@@ -3,17 +3,18 @@
 go 1.23.3
 
 require (
-	github.com/go-chi/chi/v5 v5.1.0
-	github.com/go-chi/cors v1.2.1
 	github.com/gocql/gocql v1.7.0
 	github.com/golang-jwt/jwt/v5 v5.2.1
 	github.com/joho/godotenv v1.5.1
+	github.com/twitchtv/twirp v8.1.3+incompatible
 	golang.org/x/crypto v0.27.0
+	google.golang.org/protobuf v1.36.0
 )
 
 require (
 	github.com/golang/snappy v0.0.3 // indirect
 	github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
 	github.com/kr/pretty v0.3.0 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 )

@@ -4,16 +4,14 @@ github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/go-chi/chi/v5 v5.1.0 h1:acVI1TYaD+hhedDJ3r54HyA6sExp3HfXq7QWEEY/xMw=
-github.com/go-chi/chi/v5 v5.1.0/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
-github.com/go-chi/cors v1.2.1 h1:xEC8UT3Rlp2QuWNEr4Fs/c2EAGVKBwy/1vHx3bppil4=
-github.com/go-chi/cors v1.2.1/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
 github.com/gocql/gocql v1.7.0 h1:O+7U7/1gSN7QTEAaMEsJc1Oq2QHXvCWoF3DFK9HDHus=
 github.com/gocql/gocql v1.7.0/go.mod h1:vnlvXyFZeLBF0Wy+RS8hrOdbn0UWsWtdg07XJnFxZ+4=
 github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
 github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/snappy v0.0.3 h1:fHPg5GQYlCeLIPB9BZqMVR5nR9A+IM5zcgeTdjMYmLA=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
@@ -25,13 +23,21 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rogpeppe/go-internal v1.6.1 h1:/FiVV8dS/e+YqF2JvO3yXRFbBLTIuSDkuC7aBOAvL+k=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/twitchtv/twirp v8.1.3+incompatible h1:+F4TdErPgSUbMZMwp13Q/KgDVuI7HJXP61mNV3/7iuU=
+github.com/twitchtv/twirp v8.1.3+incompatible/go.mod h1:RRJoFSAmTEh2weEqWtpPE3vFK5YBhA6bqp2l1kfCC5A=
 golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
 golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
+google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=

@@ -0,0 +1,153 @@
+package apikeys
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	"argus-core/internal/auth"
+	"argus-core/internal/database"
+	pb "argus-core/rpc/apikeys"
+
+	"github.com/gocql/gocql"
+	"github.com/twitchtv/twirp"
+)
+
+// TwirpServer implements the generated Twirp APIKeysService interface
+type TwirpServer struct {
+	authService auth.Service
+	db          database.Service
+}
+
+// NewTwirpServer creates a new Twirp server wrapper around the existing services
+func NewTwirpServer(authService auth.Service, db database.Service) pb.APIKeysService {
+	return &TwirpServer{authService: authService, db: db}
+}
+
+// CreateAPIKey implements the Twirp APIKeysService CreateAPIKey method
+func (s *TwirpServer) CreateAPIKey(ctx context.Context, req *pb.CreateAPIKeyRequest) (*pb.CreateAPIKeyResponse, error) {
+	userID, err := s.authorize(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var expiresAt *time.Time
+	if req.ExpiresAt != "" {
+		t, err := time.Parse(time.RFC3339, req.ExpiresAt)
+		if err != nil {
+			return nil, twirp.NewError(twirp.InvalidArgument, "invalid expiration date format")
+		}
+		expiresAt = &t
+	}
+
+	apiKey, keyString, err := s.authService.CreateAPIKey(userID, req.Name, expiresAt)
+	if err != nil {
+		return nil, twirp.InternalErrorWith(err)
+	}
+
+	return &pb.CreateAPIKeyResponse{
+		ApiKey: &pb.APIKey{
+			Id:         apiKey.ID.String(),
+			UserId:     apiKey.UserID.String(),
+			Name:       apiKey.Name,
+			CreatedAt:  apiKey.CreatedAt.Format(time.RFC3339),
+			LastUsedAt: apiKey.LastUsedAt.Format(time.RFC3339),
+			ExpiresAt:  apiKey.ExpiresAt.Format(time.RFC3339),
+			IsActive:   apiKey.IsActive,
+		},
+		Key: keyString,
+	}, nil
+}
+
+// ListAPIKeys implements the Twirp APIKeysService ListAPIKeys method
+func (s *TwirpServer) ListAPIKeys(ctx context.Context, req *pb.ListAPIKeysRequest) (*pb.ListAPIKeysResponse, error) {
+	userID, err := s.authorize(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	apiKeys, err := s.authService.ListAPIKeys(userID)
+	if err != nil {
+		return nil, twirp.InternalErrorWith(err)
+	}
+
+	var pbAPIKeys []*pb.APIKey
+	for _, apiKey := range apiKeys {
+		pbAPIKeys = append(pbAPIKeys, &pb.APIKey{
+			Id:         apiKey.ID.String(),
+			UserId:     apiKey.UserID.String(),
+			Name:       apiKey.Name,
+			CreatedAt:  apiKey.CreatedAt.Format(time.RFC3339),
+			LastUsedAt: apiKey.LastUsedAt.Format(time.RFC3339),
+			ExpiresAt:  apiKey.ExpiresAt.Format(time.RFC3339),
+			IsActive:   apiKey.IsActive,
+		})
+	}
+
+	return &pb.ListAPIKeysResponse{ApiKeys: pbAPIKeys}, nil
+}
+
+// RevokeAPIKey implements the Twirp APIKeysService RevokeAPIKey method
+func (s *TwirpServer) RevokeAPIKey(ctx context.Context, req *pb.RevokeAPIKeyRequest) (*pb.RevokeAPIKeyResponse, error) {
+	userID, err := s.authorize(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	keyID, err := gocql.ParseUUID(req.KeyId)
+	if err != nil {
+		return nil, twirp.NewError(twirp.InvalidArgument, "invalid key ID")
+	}
+
+	err = s.authService.RevokeAPIKey(userID, keyID)
+	if err != nil {
+		return nil, twirp.InternalErrorWith(err)
+	}
+
+	return &pb.RevokeAPIKeyResponse{}, nil
+}
+
+// DeleteAPIKey implements the Twirp APIKeysService DeleteAPIKey method
+func (s *TwirpServer) DeleteAPIKey(ctx context.Context, req *pb.DeleteAPIKeyRequest) (*pb.DeleteAPIKeyResponse, error) {
+	userID, err := s.authorize(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	keyID, err := gocql.ParseUUID(req.KeyId)
+	if err != nil {
+		return nil, twirp.NewError(twirp.InvalidArgument, "invalid key ID")
+	}
+
+	err = s.authService.DeleteAPIKey(userID, keyID)
+	if err != nil {
+		return nil, twirp.InternalErrorWith(err)
+	}
+
+	return &pb.DeleteAPIKeyResponse{}, nil
+}
+
+// authorize checks the authorization token and returns the user ID
+func (s *TwirpServer) authorize(ctx context.Context) (gocql.UUID, error) {
+	headers, ok := twirp.HTTPRequestHeaders(ctx)
+	if !ok {
+		return gocql.UUID{}, twirp.NewError(twirp.Unauthenticated, "missing authorization token")
+	}
+
+	authHeader := headers.Get("Authorization")
+	if authHeader == "" {
+		return gocql.UUID{}, twirp.NewError(twirp.Unauthenticated, "missing authorization token")
+	}
+
+	token := strings.TrimPrefix(authHeader, "Bearer ")
+	if token == authHeader {
+		return gocql.UUID{}, twirp.NewError(twirp.Unauthenticated, "invalid authorization token format")
+	}
+
+	user, err := s.authService.ValidateToken(token)
+	if err != nil {
+		return gocql.UUID{}, twirp.NewError(twirp.Unauthenticated, "invalid token")
+	}
+
+	return user.ID, nil
+}

@@ -0,0 +1,114 @@
+package auth
+
+import (
+	"context"
+	"time"
+
+	pb "argus-core/rpc/auth"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/twitchtv/twirp"
+)
+
+// TwirpServer implements the generated Twirp AuthService interface
+type TwirpServer struct {
+	auth Service // existing auth service
+}
+
+// NewTwirpServer creates a new Twirp server wrapper around the existing auth service
+func NewTwirpServer(auth Service) pb.AuthService {
+	return &TwirpServer{auth: auth}
+}
+
+// Register implements the Twirp AuthService Register method
+func (s *TwirpServer) Register(ctx context.Context, req *pb.RegisterRequest) (*pb.RegisterResponse, error) {
+	if req.Email == "" || req.Password == "" {
+		return nil, twirp.NewError(twirp.InvalidArgument, "email and password are required")
+	}
+
+	user, err := s.auth.Register(req.Email, req.Password)
+	if err != nil {
+		if err == ErrUserExists {
+			return nil, twirp.NewError(twirp.AlreadyExists, "user already exists")
+		}
+		return nil, twirp.InternalErrorWith(err)
+	}
+
+	return &pb.RegisterResponse{
+		User: &pb.User{
+			Id:        user.ID.String(),
+			Email:     user.Email,
+			CreatedAt: user.CreatedAt.Format(time.RFC3339),
+			UpdatedAt: user.UpdatedAt.Format(time.RFC3339),
+		},
+	}, nil
+}
+
+// Login implements the Twirp AuthService Login method
+func (s *TwirpServer) Login(ctx context.Context, req *pb.LoginRequest) (*pb.LoginResponse, error) {
+	if req.Email == "" || req.Password == "" {
+		return nil, twirp.NewError(twirp.InvalidArgument, "email and password are required")
+	}
+
+	token, user, err := s.auth.Login(req.Email, req.Password)
+	if err != nil {
+		if err == ErrInvalidCredentials {
+			return nil, twirp.NewError(twirp.Unauthenticated, "invalid credentials")
+		}
+		return nil, twirp.InternalErrorWith(err)
+	}
+
+	return &pb.LoginResponse{
+		Token: token,
+		User: &pb.User{
+			Id:        user.ID.String(),
+			Email:     user.Email,
+			CreatedAt: user.CreatedAt.Format(time.RFC3339),
+			UpdatedAt: user.UpdatedAt.Format(time.RFC3339),
+		},
+	}, nil
+}
+
+// ValidateToken implements the Twirp AuthService ValidateToken method
+func (s *TwirpServer) ValidateToken(ctx context.Context, req *pb.ValidateTokenRequest) (*pb.ValidateTokenResponse, error) {
+	if req.Token == "" {
+		return nil, twirp.NewError(twirp.InvalidArgument, "token is required")
+	}
+
+	// Parse token to check expiration first
+	token, err := jwt.Parse(req.Token, func(token *jwt.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, twirp.NewError(twirp.Unauthenticated, "invalid token signing method")
+		}
+		return s.auth.(*service).jwtSecret, nil // Note: This requires the secret to be accessible
+	})
+
+	if err != nil {
+		if err.Error() == "Token is expired" {
+			return nil, twirp.NewError(twirp.Unauthenticated, "token has expired")
+		}
+		return nil, twirp.NewError(twirp.Unauthenticated, "invalid token")
+	}
+
+	if !token.Valid {
+		return nil, twirp.NewError(twirp.Unauthenticated, "invalid token")
+	}
+
+	// Now use the service's ValidateToken which will get the user
+	user, err := s.auth.ValidateToken(req.Token)
+	if err != nil {
+		if err == ErrInvalidToken {
+			return nil, twirp.NewError(twirp.Unauthenticated, "invalid token")
+		}
+		return nil, twirp.InternalErrorWith(err)
+	}
+
+	return &pb.ValidateTokenResponse{
+		User: &pb.User{
+			Id:        user.ID.String(),
+			Email:     user.Email,
+			CreatedAt: user.CreatedAt.Format(time.RFC3339),
+			UpdatedAt: user.UpdatedAt.Format(time.RFC3339),
+		},
+	}, nil
+}

