
-}
+// func ListUsernames(ss map[string]*Session) []string {
+// 	resp := make([]string, 0, len(ss))
+// 	for _, s := range ss {
+// 		resp = append(resp, s.Username)
+// 	}
+// 	return resp
+// }
diff --git a/repos/session.go b/repos/session.go
new file mode 100644
index 0000000..f814da6
--- /dev/null
+++ b/repos/session.go
@@ -0,0 +1,9 @@
+package repos
+
+import "gralias/models"
+
+type SessionsRepo interface {
+	SessionByToken(token string) (*models.Session, error)
+	SessionCreate(req *models.Session) error
+	SessionUpdateLifetime(minutes uint32) error
+}