@@ -1,212 +0,0 @@
-package server
-
-import (
-	"context"
-	"encoding/json"
-	"log"
-	"net/http"
-
-	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
-	"github.com/go-chi/cors"
-	"github.com/gocql/gocql"
-
-	"argus-core/internal/auth"
-)
-
-func (s *Server) RegisterRoutes() http.Handler {
-	r := chi.NewRouter()
-	r.Use(middleware.Logger)
-
-	r.Use(cors.Handler(cors.Options{
-		AllowedOrigins:   []string{"https://*", "http://*"},
-		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"},
-		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type"},
-		AllowCredentials: false,
-		MaxAge:           300,
-	}))
-
-	r.Get("/", s.HelloWorldHandler)
-	r.Get("/health", s.healthHandler)
-
-	// Auth routes
-	r.Post("/auth/register", s.handleRegister)
-	r.Post("/auth/login", s.handleLogin)
-
-	// Protected routes
-	r.Group(func(r chi.Router) {
-		r.Use(s.authMiddleware)
-		r.Get("/auth/me", s.handleGetCurrentUser)
-		r.Post("/api-keys", s.handleCreateAPIKey)
-		r.Get("/api-keys", s.handleListAPIKeys)
-		r.Delete("/api-keys/{keyID}", s.handleDeleteAPIKey)
-		r.Post("/api-keys/{keyID}/revoke", s.handleRevokeAPIKey)
-	})
-
-	return r
-}
-
-func (s *Server) HelloWorldHandler(w http.ResponseWriter, r *http.Request) {
-	resp := make(map[string]string)
-	resp["message"] = "Hello World"
-
-	jsonResp, err := json.Marshal(resp)
-	if err != nil {
-		log.Fatalf("error handling JSON marshal. Err: %v", err)
-	}
-
-	_, _ = w.Write(jsonResp)
-}
-
-func (s *Server) healthHandler(w http.ResponseWriter, r *http.Request) {
-	jsonResp, _ := json.Marshal(s.db.Health())
-	_, _ = w.Write(jsonResp)
-}
-
-func (s *Server) handleRegister(w http.ResponseWriter, r *http.Request) {
-	var req auth.RegisterRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		s.respondWithError(w, http.StatusBadRequest, "Invalid request payload")
-		return
-	}
-
-	user, err := s.auth.Register(req.Email, req.Password)
-	if err != nil {
-		s.respondWithError(w, http.StatusInternalServerError, "Failed to register user")
-		return
-	}
-
-	s.respondWithJSON(w, http.StatusCreated, user)
-}
-
-func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
-	var req auth.LoginRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		s.respondWithError(w, http.StatusBadRequest, "Invalid request payload")
-		return
-	}
-
-	token, user, err := s.auth.Login(req.Email, req.Password)
-	if err != nil {
-		s.respondWithError(w, http.StatusUnauthorized, "Invalid credentials")
-		return
-	}
-
-	s.respondWithJSON(w, http.StatusOK, map[string]interface{}{
-		"token": token,
-		"user":  user,
-	})
-}
-
-func (s *Server) handleGetCurrentUser(w http.ResponseWriter, r *http.Request) {
-	// Get user ID from context (set by authMiddleware)
-	userID := r.Context().Value("userID").(gocql.UUID)
-
-	user, err := s.db.GetUserByID(userID)
-	if err != nil {
-		s.respondWithError(w, http.StatusInternalServerError, "Failed to get user details")
-		return
-	}
-
-	s.respondWithJSON(w, http.StatusOK, user)
-}
-
-func (s *Server) handleCreateAPIKey(w http.ResponseWriter, r *http.Request) {
-	var req auth.CreateAPIKeyRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		s.respondWithError(w, http.StatusBadRequest, "Invalid request payload")
-		return
-	}
-
-	userID := r.Context().Value("userID").(gocql.UUID)
-	apiKey, keyString, err := s.auth.CreateAPIKey(userID, req.Name, req.ExpiresAt)
-	if err != nil {
-		s.respondWithError(w, http.StatusInternalServerError, "Failed to create API key")
-		return
-	}
-
-	s.respondWithJSON(w, http.StatusCreated, map[string]interface{}{
-		"api_key": apiKey,
-		"key":     keyString,
-	})
-}
-
-func (s *Server) handleListAPIKeys(w http.ResponseWriter, r *http.Request) {
-	userID := r.Context().Value("userID").(gocql.UUID)
-	apiKeys, err := s.auth.ListAPIKeys(userID)
-	if err != nil {
-		s.respondWithError(w, http.StatusInternalServerError, "Failed to list API keys")
-		return
-	}
-
-	s.respondWithJSON(w, http.StatusOK, apiKeys)
-}
-
-func (s *Server) handleRevokeAPIKey(w http.ResponseWriter, r *http.Request) {
-	userID := r.Context().Value("userID").(gocql.UUID)
-	keyID, err := gocql.ParseUUID(chi.URLParam(r, "keyID"))
-	if err != nil {
-		s.respondWithError(w, http.StatusBadRequest, "Invalid key ID")
-		return
-	}
-
-	if err := s.auth.RevokeAPIKey(userID, keyID); err != nil {
-		s.respondWithError(w, http.StatusInternalServerError, "Failed to revoke API key")
-		return
-	}
-
-	w.WriteHeader(http.StatusNoContent)
-}
-
-func (s *Server) handleDeleteAPIKey(w http.ResponseWriter, r *http.Request) {
-	userID := r.Context().Value("userID").(gocql.UUID)
-	keyID, err := gocql.ParseUUID(chi.URLParam(r, "keyID"))
-	if err != nil {
-		s.respondWithError(w, http.StatusBadRequest, "Invalid key ID")
-		return
-	}
-
-	if err := s.auth.DeleteAPIKey(userID, keyID); err != nil {
-		s.respondWithError(w, http.StatusInternalServerError, "Failed to delete API key")
-		return
-	}
-
-	w.WriteHeader(http.StatusNoContent)
-}
-
-func (s *Server) authMiddleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		authHeader := r.Header.Get("Authorization")
-		if authHeader == "" {
-			s.respondWithError(w, http.StatusUnauthorized, "No authorization header")
-			return
-		}
-
-		user, err := s.auth.ValidateToken(authHeader)
-		if err != nil {
-			s.respondWithError(w, http.StatusUnauthorized, "Invalid token")
-			return
-		}
-
-		// Add user ID to context
-		ctx := context.WithValue(r.Context(), "userID", user.ID)
-		next.ServeHTTP(w, r.WithContext(ctx))
-	})
-}
-
-func (s *Server) respondWithError(w http.ResponseWriter, code int, message string) {
-	s.respondWithJSON(w, code, map[string]string{"error": message})
-}
-
-func (s *Server) respondWithJSON(w http.ResponseWriter, code int, payload interface{}) {
-	response, err := json.Marshal(payload)
-	if err != nil {
-		w.WriteHeader(http.StatusInternalServerError)
-		w.Write([]byte(`{"error":"Failed to marshal JSON response"}`))
-		return
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(code)
-	w.Write(response)
-}

@@ -9,17 +9,38 @@ "time"
 
 	_ "github.com/joho/godotenv/autoload"
 
+	"argus-core/internal/apikeys"
 	"argus-core/internal/auth"
 	"argus-core/internal/database"
+	apikeyspb "argus-core/rpc/apikeys"
+	authpb "argus-core/rpc/auth"
 )
 
 type Server struct {
 	port int
-
 	db   database.Service
 	auth auth.Service
 }
 
+// CORSMiddleware wraps a handler with CORS support
+func CORSMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Set CORS headers
+		w.Header().Set("Access-Control-Allow-Origin", "*") // In production, replace * with your frontend domain
+		w.Header().Set("Access-Control-Allow-Methods", "POST, GET, OPTIONS, PUT, DELETE")
+		w.Header().Set("Access-Control-Allow-Headers", "Accept, Content-Type, Content-Length, Accept-Encoding, Authorization")
+
+		// Handle preflight requests
+		if r.Method == "OPTIONS" {
+			w.WriteHeader(http.StatusOK)
+			return
+		}
+
+		// Call the next handler
+		next.ServeHTTP(w, r)
+	})
+}
+
 func NewServer() *http.Server {
 	port, _ := strconv.Atoi(os.Getenv("PORT"))
 
@@ -32,16 +53,22 @@ JWTSecret:     os.Getenv("JWT_SECRET"),
 		TokenDuration: 24 * time.Hour,
 	})
 
-	NewServer := &Server{
-		port: port,
-		db:   db,
-		auth: authService,
-	}
+	// Create Twirp Server handlers
+	authHandler := authpb.NewAuthServiceServer(auth.NewTwirpServer(authService))
+	apiKeysHandler := apikeyspb.NewAPIKeysServiceServer(apikeys.NewTwirpServer(authService, db))
+
+	// Combine handlers
+	mux := http.NewServeMux()
+	mux.Handle(authpb.AuthServicePathPrefix, authHandler)
+	mux.Handle(apikeyspb.APIKeysServicePathPrefix, apiKeysHandler)
+
+	// Wrap the mux with CORS middleware
+	handler := CORSMiddleware(mux)
 
 	// Declare Server config
 	server := &http.Server{
-		Addr:         fmt.Sprintf(":%d", NewServer.port),
-		Handler:      NewServer.RegisterRoutes(),
+		Addr:         fmt.Sprintf(":%d", port),
+		Handler:      handler,
 		IdleTimeout:  time.Minute,
 		ReadTimeout:  10 * time.Second,
 		WriteTimeout: 30 * time.Second,

@@ -0,0 +1,599 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.35.2
+// 	protoc        v5.29.1
+// source: rpc/apikeys/service.proto
+
+package apikeys
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Request and Response messages
+type CreateAPIKeyRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name      string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	ExpiresAt string `protobuf:"bytes,2,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"` // optional expiration date in RFC3339 format
+}
+
+func (x *CreateAPIKeyRequest) Reset() {
+	*x = CreateAPIKeyRequest{}
+	mi := &file_rpc_apikeys_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateAPIKeyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateAPIKeyRequest) ProtoMessage() {}
+
+func (x *CreateAPIKeyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_apikeys_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateAPIKeyRequest.ProtoReflect.Descriptor instead.
+func (*CreateAPIKeyRequest) Descriptor() ([]byte, []int) {
+	return file_rpc_apikeys_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CreateAPIKeyRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *CreateAPIKeyRequest) GetExpiresAt() string {
+	if x != nil {
+		return x.ExpiresAt
+	}
+	return ""
+}
+
+type CreateAPIKeyResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ApiKey *APIKey `protobuf:"bytes,1,opt,name=api_key,json=apiKey,proto3" json:"api_key,omitempty"`
+	Key    string  `protobuf:"bytes,2,opt,name=key,proto3" json:"key,omitempty"` // the actual API key string
+}
+
+func (x *CreateAPIKeyResponse) Reset() {
+	*x = CreateAPIKeyResponse{}
+	mi := &file_rpc_apikeys_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateAPIKeyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateAPIKeyResponse) ProtoMessage() {}
+
+func (x *CreateAPIKeyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_apikeys_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateAPIKeyResponse.ProtoReflect.Descriptor instead.
+func (*CreateAPIKeyResponse) Descriptor() ([]byte, []int) {
+	return file_rpc_apikeys_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CreateAPIKeyResponse) GetApiKey() *APIKey {
+	if x != nil {
+		return x.ApiKey
+	}
+	return nil
+}
+
+func (x *CreateAPIKeyResponse) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+type ListAPIKeysRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *ListAPIKeysRequest) Reset() {
+	*x = ListAPIKeysRequest{}
+	mi := &file_rpc_apikeys_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListAPIKeysRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAPIKeysRequest) ProtoMessage() {}
+
+func (x *ListAPIKeysRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_apikeys_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAPIKeysRequest.ProtoReflect.Descriptor instead.
+func (*ListAPIKeysRequest) Descriptor() ([]byte, []int) {
+	return file_rpc_apikeys_service_proto_rawDescGZIP(), []int{2}
+}
+
+type ListAPIKeysResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ApiKeys []*APIKey `protobuf:"bytes,1,rep,name=api_keys,json=apiKeys,proto3" json:"api_keys,omitempty"`
+}
+
+func (x *ListAPIKeysResponse) Reset() {
+	*x = ListAPIKeysResponse{}
+	mi := &file_rpc_apikeys_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListAPIKeysResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAPIKeysResponse) ProtoMessage() {}
+
+func (x *ListAPIKeysResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_apikeys_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAPIKeysResponse.ProtoReflect.Descriptor instead.
+func (*ListAPIKeysResponse) Descriptor() ([]byte, []int) {
+	return file_rpc_apikeys_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ListAPIKeysResponse) GetApiKeys() []*APIKey {
+	if x != nil {
+		return x.ApiKeys
+	}
+	return nil
+}
+
+type RevokeAPIKeyRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	KeyId string `protobuf:"bytes,1,opt,name=key_id,json=keyId,proto3" json:"key_id,omitempty"`
+}
+
+func (x *RevokeAPIKeyRequest) Reset() {
+	*x = RevokeAPIKeyRequest{}
+	mi := &file_rpc_apikeys_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RevokeAPIKeyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RevokeAPIKeyRequest) ProtoMessage() {}
+
+func (x *RevokeAPIKeyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_apikeys_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RevokeAPIKeyRequest.ProtoReflect.Descriptor instead.
+func (*RevokeAPIKeyRequest) Descriptor() ([]byte, []int) {
+	return file_rpc_apikeys_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *RevokeAPIKeyRequest) GetKeyId() string {
+	if x != nil {
+		return x.KeyId
+	}
+	return ""
+}
+
+type RevokeAPIKeyResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *RevokeAPIKeyResponse) Reset() {
+	*x = RevokeAPIKeyResponse{}
+	mi := &file_rpc_apikeys_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RevokeAPIKeyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RevokeAPIKeyResponse) ProtoMessage() {}
+
+func (x *RevokeAPIKeyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_apikeys_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RevokeAPIKeyResponse.ProtoReflect.Descriptor instead.
+func (*RevokeAPIKeyResponse) Descriptor() ([]byte, []int) {
+	return file_rpc_apikeys_service_proto_rawDescGZIP(), []int{5}
+}
+
+type DeleteAPIKeyRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	KeyId string `protobuf:"bytes,1,opt,name=key_id,json=keyId,proto3" json:"key_id,omitempty"`
+}
+
+func (x *DeleteAPIKeyRequest) Reset() {
+	*x = DeleteAPIKeyRequest{}
+	mi := &file_rpc_apikeys_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteAPIKeyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteAPIKeyRequest) ProtoMessage() {}
+
+func (x *DeleteAPIKeyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_apikeys_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteAPIKeyRequest.ProtoReflect.Descriptor instead.
+func (*DeleteAPIKeyRequest) Descriptor() ([]byte, []int) {
+	return file_rpc_apikeys_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *DeleteAPIKeyRequest) GetKeyId() string {
+	if x != nil {
+		return x.KeyId
+	}
+	return ""
+}
+
+type DeleteAPIKeyResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *DeleteAPIKeyResponse) Reset() {
+	*x = DeleteAPIKeyResponse{}
+	mi := &file_rpc_apikeys_service_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteAPIKeyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteAPIKeyResponse) ProtoMessage() {}
+
+func (x *DeleteAPIKeyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_apikeys_service_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteAPIKeyResponse.ProtoReflect.Descriptor instead.
+func (*DeleteAPIKeyResponse) Descriptor() ([]byte, []int) {
+	return file_rpc_apikeys_service_proto_rawDescGZIP(), []int{7}
+}
+
+// Common messages
+type APIKey struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id         string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	UserId     string `protobuf:"bytes,2,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	Name       string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
+	CreatedAt  string `protobuf:"bytes,4,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	LastUsedAt string `protobuf:"bytes,5,opt,name=last_used_at,json=lastUsedAt,proto3" json:"last_used_at,omitempty"`
+	ExpiresAt  string `protobuf:"bytes,6,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"`
+	IsActive   bool   `protobuf:"varint,7,opt,name=is_active,json=isActive,proto3" json:"is_active,omitempty"`
+}
+
+func (x *APIKey) Reset() {
+	*x = APIKey{}
+	mi := &file_rpc_apikeys_service_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *APIKey) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*APIKey) ProtoMessage() {}
+
+func (x *APIKey) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_apikeys_service_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use APIKey.ProtoReflect.Descriptor instead.
+func (*APIKey) Descriptor() ([]byte, []int) {
+	return file_rpc_apikeys_service_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *APIKey) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *APIKey) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+func (x *APIKey) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *APIKey) GetCreatedAt() string {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return ""
+}
+
+func (x *APIKey) GetLastUsedAt() string {
+	if x != nil {
+		return x.LastUsedAt
+	}
+	return ""
+}
+
+func (x *APIKey) GetExpiresAt() string {
+	if x != nil {
+		return x.ExpiresAt
+	}
+	return ""
+}
+
+func (x *APIKey) GetIsActive() bool {
+	if x != nil {
+		return x.IsActive
+	}
+	return false
+}
+
+var File_rpc_apikeys_service_proto protoreflect.FileDescriptor
+
+var file_rpc_apikeys_service_proto_rawDesc = []byte{
+	0x0a, 0x19, 0x72, 0x70, 0x63, 0x2f, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x73, 0x2f, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x07, 0x61, 0x70, 0x69,
+	0x6b, 0x65, 0x79, 0x73, 0x22, 0x48, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x50,
+	0x49, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x1d, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x61, 0x74, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x22, 0x52,
+	0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x28, 0x0a, 0x07, 0x61, 0x70, 0x69, 0x5f, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79,
+	0x73, 0x2e, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x52, 0x06, 0x61, 0x70, 0x69, 0x4b, 0x65, 0x79,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x22, 0x14, 0x0a, 0x12, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x41, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74,
+	0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x2a, 0x0a, 0x08, 0x61, 0x70, 0x69, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x0f, 0x2e, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x73, 0x2e, 0x41, 0x50, 0x49, 0x4b,
+	0x65, 0x79, 0x52, 0x07, 0x61, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x73, 0x22, 0x2c, 0x0a, 0x13, 0x52,
+	0x65, 0x76, 0x6f, 0x6b, 0x65, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, 0x22, 0x16, 0x0a, 0x14, 0x52, 0x65, 0x76,
+	0x6f, 0x6b, 0x65, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x2c, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x50, 0x49, 0x4b, 0x65,
+	0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, 0x22,
+	0x16, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xc2, 0x01, 0x0a, 0x06, 0x41, 0x50, 0x49, 0x4b,
+	0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
+	0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x1d, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x20,
+	0x0a, 0x0c, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x75, 0x73, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6c, 0x61, 0x73, 0x74, 0x55, 0x73, 0x65, 0x64, 0x41, 0x74,
+	0x12, 0x1d, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x61, 0x74, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x12,
+	0x1b, 0x0a, 0x09, 0x69, 0x73, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x18, 0x07, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x08, 0x69, 0x73, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x32, 0xc1, 0x02, 0x0a,
+	0x0e, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x73, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12,
+	0x4b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x12,
+	0x1c, 0x2e, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e,
+	0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x50,
+	0x49, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x48, 0x0a, 0x0b,
+	0x4c, 0x69, 0x73, 0x74, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x1b, 0x2e, 0x61, 0x70,
+	0x69, 0x6b, 0x65, 0x79, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x6b, 0x65,
+	0x79, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4b, 0x0a, 0x0c, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65,
+	0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x73,
+	0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x73, 0x2e, 0x52,
+	0x65, 0x76, 0x6f, 0x6b, 0x65, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x4b, 0x0a, 0x0c, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x50, 0x49,
+	0x4b, 0x65, 0x79, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x73, 0x2e, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x41, 0x50, 0x49, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x42, 0x18, 0x5a, 0x16, 0x61, 0x72, 0x67, 0x75, 0x73, 0x2d, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x72,
+	0x70, 0x63, 0x2f, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
+}
+
+var (
+	file_rpc_apikeys_service_proto_rawDescOnce sync.Once
+	file_rpc_apikeys_service_proto_rawDescData = file_rpc_apikeys_service_proto_rawDesc
+)
+
+func file_rpc_apikeys_service_proto_rawDescGZIP() []byte {
+	file_rpc_apikeys_service_proto_rawDescOnce.Do(func() {
+		file_rpc_apikeys_service_proto_rawDescData = protoimpl.X.CompressGZIP(file_rpc_apikeys_service_proto_rawDescData)
+	})
+	return file_rpc_apikeys_service_proto_rawDescData
+}
+
+var file_rpc_apikeys_service_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_rpc_apikeys_service_proto_goTypes = []any{
+	(*CreateAPIKeyRequest)(nil),  // 0: apikeys.CreateAPIKeyRequest
+	(*CreateAPIKeyResponse)(nil), // 1: apikeys.CreateAPIKeyResponse
+	(*ListAPIKeysRequest)(nil),   // 2: apikeys.ListAPIKeysRequest
+	(*ListAPIKeysResponse)(nil),  // 3: apikeys.ListAPIKeysResponse
+	(*RevokeAPIKeyRequest)(nil),  // 4: apikeys.RevokeAPIKeyRequest
+	(*RevokeAPIKeyResponse)(nil), // 5: apikeys.RevokeAPIKeyResponse
+	(*DeleteAPIKeyRequest)(nil),  // 6: apikeys.DeleteAPIKeyRequest
+	(*DeleteAPIKeyResponse)(nil), // 7: apikeys.DeleteAPIKeyResponse
+	(*APIKey)(nil),               // 8: apikeys.APIKey
+}
+var file_rpc_apikeys_service_proto_depIdxs = []int32{
+	8, // 0: apikeys.CreateAPIKeyResponse.api_key:type_name -> apikeys.APIKey
+	8, // 1: apikeys.ListAPIKeysResponse.api_keys:type_name -> apikeys.APIKey
+	0, // 2: apikeys.APIKeysService.CreateAPIKey:input_type -> apikeys.CreateAPIKeyRequest
+	2, // 3: apikeys.APIKeysService.ListAPIKeys:input_type -> apikeys.ListAPIKeysRequest
+	4, // 4: apikeys.APIKeysService.RevokeAPIKey:input_type -> apikeys.RevokeAPIKeyRequest
+	6, // 5: apikeys.APIKeysService.DeleteAPIKey:input_type -> apikeys.DeleteAPIKeyRequest
+	1, // 6: apikeys.APIKeysService.CreateAPIKey:output_type -> apikeys.CreateAPIKeyResponse
+	3, // 7: apikeys.APIKeysService.ListAPIKeys:output_type -> apikeys.ListAPIKeysResponse
+	5, // 8: apikeys.APIKeysService.RevokeAPIKey:output_type -> apikeys.RevokeAPIKeyResponse
+	7, // 9: apikeys.APIKeysService.DeleteAPIKey:output_type -> apikeys.DeleteAPIKeyResponse
+	6, // [6:10] is the sub-list for method output_type
+	2, // [2:6] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_rpc_apikeys_service_proto_init() }
+func file_rpc_apikeys_service_proto_init() {
+	if File_rpc_apikeys_service_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_rpc_apikeys_service_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   9,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_rpc_apikeys_service_proto_goTypes,
+		DependencyIndexes: file_rpc_apikeys_service_proto_depIdxs,
+		MessageInfos:      file_rpc_apikeys_service_proto_msgTypes,
+	}.Build()
+	File_rpc_apikeys_service_proto = out.File
+	file_rpc_apikeys_service_proto_rawDesc = nil
+	file_rpc_apikeys_service_proto_goTypes = nil
+	file_rpc_apikeys_service_proto_depIdxs = nil
+}

@@ -0,0 +1,59 @@
+syntax = "proto3";
+
+package apikeys;
+option go_package = "argus-core/rpc/apikeys";
+
+// APIKeys service handles API key creation, listing, revocation, and deletion.
+service APIKeysService {
+  // CreateAPIKey creates a new API key for the authenticated user.
+  rpc CreateAPIKey(CreateAPIKeyRequest) returns (CreateAPIKeyResponse);
+
+  // ListAPIKeys lists all API keys for the authenticated user.
+  rpc ListAPIKeys(ListAPIKeysRequest) returns (ListAPIKeysResponse);
+
+  // RevokeAPIKey revokes an API key for the authenticated user.
+  rpc RevokeAPIKey(RevokeAPIKeyRequest) returns (RevokeAPIKeyResponse);
+
+  // DeleteAPIKey deletes an API key for the authenticated user.
+  rpc DeleteAPIKey(DeleteAPIKeyRequest) returns (DeleteAPIKeyResponse);
+}
+
+// Request and Response messages
+message CreateAPIKeyRequest {
+  string name = 1;
+  string expires_at = 2; // optional expiration date in RFC3339 format
+}
+
+message CreateAPIKeyResponse {
+  APIKey api_key = 1;
+  string key = 2; // the actual API key string
+}
+
+message ListAPIKeysRequest {}
+
+message ListAPIKeysResponse {
+  repeated APIKey api_keys = 1;
+}
+
+message RevokeAPIKeyRequest {
+  string key_id = 1;
+}
+
+message RevokeAPIKeyResponse {}
+
+message DeleteAPIKeyRequest {
+  string key_id = 1;
+}
+
+message DeleteAPIKeyResponse {}
+
+// Common messages
+message APIKey {
+  string id = 1;
+  string user_id = 2;
+  string name = 3;
+  string created_at = 4;
+  string last_used_at = 5;
+  string expires_at = 6;
+  bool is_active = 7;
+}

@@ -0,0 +1,1960 @@
+// Code generated by protoc-gen-twirp v8.1.3, DO NOT EDIT.
+// source: rpc/apikeys/service.proto
+
+package apikeys
+
+import context "context"
+import fmt "fmt"
+import http "net/http"
+import io "io"
+import json "encoding/json"
+import strconv "strconv"
+import strings "strings"
+
+import protojson "google.golang.org/protobuf/encoding/protojson"
+import proto "google.golang.org/protobuf/proto"
+import twirp "github.com/twitchtv/twirp"
+import ctxsetters "github.com/twitchtv/twirp/ctxsetters"
+
+import bytes "bytes"
+import errors "errors"
+import path "path"
+import url "net/url"
+
+// Version compatibility assertion.
+// If the constant is not defined in the package, that likely means
+// the package needs to be updated to work with this generated code.
+// See https://twitchtv.github.io/twirp/docs/version_matrix.html
+const _ = twirp.TwirpPackageMinVersion_8_1_0
+
+// ========================
+// APIKeysService Interface
+// ========================
+
+// APIKeys service handles API key creation, listing, revocation, and deletion.
+type APIKeysService interface {
+	// CreateAPIKey creates a new API key for the authenticated user.
+	CreateAPIKey(context.Context, *CreateAPIKeyRequest) (*CreateAPIKeyResponse, error)
+
+	// ListAPIKeys lists all API keys for the authenticated user.
+	ListAPIKeys(context.Context, *ListAPIKeysRequest) (*ListAPIKeysResponse, error)
+
+	// RevokeAPIKey revokes an API key for the authenticated user.
+	RevokeAPIKey(context.Context, *RevokeAPIKeyRequest) (*RevokeAPIKeyResponse, error)
+
+	// DeleteAPIKey deletes an API key for the authenticated user.
+	DeleteAPIKey(context.Context, *DeleteAPIKeyRequest) (*DeleteAPIKeyResponse, error)
+}
+
+// ==============================
+// APIKeysService Protobuf Client
+// ==============================
+
+type aPIKeysServiceProtobufClient struct {
+	client      HTTPClient
+	urls        [4]string
+	interceptor twirp.Interceptor
+	opts        twirp.ClientOptions
+}
+
+// NewAPIKeysServiceProtobufClient creates a Protobuf client that implements the APIKeysService interface.
+// It communicates using Protobuf and can be configured with a custom HTTPClient.
+func NewAPIKeysServiceProtobufClient(baseURL string, client HTTPClient, opts ...twirp.ClientOption) APIKeysService {
+	if c, ok := client.(*http.Client); ok {
+		client = withoutRedirects(c)
+	}
+
+	clientOpts := twirp.ClientOptions{}
+	for _, o := range opts {
+		o(&clientOpts)
+	}
+
+	// Using ReadOpt allows backwards and forwards compatibility with new options in the future
+	literalURLs := false
+	_ = clientOpts.ReadOpt("literalURLs", &literalURLs)
+	var pathPrefix string
+	if ok := clientOpts.ReadOpt("pathPrefix", &pathPrefix); !ok {
+		pathPrefix = "/twirp" // default prefix
+	}
+
+	// Build method URLs: <baseURL>[<prefix>]/<package>.<Service>/<Method>
+	serviceURL := sanitizeBaseURL(baseURL)
+	serviceURL += baseServicePath(pathPrefix, "apikeys", "APIKeysService")
+	urls := [4]string{
+		serviceURL + "CreateAPIKey",
+		serviceURL + "ListAPIKeys",
+		serviceURL + "RevokeAPIKey",
+		serviceURL + "DeleteAPIKey",
+	}
+
+	return &aPIKeysServiceProtobufClient{
+		client:      client,
+		urls:        urls,
+		interceptor: twirp.ChainInterceptors(clientOpts.Interceptors...),
+		opts:        clientOpts,
+	}
+}
+
+func (c *aPIKeysServiceProtobufClient) CreateAPIKey(ctx context.Context, in *CreateAPIKeyRequest) (*CreateAPIKeyResponse, error) {
+	ctx = ctxsetters.WithPackageName(ctx, "apikeys")
+	ctx = ctxsetters.WithServiceName(ctx, "APIKeysService")
+	ctx = ctxsetters.WithMethodName(ctx, "CreateAPIKey")
+	caller := c.callCreateAPIKey
+	if c.interceptor != nil {
+		caller = func(ctx context.Context, req *CreateAPIKeyRequest) (*CreateAPIKeyResponse, error) {
+			resp, err := c.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*CreateAPIKeyRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*CreateAPIKeyRequest) when calling interceptor")
+					}
+					return c.callCreateAPIKey(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*CreateAPIKeyResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*CreateAPIKeyResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+	return caller(ctx, in)
+}
+
+func (c *aPIKeysServiceProtobufClient) callCreateAPIKey(ctx context.Context, in *CreateAPIKeyRequest) (*CreateAPIKeyResponse, error) {
+	out := new(CreateAPIKeyResponse)
+	ctx, err := doProtobufRequest(ctx, c.client, c.opts.Hooks, c.urls[0], in, out)
+	if err != nil {
+		twerr, ok := err.(twirp.Error)
+		if !ok {
+			twerr = twirp.InternalErrorWith(err)
+		}
+		callClientError(ctx, c.opts.Hooks, twerr)
+		return nil, err
+	}
+
+	callClientResponseReceived(ctx, c.opts.Hooks)
+
+	return out, nil
+}
+
+func (c *aPIKeysServiceProtobufClient) ListAPIKeys(ctx context.Context, in *ListAPIKeysRequest) (*ListAPIKeysResponse, error) {
+	ctx = ctxsetters.WithPackageName(ctx, "apikeys")
+	ctx = ctxsetters.WithServiceName(ctx, "APIKeysService")
+	ctx = ctxsetters.WithMethodName(ctx, "ListAPIKeys")
+	caller := c.callListAPIKeys
+	if c.interceptor != nil {
+		caller = func(ctx context.Context, req *ListAPIKeysRequest) (*ListAPIKeysResponse, error) {
+			resp, err := c.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*ListAPIKeysRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*ListAPIKeysRequest) when calling interceptor")
+					}
+					return c.callListAPIKeys(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*ListAPIKeysResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*ListAPIKeysResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+	return caller(ctx, in)
+}
+
+func (c *aPIKeysServiceProtobufClient) callListAPIKeys(ctx context.Context, in *ListAPIKeysRequest) (*ListAPIKeysResponse, error) {
+	out := new(ListAPIKeysResponse)
+	ctx, err := doProtobufRequest(ctx, c.client, c.opts.Hooks, c.urls[1], in, out)
+	if err != nil {
+		twerr, ok := err.(twirp.Error)
+		if !ok {
+			twerr = twirp.InternalErrorWith(err)
+		}
+		callClientError(ctx, c.opts.Hooks, twerr)
+		return nil, err
+	}
+
+	callClientResponseReceived(ctx, c.opts.Hooks)
+
+	return out, nil
+}
+
+func (c *aPIKeysServiceProtobufClient) RevokeAPIKey(ctx context.Context, in *RevokeAPIKeyRequest) (*RevokeAPIKeyResponse, error) {
+	ctx = ctxsetters.WithPackageName(ctx, "apikeys")
+	ctx = ctxsetters.WithServiceName(ctx, "APIKeysService")
+	ctx = ctxsetters.WithMethodName(ctx, "RevokeAPIKey")
+	caller := c.callRevokeAPIKey
+	if c.interceptor != nil {
+		caller = func(ctx context.Context, req *RevokeAPIKeyRequest) (*RevokeAPIKeyResponse, error) {
+			resp, err := c.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*RevokeAPIKeyRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*RevokeAPIKeyRequest) when calling interceptor")
+					}
+					return c.callRevokeAPIKey(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*RevokeAPIKeyResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*RevokeAPIKeyResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+	return caller(ctx, in)
+}
+
+func (c *aPIKeysServiceProtobufClient) callRevokeAPIKey(ctx context.Context, in *RevokeAPIKeyRequest) (*RevokeAPIKeyResponse, error) {
+	out := new(RevokeAPIKeyResponse)
+	ctx, err := doProtobufRequest(ctx, c.client, c.opts.Hooks, c.urls[2], in, out)
+	if err != nil {
+		twerr, ok := err.(twirp.Error)
+		if !ok {
+			twerr = twirp.InternalErrorWith(err)
+		}
+		callClientError(ctx, c.opts.Hooks, twerr)
+		return nil, err
+	}
+
+	callClientResponseReceived(ctx, c.opts.Hooks)
+
+	return out, nil
+}
+
+func (c *aPIKeysServiceProtobufClient) DeleteAPIKey(ctx context.Context, in *DeleteAPIKeyRequest) (*DeleteAPIKeyResponse, error) {
+	ctx = ctxsetters.WithPackageName(ctx, "apikeys")
+	ctx = ctxsetters.WithServiceName(ctx, "APIKeysService")
+	ctx = ctxsetters.WithMethodName(ctx, "DeleteAPIKey")
+	caller := c.callDeleteAPIKey
+	if c.interceptor != nil {
+		caller = func(ctx context.Context, req *DeleteAPIKeyRequest) (*DeleteAPIKeyResponse, error) {
+			resp, err := c.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*DeleteAPIKeyRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*DeleteAPIKeyRequest) when calling interceptor")
+					}
+					return c.callDeleteAPIKey(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*DeleteAPIKeyResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*DeleteAPIKeyResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+	return caller(ctx, in)
+}
+
+func (c *aPIKeysServiceProtobufClient) callDeleteAPIKey(ctx context.Context, in *DeleteAPIKeyRequest) (*DeleteAPIKeyResponse, error) {
+	out := new(DeleteAPIKeyResponse)
+	ctx, err := doProtobufRequest(ctx, c.client, c.opts.Hooks, c.urls[3], in, out)
+	if err != nil {
+		twerr, ok := err.(twirp.Error)
+		if !ok {
+			twerr = twirp.InternalErrorWith(err)
+		}
+		callClientError(ctx, c.opts.Hooks, twerr)
+		return nil, err
+	}
+
+	callClientResponseReceived(ctx, c.opts.Hooks)
+
+	return out, nil
+}
+
+// ==========================
+// APIKeysService JSON Client
+// ==========================
+
+type aPIKeysServiceJSONClient struct {
+	client      HTTPClient
+	urls        [4]string
+	interceptor twirp.Interceptor
+	opts        twirp.ClientOptions
+}
+
+// NewAPIKeysServiceJSONClient creates a JSON client that implements the APIKeysService interface.
+// It communicates using JSON and can be configured with a custom HTTPClient.
+func NewAPIKeysServiceJSONClient(baseURL string, client HTTPClient, opts ...twirp.ClientOption) APIKeysService {
+	if c, ok := client.(*http.Client); ok {
+		client = withoutRedirects(c)
+	}
+
+	clientOpts := twirp.ClientOptions{}
+	for _, o := range opts {
+		o(&clientOpts)
+	}
+
+	// Using ReadOpt allows backwards and forwards compatibility with new options in the future
+	literalURLs := false
+	_ = clientOpts.ReadOpt("literalURLs", &literalURLs)
+	var pathPrefix string
+	if ok := clientOpts.ReadOpt("pathPrefix", &pathPrefix); !ok {
+		pathPrefix = "/twirp" // default prefix
+	}
+
+	// Build method URLs: <baseURL>[<prefix>]/<package>.<Service>/<Method>
+	serviceURL := sanitizeBaseURL(baseURL)
+	serviceURL += baseServicePath(pathPrefix, "apikeys", "APIKeysService")
+	urls := [4]string{
+		serviceURL + "CreateAPIKey",
+		serviceURL + "ListAPIKeys",
+		serviceURL + "RevokeAPIKey",
+		serviceURL + "DeleteAPIKey",
+	}
+
+	return &aPIKeysServiceJSONClient{
+		client:      client,
+		urls:        urls,
+		interceptor: twirp.ChainInterceptors(clientOpts.Interceptors...),
+		opts:        clientOpts,
+	}
+}
+
+func (c *aPIKeysServiceJSONClient) CreateAPIKey(ctx context.Context, in *CreateAPIKeyRequest) (*CreateAPIKeyResponse, error) {
+	ctx = ctxsetters.WithPackageName(ctx, "apikeys")
+	ctx = ctxsetters.WithServiceName(ctx, "APIKeysService")
+	ctx = ctxsetters.WithMethodName(ctx, "CreateAPIKey")
+	caller := c.callCreateAPIKey
+	if c.interceptor != nil {
+		caller = func(ctx context.Context, req *CreateAPIKeyRequest) (*CreateAPIKeyResponse, error) {
+			resp, err := c.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*CreateAPIKeyRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*CreateAPIKeyRequest) when calling interceptor")
+					}
+					return c.callCreateAPIKey(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*CreateAPIKeyResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*CreateAPIKeyResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+	return caller(ctx, in)
+}
+
+func (c *aPIKeysServiceJSONClient) callCreateAPIKey(ctx context.Context, in *CreateAPIKeyRequest) (*CreateAPIKeyResponse, error) {
+	out := new(CreateAPIKeyResponse)
+	ctx, err := doJSONRequest(ctx, c.client, c.opts.Hooks, c.urls[0], in, out)
+	if err != nil {
+		twerr, ok := err.(twirp.Error)
+		if !ok {
+			twerr = twirp.InternalErrorWith(err)
+		}
+		callClientError(ctx, c.opts.Hooks, twerr)
+		return nil, err
+	}
+
+	callClientResponseReceived(ctx, c.opts.Hooks)
+
+	return out, nil
+}
+
+func (c *aPIKeysServiceJSONClient) ListAPIKeys(ctx context.Context, in *ListAPIKeysRequest) (*ListAPIKeysResponse, error) {
+	ctx = ctxsetters.WithPackageName(ctx, "apikeys")
+	ctx = ctxsetters.WithServiceName(ctx, "APIKeysService")
+	ctx = ctxsetters.WithMethodName(ctx, "ListAPIKeys")
+	caller := c.callListAPIKeys
+	if c.interceptor != nil {
+		caller = func(ctx context.Context, req *ListAPIKeysRequest) (*ListAPIKeysResponse, error) {
+			resp, err := c.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*ListAPIKeysRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*ListAPIKeysRequest) when calling interceptor")
+					}
+					return c.callListAPIKeys(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*ListAPIKeysResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*ListAPIKeysResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+	return caller(ctx, in)
+}
+
+func (c *aPIKeysServiceJSONClient) callListAPIKeys(ctx context.Context, in *ListAPIKeysRequest) (*ListAPIKeysResponse, error) {
+	out := new(ListAPIKeysResponse)
+	ctx, err := doJSONRequest(ctx, c.client, c.opts.Hooks, c.urls[1], in, out)
+	if err != nil {
+		twerr, ok := err.(twirp.Error)
+		if !ok {
+			twerr = twirp.InternalErrorWith(err)
+		}
+		callClientError(ctx, c.opts.Hooks, twerr)
+		return nil, err
+	}
+
+	callClientResponseReceived(ctx, c.opts.Hooks)
+
+	return out, nil
+}
+
+func (c *aPIKeysServiceJSONClient) RevokeAPIKey(ctx context.Context, in *RevokeAPIKeyRequest) (*RevokeAPIKeyResponse, error) {
+	ctx = ctxsetters.WithPackageName(ctx, "apikeys")
+	ctx = ctxsetters.WithServiceName(ctx, "APIKeysService")
+	ctx = ctxsetters.WithMethodName(ctx, "RevokeAPIKey")
+	caller := c.callRevokeAPIKey
+	if c.interceptor != nil {
+		caller = func(ctx context.Context, req *RevokeAPIKeyRequest) (*RevokeAPIKeyResponse, error) {
+			resp, err := c.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*RevokeAPIKeyRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*RevokeAPIKeyRequest) when calling interceptor")
+					}
+					return c.callRevokeAPIKey(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*RevokeAPIKeyResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*RevokeAPIKeyResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+	return caller(ctx, in)
+}
+
+func (c *aPIKeysServiceJSONClient) callRevokeAPIKey(ctx context.Context, in *RevokeAPIKeyRequest) (*RevokeAPIKeyResponse, error) {
+	out := new(RevokeAPIKeyResponse)
+	ctx, err := doJSONRequest(ctx, c.client, c.opts.Hooks, c.urls[2], in, out)
+	if err != nil {
+		twerr, ok := err.(twirp.Error)
+		if !ok {
+			twerr = twirp.InternalErrorWith(err)
+		}
+		callClientError(ctx, c.opts.Hooks, twerr)
+		return nil, err
+	}
+
+	callClientResponseReceived(ctx, c.opts.Hooks)
+
+	return out, nil
+}
+
+func (c *aPIKeysServiceJSONClient) DeleteAPIKey(ctx context.Context, in *DeleteAPIKeyRequest) (*DeleteAPIKeyResponse, error) {
+	ctx = ctxsetters.WithPackageName(ctx, "apikeys")
+	ctx = ctxsetters.WithServiceName(ctx, "APIKeysService")
+	ctx = ctxsetters.WithMethodName(ctx, "DeleteAPIKey")
+	caller := c.callDeleteAPIKey
+	if c.interceptor != nil {
+		caller = func(ctx context.Context, req *DeleteAPIKeyRequest) (*DeleteAPIKeyResponse, error) {
+			resp, err := c.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*DeleteAPIKeyRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*DeleteAPIKeyRequest) when calling interceptor")
+					}
+					return c.callDeleteAPIKey(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*DeleteAPIKeyResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*DeleteAPIKeyResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+	return caller(ctx, in)
+}
+
+func (c *aPIKeysServiceJSONClient) callDeleteAPIKey(ctx context.Context, in *DeleteAPIKeyRequest) (*DeleteAPIKeyResponse, error) {
+	out := new(DeleteAPIKeyResponse)
+	ctx, err := doJSONRequest(ctx, c.client, c.opts.Hooks, c.urls[3], in, out)
+	if err != nil {
+		twerr, ok := err.(twirp.Error)
+		if !ok {
+			twerr = twirp.InternalErrorWith(err)
+		}
+		callClientError(ctx, c.opts.Hooks, twerr)
+		return nil, err
+	}
+
+	callClientResponseReceived(ctx, c.opts.Hooks)
+
+	return out, nil
+}
+
+// =============================
+// APIKeysService Server Handler
+// =============================
+
+type aPIKeysServiceServer struct {
+	APIKeysService
+	interceptor      twirp.Interceptor
+	hooks            *twirp.ServerHooks
+	pathPrefix       string // prefix for routing
+	jsonSkipDefaults bool   // do not include unpopulated fields (default values) in the response
+	jsonCamelCase    bool   // JSON fields are serialized as lowerCamelCase rather than keeping the original proto names
+}
+
+// NewAPIKeysServiceServer builds a TwirpServer that can be used as an http.Handler to handle
+// HTTP requests that are routed to the right method in the provided svc implementation.
+// The opts are twirp.ServerOption modifiers, for example twirp.WithServerHooks(hooks).
+func NewAPIKeysServiceServer(svc APIKeysService, opts ...interface{}) TwirpServer {
+	serverOpts := newServerOpts(opts)
+
+	// Using ReadOpt allows backwards and forwards compatibility with new options in the future
+	jsonSkipDefaults := false
+	_ = serverOpts.ReadOpt("jsonSkipDefaults", &jsonSkipDefaults)
+	jsonCamelCase := false
+	_ = serverOpts.ReadOpt("jsonCamelCase", &jsonCamelCase)
+	var pathPrefix string
+	if ok := serverOpts.ReadOpt("pathPrefix", &pathPrefix); !ok {
+		pathPrefix = "/twirp" // default prefix
+	}
+
+	return &aPIKeysServiceServer{
+		APIKeysService:   svc,
+		hooks:            serverOpts.Hooks,
+		interceptor:      twirp.ChainInterceptors(serverOpts.Interceptors...),
+		pathPrefix:       pathPrefix,
+		jsonSkipDefaults: jsonSkipDefaults,
+		jsonCamelCase:    jsonCamelCase,
+	}
+}
+
+// writeError writes an HTTP response with a valid Twirp error format, and triggers hooks.
+// If err is not a twirp.Error, it will get wrapped with twirp.InternalErrorWith(err)
+func (s *aPIKeysServiceServer) writeError(ctx context.Context, resp http.ResponseWriter, err error) {
+	writeError(ctx, resp, err, s.hooks)
+}
+
+// handleRequestBodyError is used to handle error when the twirp server cannot read request
+func (s *aPIKeysServiceServer) handleRequestBodyError(ctx context.Context, resp http.ResponseWriter, msg string, err error) {
+	if context.Canceled == ctx.Err() {
+		s.writeError(ctx, resp, twirp.NewError(twirp.Canceled, "failed to read request: context canceled"))
+		return
+	}
+	if context.DeadlineExceeded == ctx.Err() {
+		s.writeError(ctx, resp, twirp.NewError(twirp.DeadlineExceeded, "failed to read request: deadline exceeded"))
+		return
+	}
+	s.writeError(ctx, resp, twirp.WrapError(malformedRequestError(msg), err))
+}
+
+// APIKeysServicePathPrefix is a convenience constant that may identify URL paths.
+// Should be used with caution, it only matches routes generated by Twirp Go clients,
+// with the default "/twirp" prefix and default CamelCase service and method names.
+// More info: https://twitchtv.github.io/twirp/docs/routing.html
+const APIKeysServicePathPrefix = "/twirp/apikeys.APIKeysService/"
+
+func (s *aPIKeysServiceServer) ServeHTTP(resp http.ResponseWriter, req *http.Request) {
+	ctx := req.Context()
+	ctx = ctxsetters.WithPackageName(ctx, "apikeys")
+	ctx = ctxsetters.WithServiceName(ctx, "APIKeysService")
+	ctx = ctxsetters.WithResponseWriter(ctx, resp)
+
+	var err error
+	ctx, err = callRequestReceived(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	if req.Method != "POST" {
+		msg := fmt.Sprintf("unsupported method %q (only POST is allowed)", req.Method)
+		s.writeError(ctx, resp, badRouteError(msg, req.Method, req.URL.Path))
+		return
+	}
+
+	// Verify path format: [<prefix>]/<package>.<Service>/<Method>
+	prefix, pkgService, method := parseTwirpPath(req.URL.Path)
+	if pkgService != "apikeys.APIKeysService" {
+		msg := fmt.Sprintf("no handler for path %q", req.URL.Path)
+		s.writeError(ctx, resp, badRouteError(msg, req.Method, req.URL.Path))
+		return
+	}
+	if prefix != s.pathPrefix {
+		msg := fmt.Sprintf("invalid path prefix %q, expected %q, on path %q", prefix, s.pathPrefix, req.URL.Path)
+		s.writeError(ctx, resp, badRouteError(msg, req.Method, req.URL.Path))
+		return
+	}
+
+	switch method {
+	case "CreateAPIKey":
+		s.serveCreateAPIKey(ctx, resp, req)
+		return
+	case "ListAPIKeys":
+		s.serveListAPIKeys(ctx, resp, req)
+		return
+	case "RevokeAPIKey":
+		s.serveRevokeAPIKey(ctx, resp, req)
+		return
+	case "DeleteAPIKey":
+		s.serveDeleteAPIKey(ctx, resp, req)
+		return
+	default:
+		msg := fmt.Sprintf("no handler for path %q", req.URL.Path)
+		s.writeError(ctx, resp, badRouteError(msg, req.Method, req.URL.Path))
+		return
+	}
+}
+
+func (s *aPIKeysServiceServer) serveCreateAPIKey(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	header := req.Header.Get("Content-Type")
+	i := strings.Index(header, ";")
+	if i == -1 {
+		i = len(header)
+	}
+	switch strings.TrimSpace(strings.ToLower(header[:i])) {
+	case "application/json":
+		s.serveCreateAPIKeyJSON(ctx, resp, req)
+	case "application/protobuf":
+		s.serveCreateAPIKeyProtobuf(ctx, resp, req)
+	default:
+		msg := fmt.Sprintf("unexpected Content-Type: %q", req.Header.Get("Content-Type"))
+		twerr := badRouteError(msg, req.Method, req.URL.Path)
+		s.writeError(ctx, resp, twerr)
+	}
+}
+
+func (s *aPIKeysServiceServer) serveCreateAPIKeyJSON(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	var err error
+	ctx = ctxsetters.WithMethodName(ctx, "CreateAPIKey")
+	ctx, err = callRequestRouted(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	d := json.NewDecoder(req.Body)
+	rawReqBody := json.RawMessage{}
+	if err := d.Decode(&rawReqBody); err != nil {
+		s.handleRequestBodyError(ctx, resp, "the json request could not be decoded", err)
+		return
+	}
+	reqContent := new(CreateAPIKeyRequest)
+	unmarshaler := protojson.UnmarshalOptions{DiscardUnknown: true}
+	if err = unmarshaler.Unmarshal(rawReqBody, reqContent); err != nil {
+		s.handleRequestBodyError(ctx, resp, "the json request could not be decoded", err)
+		return
+	}
+
+	handler := s.APIKeysService.CreateAPIKey
+	if s.interceptor != nil {
+		handler = func(ctx context.Context, req *CreateAPIKeyRequest) (*CreateAPIKeyResponse, error) {
+			resp, err := s.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*CreateAPIKeyRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*CreateAPIKeyRequest) when calling interceptor")
+					}
+					return s.APIKeysService.CreateAPIKey(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*CreateAPIKeyResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*CreateAPIKeyResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+
+	// Call service method
+	var respContent *CreateAPIKeyResponse
+	func() {
+		defer ensurePanicResponses(ctx, resp, s.hooks)
+		respContent, err = handler(ctx, reqContent)
+	}()
+
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+	if respContent == nil {
+		s.writeError(ctx, resp, twirp.InternalError("received a nil *CreateAPIKeyResponse and nil error while calling CreateAPIKey. nil responses are not supported"))
+		return
+	}
+
+	ctx = callResponsePrepared(ctx, s.hooks)
+
+	marshaler := &protojson.MarshalOptions{UseProtoNames: !s.jsonCamelCase, EmitUnpopulated: !s.jsonSkipDefaults}
+	respBytes, err := marshaler.Marshal(respContent)
+	if err != nil {
+		s.writeError(ctx, resp, wrapInternal(err, "failed to marshal json response"))
+		return
+	}
+
+	ctx = ctxsetters.WithStatusCode(ctx, http.StatusOK)
+	resp.Header().Set("Content-Type", "application/json")
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBytes)))
+	resp.WriteHeader(http.StatusOK)
+
+	if n, err := resp.Write(respBytes); err != nil {
+		msg := fmt.Sprintf("failed to write response, %d of %d bytes written: %s", n, len(respBytes), err.Error())
+		twerr := twirp.NewError(twirp.Unknown, msg)
+		ctx = callError(ctx, s.hooks, twerr)
+	}
+	callResponseSent(ctx, s.hooks)
+}
+
+func (s *aPIKeysServiceServer) serveCreateAPIKeyProtobuf(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	var err error
+	ctx = ctxsetters.WithMethodName(ctx, "CreateAPIKey")
+	ctx, err = callRequestRouted(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	buf, err := io.ReadAll(req.Body)
+	if err != nil {
+		s.handleRequestBodyError(ctx, resp, "failed to read request body", err)
+		return
+	}
+	reqContent := new(CreateAPIKeyRequest)
+	if err = proto.Unmarshal(buf, reqContent); err != nil {
+		s.writeError(ctx, resp, malformedRequestError("the protobuf request could not be decoded"))
+		return
+	}
+
+	handler := s.APIKeysService.CreateAPIKey
+	if s.interceptor != nil {
+		handler = func(ctx context.Context, req *CreateAPIKeyRequest) (*CreateAPIKeyResponse, error) {
+			resp, err := s.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*CreateAPIKeyRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*CreateAPIKeyRequest) when calling interceptor")
+					}
+					return s.APIKeysService.CreateAPIKey(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*CreateAPIKeyResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*CreateAPIKeyResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+
+	// Call service method
+	var respContent *CreateAPIKeyResponse
+	func() {
+		defer ensurePanicResponses(ctx, resp, s.hooks)
+		respContent, err = handler(ctx, reqContent)
+	}()
+
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+	if respContent == nil {
+		s.writeError(ctx, resp, twirp.InternalError("received a nil *CreateAPIKeyResponse and nil error while calling CreateAPIKey. nil responses are not supported"))
+		return
+	}
+
+	ctx = callResponsePrepared(ctx, s.hooks)
+
+	respBytes, err := proto.Marshal(respContent)
+	if err != nil {
+		s.writeError(ctx, resp, wrapInternal(err, "failed to marshal proto response"))
+		return
+	}
+
+	ctx = ctxsetters.WithStatusCode(ctx, http.StatusOK)
+	resp.Header().Set("Content-Type", "application/protobuf")
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBytes)))
+	resp.WriteHeader(http.StatusOK)
+	if n, err := resp.Write(respBytes); err != nil {
+		msg := fmt.Sprintf("failed to write response, %d of %d bytes written: %s", n, len(respBytes), err.Error())
+		twerr := twirp.NewError(twirp.Unknown, msg)
+		ctx = callError(ctx, s.hooks, twerr)
+	}
+	callResponseSent(ctx, s.hooks)
+}
+
+func (s *aPIKeysServiceServer) serveListAPIKeys(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	header := req.Header.Get("Content-Type")
+	i := strings.Index(header, ";")
+	if i == -1 {
+		i = len(header)
+	}
+	switch strings.TrimSpace(strings.ToLower(header[:i])) {
+	case "application/json":
+		s.serveListAPIKeysJSON(ctx, resp, req)
+	case "application/protobuf":
+		s.serveListAPIKeysProtobuf(ctx, resp, req)
+	default:
+		msg := fmt.Sprintf("unexpected Content-Type: %q", req.Header.Get("Content-Type"))
+		twerr := badRouteError(msg, req.Method, req.URL.Path)
+		s.writeError(ctx, resp, twerr)
+	}
+}
+
+func (s *aPIKeysServiceServer) serveListAPIKeysJSON(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	var err error
+	ctx = ctxsetters.WithMethodName(ctx, "ListAPIKeys")
+	ctx, err = callRequestRouted(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	d := json.NewDecoder(req.Body)
+	rawReqBody := json.RawMessage{}
+	if err := d.Decode(&rawReqBody); err != nil {
+		s.handleRequestBodyError(ctx, resp, "the json request could not be decoded", err)
+		return
+	}
+	reqContent := new(ListAPIKeysRequest)
+	unmarshaler := protojson.UnmarshalOptions{DiscardUnknown: true}
+	if err = unmarshaler.Unmarshal(rawReqBody, reqContent); err != nil {
+		s.handleRequestBodyError(ctx, resp, "the json request could not be decoded", err)
+		return
+	}
+
+	handler := s.APIKeysService.ListAPIKeys
+	if s.interceptor != nil {
+		handler = func(ctx context.Context, req *ListAPIKeysRequest) (*ListAPIKeysResponse, error) {
+			resp, err := s.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*ListAPIKeysRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*ListAPIKeysRequest) when calling interceptor")
+					}
+					return s.APIKeysService.ListAPIKeys(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*ListAPIKeysResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*ListAPIKeysResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+
+	// Call service method
+	var respContent *ListAPIKeysResponse
+	func() {
+		defer ensurePanicResponses(ctx, resp, s.hooks)
+		respContent, err = handler(ctx, reqContent)
+	}()
+
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+	if respContent == nil {
+		s.writeError(ctx, resp, twirp.InternalError("received a nil *ListAPIKeysResponse and nil error while calling ListAPIKeys. nil responses are not supported"))
+		return
+	}
+
+	ctx = callResponsePrepared(ctx, s.hooks)
+
+	marshaler := &protojson.MarshalOptions{UseProtoNames: !s.jsonCamelCase, EmitUnpopulated: !s.jsonSkipDefaults}
+	respBytes, err := marshaler.Marshal(respContent)
+	if err != nil {
+		s.writeError(ctx, resp, wrapInternal(err, "failed to marshal json response"))
+		return
+	}
+
+	ctx = ctxsetters.WithStatusCode(ctx, http.StatusOK)
+	resp.Header().Set("Content-Type", "application/json")
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBytes)))
+	resp.WriteHeader(http.StatusOK)
+
+	if n, err := resp.Write(respBytes); err != nil {
+		msg := fmt.Sprintf("failed to write response, %d of %d bytes written: %s", n, len(respBytes), err.Error())
+		twerr := twirp.NewError(twirp.Unknown, msg)
+		ctx = callError(ctx, s.hooks, twerr)
+	}
+	callResponseSent(ctx, s.hooks)
+}
+
+func (s *aPIKeysServiceServer) serveListAPIKeysProtobuf(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	var err error
+	ctx = ctxsetters.WithMethodName(ctx, "ListAPIKeys")
+	ctx, err = callRequestRouted(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	buf, err := io.ReadAll(req.Body)
+	if err != nil {
+		s.handleRequestBodyError(ctx, resp, "failed to read request body", err)
+		return
+	}
+	reqContent := new(ListAPIKeysRequest)
+	if err = proto.Unmarshal(buf, reqContent); err != nil {
+		s.writeError(ctx, resp, malformedRequestError("the protobuf request could not be decoded"))
+		return
+	}
+
+	handler := s.APIKeysService.ListAPIKeys
+	if s.interceptor != nil {
+		handler = func(ctx context.Context, req *ListAPIKeysRequest) (*ListAPIKeysResponse, error) {
+			resp, err := s.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*ListAPIKeysRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*ListAPIKeysRequest) when calling interceptor")
+					}
+					return s.APIKeysService.ListAPIKeys(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*ListAPIKeysResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*ListAPIKeysResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+
+	// Call service method
+	var respContent *ListAPIKeysResponse
+	func() {
+		defer ensurePanicResponses(ctx, resp, s.hooks)
+		respContent, err = handler(ctx, reqContent)
+	}()
+
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+	if respContent == nil {
+		s.writeError(ctx, resp, twirp.InternalError("received a nil *ListAPIKeysResponse and nil error while calling ListAPIKeys. nil responses are not supported"))
+		return
+	}
+
+	ctx = callResponsePrepared(ctx, s.hooks)
+
+	respBytes, err := proto.Marshal(respContent)
+	if err != nil {
+		s.writeError(ctx, resp, wrapInternal(err, "failed to marshal proto response"))
+		return
+	}
+
+	ctx = ctxsetters.WithStatusCode(ctx, http.StatusOK)
+	resp.Header().Set("Content-Type", "application/protobuf")
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBytes)))
+	resp.WriteHeader(http.StatusOK)
+	if n, err := resp.Write(respBytes); err != nil {
+		msg := fmt.Sprintf("failed to write response, %d of %d bytes written: %s", n, len(respBytes), err.Error())
+		twerr := twirp.NewError(twirp.Unknown, msg)
+		ctx = callError(ctx, s.hooks, twerr)
+	}
+	callResponseSent(ctx, s.hooks)
+}
+
+func (s *aPIKeysServiceServer) serveRevokeAPIKey(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	header := req.Header.Get("Content-Type")
+	i := strings.Index(header, ";")
+	if i == -1 {
+		i = len(header)
+	}
+	switch strings.TrimSpace(strings.ToLower(header[:i])) {
+	case "application/json":
+		s.serveRevokeAPIKeyJSON(ctx, resp, req)
+	case "application/protobuf":
+		s.serveRevokeAPIKeyProtobuf(ctx, resp, req)
+	default:
+		msg := fmt.Sprintf("unexpected Content-Type: %q", req.Header.Get("Content-Type"))
+		twerr := badRouteError(msg, req.Method, req.URL.Path)
+		s.writeError(ctx, resp, twerr)
+	}
+}
+
+func (s *aPIKeysServiceServer) serveRevokeAPIKeyJSON(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	var err error
+	ctx = ctxsetters.WithMethodName(ctx, "RevokeAPIKey")
+	ctx, err = callRequestRouted(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	d := json.NewDecoder(req.Body)
+	rawReqBody := json.RawMessage{}
+	if err := d.Decode(&rawReqBody); err != nil {
+		s.handleRequestBodyError(ctx, resp, "the json request could not be decoded", err)
+		return
+	}
+	reqContent := new(RevokeAPIKeyRequest)
+	unmarshaler := protojson.UnmarshalOptions{DiscardUnknown: true}
+	if err = unmarshaler.Unmarshal(rawReqBody, reqContent); err != nil {
+		s.handleRequestBodyError(ctx, resp, "the json request could not be decoded", err)
+		return
+	}
+
+	handler := s.APIKeysService.RevokeAPIKey
+	if s.interceptor != nil {
+		handler = func(ctx context.Context, req *RevokeAPIKeyRequest) (*RevokeAPIKeyResponse, error) {
+			resp, err := s.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*RevokeAPIKeyRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*RevokeAPIKeyRequest) when calling interceptor")
+					}
+					return s.APIKeysService.RevokeAPIKey(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*RevokeAPIKeyResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*RevokeAPIKeyResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+
+	// Call service method
+	var respContent *RevokeAPIKeyResponse
+	func() {
+		defer ensurePanicResponses(ctx, resp, s.hooks)
+		respContent, err = handler(ctx, reqContent)
+	}()
+
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+	if respContent == nil {
+		s.writeError(ctx, resp, twirp.InternalError("received a nil *RevokeAPIKeyResponse and nil error while calling RevokeAPIKey. nil responses are not supported"))
+		return
+	}
+
+	ctx = callResponsePrepared(ctx, s.hooks)
+
+	marshaler := &protojson.MarshalOptions{UseProtoNames: !s.jsonCamelCase, EmitUnpopulated: !s.jsonSkipDefaults}
+	respBytes, err := marshaler.Marshal(respContent)
+	if err != nil {
+		s.writeError(ctx, resp, wrapInternal(err, "failed to marshal json response"))
+		return
+	}
+
+	ctx = ctxsetters.WithStatusCode(ctx, http.StatusOK)
+	resp.Header().Set("Content-Type", "application/json")
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBytes)))
+	resp.WriteHeader(http.StatusOK)
+
+	if n, err := resp.Write(respBytes); err != nil {
+		msg := fmt.Sprintf("failed to write response, %d of %d bytes written: %s", n, len(respBytes), err.Error())
+		twerr := twirp.NewError(twirp.Unknown, msg)
+		ctx = callError(ctx, s.hooks, twerr)
+	}
+	callResponseSent(ctx, s.hooks)
+}
+
+func (s *aPIKeysServiceServer) serveRevokeAPIKeyProtobuf(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	var err error
+	ctx = ctxsetters.WithMethodName(ctx, "RevokeAPIKey")
+	ctx, err = callRequestRouted(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	buf, err := io.ReadAll(req.Body)
+	if err != nil {
+		s.handleRequestBodyError(ctx, resp, "failed to read request body", err)
+		return
+	}
+	reqContent := new(RevokeAPIKeyRequest)
+	if err = proto.Unmarshal(buf, reqContent); err != nil {
+		s.writeError(ctx, resp, malformedRequestError("the protobuf request could not be decoded"))
+		return
+	}
+
+	handler := s.APIKeysService.RevokeAPIKey
+	if s.interceptor != nil {
+		handler = func(ctx context.Context, req *RevokeAPIKeyRequest) (*RevokeAPIKeyResponse, error) {
+			resp, err := s.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*RevokeAPIKeyRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*RevokeAPIKeyRequest) when calling interceptor")
+					}
+					return s.APIKeysService.RevokeAPIKey(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*RevokeAPIKeyResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*RevokeAPIKeyResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+
+	// Call service method
+	var respContent *RevokeAPIKeyResponse
+	func() {
+		defer ensurePanicResponses(ctx, resp, s.hooks)
+		respContent, err = handler(ctx, reqContent)
+	}()
+
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+	if respContent == nil {
+		s.writeError(ctx, resp, twirp.InternalError("received a nil *RevokeAPIKeyResponse and nil error while calling RevokeAPIKey. nil responses are not supported"))
+		return
+	}
+
+	ctx = callResponsePrepared(ctx, s.hooks)
+
+	respBytes, err := proto.Marshal(respContent)
+	if err != nil {
+		s.writeError(ctx, resp, wrapInternal(err, "failed to marshal proto response"))
+		return
+	}
+
+	ctx = ctxsetters.WithStatusCode(ctx, http.StatusOK)
+	resp.Header().Set("Content-Type", "application/protobuf")
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBytes)))
+	resp.WriteHeader(http.StatusOK)
+	if n, err := resp.Write(respBytes); err != nil {
+		msg := fmt.Sprintf("failed to write response, %d of %d bytes written: %s", n, len(respBytes), err.Error())
+		twerr := twirp.NewError(twirp.Unknown, msg)
+		ctx = callError(ctx, s.hooks, twerr)
+	}
+	callResponseSent(ctx, s.hooks)
+}
+
+func (s *aPIKeysServiceServer) serveDeleteAPIKey(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	header := req.Header.Get("Content-Type")
+	i := strings.Index(header, ";")
+	if i == -1 {
+		i = len(header)
+	}
+	switch strings.TrimSpace(strings.ToLower(header[:i])) {
+	case "application/json":
+		s.serveDeleteAPIKeyJSON(ctx, resp, req)
+	case "application/protobuf":
+		s.serveDeleteAPIKeyProtobuf(ctx, resp, req)
+	default:
+		msg := fmt.Sprintf("unexpected Content-Type: %q", req.Header.Get("Content-Type"))
+		twerr := badRouteError(msg, req.Method, req.URL.Path)
+		s.writeError(ctx, resp, twerr)
+	}
+}
+
+func (s *aPIKeysServiceServer) serveDeleteAPIKeyJSON(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	var err error
+	ctx = ctxsetters.WithMethodName(ctx, "DeleteAPIKey")
+	ctx, err = callRequestRouted(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	d := json.NewDecoder(req.Body)
+	rawReqBody := json.RawMessage{}
+	if err := d.Decode(&rawReqBody); err != nil {
+		s.handleRequestBodyError(ctx, resp, "the json request could not be decoded", err)
+		return
+	}
+	reqContent := new(DeleteAPIKeyRequest)
+	unmarshaler := protojson.UnmarshalOptions{DiscardUnknown: true}
+	if err = unmarshaler.Unmarshal(rawReqBody, reqContent); err != nil {
+		s.handleRequestBodyError(ctx, resp, "the json request could not be decoded", err)
+		return
+	}
+
+	handler := s.APIKeysService.DeleteAPIKey
+	if s.interceptor != nil {
+		handler = func(ctx context.Context, req *DeleteAPIKeyRequest) (*DeleteAPIKeyResponse, error) {
+			resp, err := s.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*DeleteAPIKeyRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*DeleteAPIKeyRequest) when calling interceptor")
+					}
+					return s.APIKeysService.DeleteAPIKey(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*DeleteAPIKeyResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*DeleteAPIKeyResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+
+	// Call service method
+	var respContent *DeleteAPIKeyResponse
+	func() {
+		defer ensurePanicResponses(ctx, resp, s.hooks)
+		respContent, err = handler(ctx, reqContent)
+	}()
+
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+	if respContent == nil {
+		s.writeError(ctx, resp, twirp.InternalError("received a nil *DeleteAPIKeyResponse and nil error while calling DeleteAPIKey. nil responses are not supported"))
+		return
+	}
+
+	ctx = callResponsePrepared(ctx, s.hooks)
+
+	marshaler := &protojson.MarshalOptions{UseProtoNames: !s.jsonCamelCase, EmitUnpopulated: !s.jsonSkipDefaults}
+	respBytes, err := marshaler.Marshal(respContent)
+	if err != nil {
+		s.writeError(ctx, resp, wrapInternal(err, "failed to marshal json response"))
+		return
+	}
+
+	ctx = ctxsetters.WithStatusCode(ctx, http.StatusOK)
+	resp.Header().Set("Content-Type", "application/json")
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBytes)))
+	resp.WriteHeader(http.StatusOK)
+
+	if n, err := resp.Write(respBytes); err != nil {
+		msg := fmt.Sprintf("failed to write response, %d of %d bytes written: %s", n, len(respBytes), err.Error())
+		twerr := twirp.NewError(twirp.Unknown, msg)
+		ctx = callError(ctx, s.hooks, twerr)
+	}
+	callResponseSent(ctx, s.hooks)
+}
+
+func (s *aPIKeysServiceServer) serveDeleteAPIKeyProtobuf(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	var err error
+	ctx = ctxsetters.WithMethodName(ctx, "DeleteAPIKey")
+	ctx, err = callRequestRouted(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	buf, err := io.ReadAll(req.Body)
+	if err != nil {
+		s.handleRequestBodyError(ctx, resp, "failed to read request body", err)
+		return
+	}
+	reqContent := new(DeleteAPIKeyRequest)
+	if err = proto.Unmarshal(buf, reqContent); err != nil {
+		s.writeError(ctx, resp, malformedRequestError("the protobuf request could not be decoded"))
+		return
+	}
+
+	handler := s.APIKeysService.DeleteAPIKey
+	if s.interceptor != nil {
+		handler = func(ctx context.Context, req *DeleteAPIKeyRequest) (*DeleteAPIKeyResponse, error) {
+			resp, err := s.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*DeleteAPIKeyRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*DeleteAPIKeyRequest) when calling interceptor")
+					}
+					return s.APIKeysService.DeleteAPIKey(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*DeleteAPIKeyResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*DeleteAPIKeyResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+
+	// Call service method
+	var respContent *DeleteAPIKeyResponse
+	func() {
+		defer ensurePanicResponses(ctx, resp, s.hooks)
+		respContent, err = handler(ctx, reqContent)
+	}()
+
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+	if respContent == nil {
+		s.writeError(ctx, resp, twirp.InternalError("received a nil *DeleteAPIKeyResponse and nil error while calling DeleteAPIKey. nil responses are not supported"))
+		return
+	}
+
+	ctx = callResponsePrepared(ctx, s.hooks)
+
+	respBytes, err := proto.Marshal(respContent)
+	if err != nil {
+		s.writeError(ctx, resp, wrapInternal(err, "failed to marshal proto response"))
+		return
+	}
+
+	ctx = ctxsetters.WithStatusCode(ctx, http.StatusOK)
+	resp.Header().Set("Content-Type", "application/protobuf")
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBytes)))
+	resp.WriteHeader(http.StatusOK)
+	if n, err := resp.Write(respBytes); err != nil {
+		msg := fmt.Sprintf("failed to write response, %d of %d bytes written: %s", n, len(respBytes), err.Error())
+		twerr := twirp.NewError(twirp.Unknown, msg)
+		ctx = callError(ctx, s.hooks, twerr)
+	}
+	callResponseSent(ctx, s.hooks)
+}
+
+func (s *aPIKeysServiceServer) ServiceDescriptor() ([]byte, int) {
+	return twirpFileDescriptor0, 0
+}
+
+func (s *aPIKeysServiceServer) ProtocGenTwirpVersion() string {
+	return "v8.1.3"
+}
+
+// PathPrefix returns the base service path, in the form: "/<prefix>/<package>.<Service>/"
+// that is everything in a Twirp route except for the <Method>. This can be used for routing,
+// for example to identify the requests that are targeted to this service in a mux.
+func (s *aPIKeysServiceServer) PathPrefix() string {
+	return baseServicePath(s.pathPrefix, "apikeys", "APIKeysService")
+}
+
+// =====
+// Utils
+// =====
+
+// HTTPClient is the interface used by generated clients to send HTTP requests.
+// It is fulfilled by *(net/http).Client, which is sufficient for most users.
+// Users can provide their own implementation for special retry policies.
+//
+// HTTPClient implementations should not follow redirects. Redirects are
+// automatically disabled if *(net/http).Client is passed to client
+// constructors. See the withoutRedirects function in this file for more
+// details.
+type HTTPClient interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// TwirpServer is the interface generated server structs will support: they're
+// HTTP handlers with additional methods for accessing metadata about the
+// service. Those accessors are a low-level API for building reflection tools.
+// Most people can think of TwirpServers as just http.Handlers.
+type TwirpServer interface {
+	http.Handler
+
+	// ServiceDescriptor returns gzipped bytes describing the .proto file that
+	// this service was generated from. Once unzipped, the bytes can be
+	// unmarshalled as a
+	// google.golang.org/protobuf/types/descriptorpb.FileDescriptorProto.
+	//
+	// The returned integer is the index of this particular service within that
+	// FileDescriptorProto's 'Service' slice of ServiceDescriptorProtos. This is a
+	// low-level field, expected to be used for reflection.
+	ServiceDescriptor() ([]byte, int)
+
+	// ProtocGenTwirpVersion is the semantic version string of the version of
+	// twirp used to generate this file.
+	ProtocGenTwirpVersion() string
+
+	// PathPrefix returns the HTTP URL path prefix for all methods handled by this
+	// service. This can be used with an HTTP mux to route Twirp requests.
+	// The path prefix is in the form: "/<prefix>/<package>.<Service>/"
+	// that is, everything in a Twirp route except for the <Method> at the end.
+	PathPrefix() string
+}
+
+func newServerOpts(opts []interface{}) *twirp.ServerOptions {
+	serverOpts := &twirp.ServerOptions{}
+	for _, opt := range opts {
+		switch o := opt.(type) {
+		case twirp.ServerOption:
+			o(serverOpts)
+		case *twirp.ServerHooks: // backwards compatibility, allow to specify hooks as an argument
+			twirp.WithServerHooks(o)(serverOpts)
+		case nil: // backwards compatibility, allow nil value for the argument
+			continue
+		default:
+			panic(fmt.Sprintf("Invalid option type %T, please use a twirp.ServerOption", o))
+		}
+	}
+	return serverOpts
+}
+
+// WriteError writes an HTTP response with a valid Twirp error format (code, msg, meta).
+// Useful outside of the Twirp server (e.g. http middleware), but does not trigger hooks.
+// If err is not a twirp.Error, it will get wrapped with twirp.InternalErrorWith(err)
+func WriteError(resp http.ResponseWriter, err error) {
+	writeError(context.Background(), resp, err, nil)
+}
+
+// writeError writes Twirp errors in the response and triggers hooks.
+func writeError(ctx context.Context, resp http.ResponseWriter, err error, hooks *twirp.ServerHooks) {
+	// Convert to a twirp.Error. Non-twirp errors are converted to internal errors.
+	var twerr twirp.Error
+	if !errors.As(err, &twerr) {
+		twerr = twirp.InternalErrorWith(err)
+	}
+
+	statusCode := twirp.ServerHTTPStatusFromErrorCode(twerr.Code())
+	ctx = ctxsetters.WithStatusCode(ctx, statusCode)
+	ctx = callError(ctx, hooks, twerr)
+
+	respBody := marshalErrorToJSON(twerr)
+
+	resp.Header().Set("Content-Type", "application/json") // Error responses are always JSON
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBody)))
+	resp.WriteHeader(statusCode) // set HTTP status code and send response
+
+	_, writeErr := resp.Write(respBody)
+	if writeErr != nil {
+		// We have three options here. We could log the error, call the Error
+		// hook, or just silently ignore the error.
+		//
+		// Logging is unacceptable because we don't have a user-controlled
+		// logger; writing out to stderr without permission is too rude.
+		//
+		// Calling the Error hook would confuse users: it would mean the Error
+		// hook got called twice for one request, which is likely to lead to
+		// duplicated log messages and metrics, no matter how well we document
+		// the behavior.
+		//
+		// Silently ignoring the error is our least-bad option. It's highly
+		// likely that the connection is broken and the original 'err' says
+		// so anyway.
+		_ = writeErr
+	}
+
+	callResponseSent(ctx, hooks)
+}
+
+// sanitizeBaseURL parses the the baseURL, and adds the "http" scheme if needed.
+// If the URL is unparsable, the baseURL is returned unchanged.
+func sanitizeBaseURL(baseURL string) string {
+	u, err := url.Parse(baseURL)
+	if err != nil {
+		return baseURL // invalid URL will fail later when making requests
+	}
+	if u.Scheme == "" {
+		u.Scheme = "http"
+	}
+	return u.String()
+}
+
+// baseServicePath composes the path prefix for the service (without <Method>).
+// e.g.: baseServicePath("/twirp", "my.pkg", "MyService")
+//
+//	returns => "/twirp/my.pkg.MyService/"
+//
+// e.g.: baseServicePath("", "", "MyService")
+//
+//	returns => "/MyService/"
+func baseServicePath(prefix, pkg, service string) string {
+	fullServiceName := service
+	if pkg != "" {
+		fullServiceName = pkg + "." + service
+	}
+	return path.Join("/", prefix, fullServiceName) + "/"
+}
+
+// parseTwirpPath extracts path components form a valid Twirp route.
+// Expected format: "[<prefix>]/<package>.<Service>/<Method>"
+// e.g.: prefix, pkgService, method := parseTwirpPath("/twirp/pkg.Svc/MakeHat")
+func parseTwirpPath(path string) (string, string, string) {
+	parts := strings.Split(path, "/")
+	if len(parts) < 2 {
+		return "", "", ""
+	}
+	method := parts[len(parts)-1]
+	pkgService := parts[len(parts)-2]
+	prefix := strings.Join(parts[0:len(parts)-2], "/")
+	return prefix, pkgService, method
+}
+
+// getCustomHTTPReqHeaders retrieves a copy of any headers that are set in
+// a context through the twirp.WithHTTPRequestHeaders function.
+// If there are no headers set, or if they have the wrong type, nil is returned.
+func getCustomHTTPReqHeaders(ctx context.Context) http.Header {
+	header, ok := twirp.HTTPRequestHeaders(ctx)
+	if !ok || header == nil {
+		return nil
+	}
+	copied := make(http.Header)
+	for k, vv := range header {
+		if vv == nil {
+			copied[k] = nil
+			continue
+		}
+		copied[k] = make([]string, len(vv))
+		copy(copied[k], vv)
+	}
+	return copied
+}
+
+// newRequest makes an http.Request from a client, adding common headers.
+func newRequest(ctx context.Context, url string, reqBody io.Reader, contentType string) (*http.Request, error) {
+	req, err := http.NewRequest("POST", url, reqBody)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if customHeader := getCustomHTTPReqHeaders(ctx); customHeader != nil {
+		req.Header = customHeader
+	}
+	req.Header.Set("Accept", contentType)
+	req.Header.Set("Content-Type", contentType)
+	req.Header.Set("Twirp-Version", "v8.1.3")
+	return req, nil
+}
+
+// JSON serialization for errors
+type twerrJSON struct {
+	Code string            `json:"code"`
+	Msg  string            `json:"msg"`
+	Meta map[string]string `json:"meta,omitempty"`
+}
+
+// marshalErrorToJSON returns JSON from a twirp.Error, that can be used as HTTP error response body.
+// If serialization fails, it will use a descriptive Internal error instead.
+func marshalErrorToJSON(twerr twirp.Error) []byte {
+	// make sure that msg is not too large
+	msg := twerr.Msg()
+	if len(msg) > 1e6 {
+		msg = msg[:1e6]
+	}
+
+	tj := twerrJSON{
+		Code: string(twerr.Code()),
+		Msg:  msg,
+		Meta: twerr.MetaMap(),
+	}
+
+	buf, err := json.Marshal(&tj)
+	if err != nil {
+		buf = []byte("{\"type\": \"" + twirp.Internal + "\", \"msg\": \"There was an error but it could not be serialized into JSON\"}") // fallback
+	}
+
+	return buf
+}
+
+// errorFromResponse builds a twirp.Error from a non-200 HTTP response.
+// If the response has a valid serialized Twirp error, then it's returned.
+// If not, the response status code is used to generate a similar twirp
+// error. See twirpErrorFromIntermediary for more info on intermediary errors.
+func errorFromResponse(resp *http.Response) twirp.Error {
+	statusCode := resp.StatusCode
+	statusText := http.StatusText(statusCode)
+
+	if isHTTPRedirect(statusCode) {
+		// Unexpected redirect: it must be an error from an intermediary.
+		// Twirp clients don't follow redirects automatically, Twirp only handles
+		// POST requests, redirects should only happen on GET and HEAD requests.
+		location := resp.Header.Get("Location")
+		msg := fmt.Sprintf("unexpected HTTP status code %d %q received, Location=%q", statusCode, statusText, location)
+		return twirpErrorFromIntermediary(statusCode, msg, location)
+	}
+
+	respBodyBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return wrapInternal(err, "failed to read server error response body")
+	}
+
+	var tj twerrJSON
+	dec := json.NewDecoder(bytes.NewReader(respBodyBytes))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&tj); err != nil || tj.Code == "" {
+		// Invalid JSON response; it must be an error from an intermediary.
+		msg := fmt.Sprintf("Error from intermediary with HTTP status code %d %q", statusCode, statusText)
+		return twirpErrorFromIntermediary(statusCode, msg, string(respBodyBytes))
+	}
+
+	errorCode := twirp.ErrorCode(tj.Code)
+	if !twirp.IsValidErrorCode(errorCode) {
+		msg := "invalid type returned from server error response: " + tj.Code
+		return twirp.InternalError(msg).WithMeta("body", string(respBodyBytes))
+	}
+
+	twerr := twirp.NewError(errorCode, tj.Msg)
+	for k, v := range tj.Meta {
+		twerr = twerr.WithMeta(k, v)
+	}
+	return twerr
+}
+
+// twirpErrorFromIntermediary maps HTTP errors from non-twirp sources to twirp errors.
+// The mapping is similar to gRPC: https://github.com/grpc/grpc/blob/master/doc/http-grpc-status-mapping.md.
+// Returned twirp Errors have some additional metadata for inspection.
+func twirpErrorFromIntermediary(status int, msg string, bodyOrLocation string) twirp.Error {
+	var code twirp.ErrorCode
+	if isHTTPRedirect(status) { // 3xx
+		code = twirp.Internal
+	} else {
+		switch status {
+		case 400: // Bad Request
+			code = twirp.Internal
+		case 401: // Unauthorized
+			code = twirp.Unauthenticated
+		case 403: // Forbidden
+			code = twirp.PermissionDenied
+		case 404: // Not Found
+			code = twirp.BadRoute
+		case 429: // Too Many Requests
+			code = twirp.ResourceExhausted
+		case 502, 503, 504: // Bad Gateway, Service Unavailable, Gateway Timeout
+			code = twirp.Unavailable
+		default: // All other codes
+			code = twirp.Unknown
+		}
+	}
+
+	twerr := twirp.NewError(code, msg)
+	twerr = twerr.WithMeta("http_error_from_intermediary", "true") // to easily know if this error was from intermediary
+	twerr = twerr.WithMeta("status_code", strconv.Itoa(status))
+	if isHTTPRedirect(status) {
+		twerr = twerr.WithMeta("location", bodyOrLocation)
+	} else {
+		twerr = twerr.WithMeta("body", bodyOrLocation)
+	}
+	return twerr
+}
+
+func isHTTPRedirect(status int) bool {
+	return status >= 300 && status <= 399
+}
+
+// wrapInternal wraps an error with a prefix as an Internal error.
+// The original error cause is accessible by github.com/pkg/errors.Cause.
+func wrapInternal(err error, prefix string) twirp.Error {
+	return twirp.InternalErrorWith(&wrappedError{prefix: prefix, cause: err})
+}
+
+type wrappedError struct {
+	prefix string
+	cause  error
+}
+
+func (e *wrappedError) Error() string { return e.prefix + ": " + e.cause.Error() }
+func (e *wrappedError) Unwrap() error { return e.cause } // for go1.13 + errors.Is/As
+func (e *wrappedError) Cause() error  { return e.cause } // for github.com/pkg/errors
+
+// ensurePanicResponses makes sure that rpc methods causing a panic still result in a Twirp Internal
+// error response (status 500), and error hooks are properly called with the panic wrapped as an error.
+// The panic is re-raised so it can be handled normally with middleware.
+func ensurePanicResponses(ctx context.Context, resp http.ResponseWriter, hooks *twirp.ServerHooks) {
+	if r := recover(); r != nil {
+		// Wrap the panic as an error so it can be passed to error hooks.
+		// The original error is accessible from error hooks, but not visible in the response.
+		err := errFromPanic(r)
+		twerr := &internalWithCause{msg: "Internal service panic", cause: err}
+		// Actually write the error
+		writeError(ctx, resp, twerr, hooks)
+		// If possible, flush the error to the wire.
+		f, ok := resp.(http.Flusher)
+		if ok {
+			f.Flush()
+		}
+
+		panic(r)
+	}
+}
+
+// errFromPanic returns the typed error if the recovered panic is an error, otherwise formats as error.
+func errFromPanic(p interface{}) error {
+	if err, ok := p.(error); ok {
+		return err
+	}
+	return fmt.Errorf("panic: %v", p)
+}
+
+// internalWithCause is a Twirp Internal error wrapping an original error cause,
+// but the original error message is not exposed on Msg(). The original error
+// can be checked with go1.13+ errors.Is/As, and also by (github.com/pkg/errors).Unwrap
+type internalWithCause struct {
+	msg   string
+	cause error
+}
+
+func (e *internalWithCause) Unwrap() error                               { return e.cause } // for go1.13 + errors.Is/As
+func (e *internalWithCause) Cause() error                                { return e.cause } // for github.com/pkg/errors
+func (e *internalWithCause) Error() string                               { return e.msg + ": " + e.cause.Error() }
+func (e *internalWithCause) Code() twirp.ErrorCode                       { return twirp.Internal }
+func (e *internalWithCause) Msg() string                                 { return e.msg }
+func (e *internalWithCause) Meta(key string) string                      { return "" }
+func (e *internalWithCause) MetaMap() map[string]string                  { return nil }
+func (e *internalWithCause) WithMeta(key string, val string) twirp.Error { return e }
+
+// malformedRequestError is used when the twirp server cannot unmarshal a request
+func malformedRequestError(msg string) twirp.Error {
+	return twirp.NewError(twirp.Malformed, msg)
+}
+
+// badRouteError is used when the twirp server cannot route a request
+func badRouteError(msg string, method, url string) twirp.Error {
+	err := twirp.NewError(twirp.BadRoute, msg)
+	err = err.WithMeta("twirp_invalid_route", method+" "+url)
+	return err
+}
+
+// withoutRedirects makes sure that the POST request can not be redirected.
+// The standard library will, by default, redirect requests (including POSTs) if it gets a 302 or
+// 303 response, and also 301s in go1.8. It redirects by making a second request, changing the
+// method to GET and removing the body. This produces very confusing error messages, so instead we
+// set a redirect policy that always errors. This stops Go from executing the redirect.
+//
+// We have to be a little careful in case the user-provided http.Client has its own CheckRedirect
+// policy - if so, we'll run through that policy first.
+//
+// Because this requires modifying the http.Client, we make a new copy of the client and return it.
+func withoutRedirects(in *http.Client) *http.Client {
+	copy := *in
+	copy.CheckRedirect = func(req *http.Request, via []*http.Request) error {
+		if in.CheckRedirect != nil {
+			// Run the input's redirect if it exists, in case it has side effects, but ignore any error it
+			// returns, since we want to use ErrUseLastResponse.
+			err := in.CheckRedirect(req, via)
+			_ = err // Silly, but this makes sure generated code passes errcheck -blank, which some people use.
+		}
+		return http.ErrUseLastResponse
+	}
+	return &copy
+}
+
+// doProtobufRequest makes a Protobuf request to the remote Twirp service.
+func doProtobufRequest(ctx context.Context, client HTTPClient, hooks *twirp.ClientHooks, url string, in, out proto.Message) (_ context.Context, err error) {
+	reqBodyBytes, err := proto.Marshal(in)
+	if err != nil {
+		return ctx, wrapInternal(err, "failed to marshal proto request")
+	}
+	reqBody := bytes.NewBuffer(reqBodyBytes)
+	if err = ctx.Err(); err != nil {
+		return ctx, wrapInternal(err, "aborted because context was done")
+	}
+
+	req, err := newRequest(ctx, url, reqBody, "application/protobuf")
+	if err != nil {
+		return ctx, wrapInternal(err, "could not build request")
+	}
+	ctx, err = callClientRequestPrepared(ctx, hooks, req)
+	if err != nil {
+		return ctx, err
+	}
+
+	req = req.WithContext(ctx)
+	resp, err := client.Do(req)
+	if err != nil {
+		return ctx, wrapInternal(err, "failed to do request")
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if err = ctx.Err(); err != nil {
+		return ctx, wrapInternal(err, "aborted because context was done")
+	}
+
+	if resp.StatusCode != 200 {
+		return ctx, errorFromResponse(resp)
+	}
+
+	respBodyBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return ctx, wrapInternal(err, "failed to read response body")
+	}
+	if err = ctx.Err(); err != nil {
+		return ctx, wrapInternal(err, "aborted because context was done")
+	}
+
+	if err = proto.Unmarshal(respBodyBytes, out); err != nil {
+		return ctx, wrapInternal(err, "failed to unmarshal proto response")
+	}
+	return ctx, nil
+}
+
+// doJSONRequest makes a JSON request to the remote Twirp service.
+func doJSONRequest(ctx context.Context, client HTTPClient, hooks *twirp.ClientHooks, url string, in, out proto.Message) (_ context.Context, err error) {
+	marshaler := &protojson.MarshalOptions{UseProtoNames: true}
+	reqBytes, err := marshaler.Marshal(in)
+	if err != nil {
+		return ctx, wrapInternal(err, "failed to marshal json request")
+	}
+	if err = ctx.Err(); err != nil {
+		return ctx, wrapInternal(err, "aborted because context was done")
+	}
+
+	req, err := newRequest(ctx, url, bytes.NewReader(reqBytes), "application/json")
+	if err != nil {
+		return ctx, wrapInternal(err, "could not build request")
+	}
+	ctx, err = callClientRequestPrepared(ctx, hooks, req)
+	if err != nil {
+		return ctx, err
+	}
+
+	req = req.WithContext(ctx)
+	resp, err := client.Do(req)
+	if err != nil {
+		return ctx, wrapInternal(err, "failed to do request")
+	}
+
+	defer func() {
+		cerr := resp.Body.Close()
+		if err == nil && cerr != nil {
+			err = wrapInternal(cerr, "failed to close response body")
+		}
+	}()
+
+	if err = ctx.Err(); err != nil {
+		return ctx, wrapInternal(err, "aborted because context was done")
+	}
+
+	if resp.StatusCode != 200 {
+		return ctx, errorFromResponse(resp)
+	}
+
+	d := json.NewDecoder(resp.Body)
+	rawRespBody := json.RawMessage{}
+	if err := d.Decode(&rawRespBody); err != nil {
+		return ctx, wrapInternal(err, "failed to unmarshal json response")
+	}
+	unmarshaler := protojson.UnmarshalOptions{DiscardUnknown: true}
+	if err = unmarshaler.Unmarshal(rawRespBody, out); err != nil {
+		return ctx, wrapInternal(err, "failed to unmarshal json response")
+	}
+	if err = ctx.Err(); err != nil {
+		return ctx, wrapInternal(err, "aborted because context was done")
+	}
+	return ctx, nil
+}
+
+// Call twirp.ServerHooks.RequestReceived if the hook is available
+func callRequestReceived(ctx context.Context, h *twirp.ServerHooks) (context.Context, error) {
+	if h == nil || h.RequestReceived == nil {
+		return ctx, nil
+	}
+	return h.RequestReceived(ctx)
+}
+
+// Call twirp.ServerHooks.RequestRouted if the hook is available
+func callRequestRouted(ctx context.Context, h *twirp.ServerHooks) (context.Context, error) {
+	if h == nil || h.RequestRouted == nil {
+		return ctx, nil
+	}
+	return h.RequestRouted(ctx)
+}
+
+// Call twirp.ServerHooks.ResponsePrepared if the hook is available
+func callResponsePrepared(ctx context.Context, h *twirp.ServerHooks) context.Context {
+	if h == nil || h.ResponsePrepared == nil {
+		return ctx
+	}
+	return h.ResponsePrepared(ctx)
+}
+
+// Call twirp.ServerHooks.ResponseSent if the hook is available
+func callResponseSent(ctx context.Context, h *twirp.ServerHooks) {
+	if h == nil || h.ResponseSent == nil {
+		return
+	}
+	h.ResponseSent(ctx)
+}
+
+// Call twirp.ServerHooks.Error if the hook is available
+func callError(ctx context.Context, h *twirp.ServerHooks, err twirp.Error) context.Context {
+	if h == nil || h.Error == nil {
+		return ctx
+	}
+	return h.Error(ctx, err)
+}
+
+func callClientResponseReceived(ctx context.Context, h *twirp.ClientHooks) {
+	if h == nil || h.ResponseReceived == nil {
+		return
+	}
+	h.ResponseReceived(ctx)
+}
+
+func callClientRequestPrepared(ctx context.Context, h *twirp.ClientHooks, req *http.Request) (context.Context, error) {
+	if h == nil || h.RequestPrepared == nil {
+		return ctx, nil
+	}
+	return h.RequestPrepared(ctx, req)
+}
+
+func callClientError(ctx context.Context, h *twirp.ClientHooks, err twirp.Error) {
+	if h == nil || h.Error == nil {
+		return
+	}
+	h.Error(ctx, err)
+}
+
+var twirpFileDescriptor0 = []byte{
+	// 431 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x93, 0xcd, 0x8e, 0xd3, 0x30,
+	0x14, 0x85, 0x95, 0x76, 0x26, 0x6d, 0xef, 0x54, 0x03, 0x72, 0xcb, 0x10, 0xe6, 0x47, 0xaa, 0xb2,
+	0xaa, 0x10, 0xb4, 0xd2, 0xf0, 0x04, 0x01, 0x16, 0x53, 0x85, 0x05, 0x0a, 0x62, 0xc3, 0x26, 0x32,
+	0xc9, 0x15, 0xb2, 0x32, 0x4c, 0x82, 0xaf, 0x53, 0x91, 0xc7, 0x83, 0x27, 0x43, 0xfe, 0x51, 0xe4,
+	0x0c, 0x41, 0x62, 0x17, 0x5f, 0x9f, 0x9e, 0x63, 0xf7, 0x3b, 0x86, 0x17, 0xb2, 0x29, 0xf6, 0xbc,
+	0x11, 0x15, 0x76, 0xb4, 0x27, 0x94, 0x47, 0x51, 0xe0, 0xae, 0x91, 0xb5, 0xaa, 0xd9, 0xcc, 0x8d,
+	0xe3, 0x3b, 0x58, 0xbd, 0x93, 0xc8, 0x15, 0x26, 0x1f, 0x0f, 0x29, 0x76, 0x19, 0xfe, 0x68, 0x91,
+	0x14, 0x63, 0x70, 0xf2, 0xc0, 0xbf, 0x63, 0x14, 0x6c, 0x82, 0xed, 0x22, 0x33, 0xdf, 0xec, 0x06,
+	0x00, 0x7f, 0x36, 0x42, 0x22, 0xe5, 0x5c, 0x45, 0x13, 0xb3, 0xb3, 0x70, 0x93, 0x44, 0xc5, 0x19,
+	0xac, 0x87, 0x4e, 0xd4, 0xd4, 0x0f, 0x84, 0x6c, 0x0b, 0x3a, 0x2c, 0xaf, 0xb0, 0x33, 0x6e, 0x67,
+	0xb7, 0x4f, 0x76, 0x2e, 0x7c, 0xe7, 0x94, 0x21, 0x6f, 0x44, 0x8a, 0x1d, 0x7b, 0x0a, 0x53, 0xad,
+	0xb2, 0xce, 0xfa, 0x33, 0x5e, 0x03, 0xfb, 0x20, 0x48, 0x59, 0x1d, 0xb9, 0xc3, 0xc5, 0x09, 0xac,
+	0x06, 0x53, 0x17, 0xf4, 0x12, 0xe6, 0x2e, 0x88, 0xa2, 0x60, 0x33, 0x1d, 0x4b, 0x9a, 0xd9, 0x24,
+	0x8a, 0x5f, 0xc1, 0x2a, 0xc3, 0x63, 0x5d, 0x3d, 0xba, 0xf6, 0x33, 0x08, 0x2b, 0xec, 0x72, 0x51,
+	0xba, 0x8b, 0x9f, 0x56, 0xd8, 0x1d, 0xca, 0xf8, 0x02, 0xd6, 0x43, 0xb5, 0x4d, 0xd4, 0x2e, 0xef,
+	0xf1, 0x1e, 0xd5, 0x7f, 0xbb, 0x0c, 0xd5, 0xce, 0xe5, 0x77, 0x00, 0xa1, 0x1d, 0xb1, 0x73, 0x98,
+	0xf4, 0xbf, 0x9a, 0x88, 0x92, 0x3d, 0x87, 0x59, 0x4b, 0x28, 0xb5, 0x95, 0xfd, 0x57, 0x42, 0xbd,
+	0x3c, 0x94, 0x3d, 0x9f, 0xe9, 0x90, 0x4f, 0x61, 0x00, 0x94, 0x9a, 0xcf, 0x89, 0xe5, 0xe3, 0x26,
+	0x89, 0x62, 0x1b, 0x58, 0xde, 0x73, 0x52, 0x79, 0x4b, 0x56, 0x70, 0x6a, 0x04, 0xa0, 0x67, 0x9f,
+	0xc9, 0x28, 0x86, 0x80, 0xc3, 0x47, 0x80, 0xd9, 0x15, 0x2c, 0x04, 0xe5, 0xbc, 0x50, 0xe2, 0x88,
+	0xd1, 0x6c, 0x13, 0x6c, 0xe7, 0xd9, 0x5c, 0x50, 0x62, 0xd6, 0xb7, 0xbf, 0x26, 0x70, 0xee, 0x80,
+	0x7c, 0xb2, 0x4d, 0x63, 0x29, 0x2c, 0xfd, 0x42, 0xb0, 0xeb, 0x9e, 0xc6, 0x48, 0xe3, 0x2e, 0x6f,
+	0xfe, 0xb1, 0xeb, 0xe0, 0xde, 0xc1, 0x99, 0xc7, 0x9c, 0x5d, 0xf5, 0xea, 0xbf, 0xfb, 0x71, 0x79,
+	0x3d, 0xbe, 0xe9, 0x9c, 0x52, 0x58, 0xfa, 0x30, 0xbd, 0x63, 0x8d, 0x34, 0xc2, 0x3b, 0xd6, 0x58,
+	0x03, 0xb4, 0x99, 0xcf, 0xd4, 0x33, 0x1b, 0x29, 0x86, 0x67, 0x36, 0x56, 0x84, 0xb7, 0xd1, 0x97,
+	0x0b, 0x2e, 0xbf, 0xb5, 0xf4, 0xba, 0xa8, 0x25, 0xee, 0xbd, 0xc7, 0xfb, 0x35, 0x34, 0xaf, 0xf6,
+	0xcd, 0x9f, 0x00, 0x00, 0x00, 0xff, 0xff, 0xa6, 0xbd, 0xb3, 0x99, 0xd2, 0x03, 0x00, 0x00,
+}

@@ -0,0 +1,501 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.35.2
+// 	protoc        v5.29.1
+// source: rpc/auth/service.proto
+
+package auth
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Request and Response messages
+type RegisterRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Email    string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+	Password string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
+}
+
+func (x *RegisterRequest) Reset() {
+	*x = RegisterRequest{}
+	mi := &file_rpc_auth_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RegisterRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RegisterRequest) ProtoMessage() {}
+
+func (x *RegisterRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_auth_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RegisterRequest.ProtoReflect.Descriptor instead.
+func (*RegisterRequest) Descriptor() ([]byte, []int) {
+	return file_rpc_auth_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *RegisterRequest) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *RegisterRequest) GetPassword() string {
+	if x != nil {
+		return x.Password
+	}
+	return ""
+}
+
+type RegisterResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	User *User `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
+}
+
+func (x *RegisterResponse) Reset() {
+	*x = RegisterResponse{}
+	mi := &file_rpc_auth_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RegisterResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RegisterResponse) ProtoMessage() {}
+
+func (x *RegisterResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_auth_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RegisterResponse.ProtoReflect.Descriptor instead.
+func (*RegisterResponse) Descriptor() ([]byte, []int) {
+	return file_rpc_auth_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *RegisterResponse) GetUser() *User {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+type LoginRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Email    string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+	Password string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
+}
+
+func (x *LoginRequest) Reset() {
+	*x = LoginRequest{}
+	mi := &file_rpc_auth_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LoginRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LoginRequest) ProtoMessage() {}
+
+func (x *LoginRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_auth_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LoginRequest.ProtoReflect.Descriptor instead.
+func (*LoginRequest) Descriptor() ([]byte, []int) {
+	return file_rpc_auth_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *LoginRequest) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *LoginRequest) GetPassword() string {
+	if x != nil {
+		return x.Password
+	}
+	return ""
+}
+
+type LoginResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
+	User  *User  `protobuf:"bytes,2,opt,name=user,proto3" json:"user,omitempty"`
+}
+
+func (x *LoginResponse) Reset() {
+	*x = LoginResponse{}
+	mi := &file_rpc_auth_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LoginResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LoginResponse) ProtoMessage() {}
+
+func (x *LoginResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_auth_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LoginResponse.ProtoReflect.Descriptor instead.
+func (*LoginResponse) Descriptor() ([]byte, []int) {
+	return file_rpc_auth_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *LoginResponse) GetToken() string {
+	if x != nil {
+		return x.Token
+	}
+	return ""
+}
+
+func (x *LoginResponse) GetUser() *User {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+type ValidateTokenRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
+}
+
+func (x *ValidateTokenRequest) Reset() {
+	*x = ValidateTokenRequest{}
+	mi := &file_rpc_auth_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ValidateTokenRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ValidateTokenRequest) ProtoMessage() {}
+
+func (x *ValidateTokenRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_auth_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ValidateTokenRequest.ProtoReflect.Descriptor instead.
+func (*ValidateTokenRequest) Descriptor() ([]byte, []int) {
+	return file_rpc_auth_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ValidateTokenRequest) GetToken() string {
+	if x != nil {
+		return x.Token
+	}
+	return ""
+}
+
+type ValidateTokenResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	User *User `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
+}
+
+func (x *ValidateTokenResponse) Reset() {
+	*x = ValidateTokenResponse{}
+	mi := &file_rpc_auth_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ValidateTokenResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ValidateTokenResponse) ProtoMessage() {}
+
+func (x *ValidateTokenResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_auth_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ValidateTokenResponse.ProtoReflect.Descriptor instead.
+func (*ValidateTokenResponse) Descriptor() ([]byte, []int) {
+	return file_rpc_auth_service_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *ValidateTokenResponse) GetUser() *User {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+// Common messages
+type User struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id        string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Email     string `protobuf:"bytes,2,opt,name=email,proto3" json:"email,omitempty"`
+	CreatedAt string `protobuf:"bytes,3,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	UpdatedAt string `protobuf:"bytes,4,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
+}
+
+func (x *User) Reset() {
+	*x = User{}
+	mi := &file_rpc_auth_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *User) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*User) ProtoMessage() {}
+
+func (x *User) ProtoReflect() protoreflect.Message {
+	mi := &file_rpc_auth_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use User.ProtoReflect.Descriptor instead.
+func (*User) Descriptor() ([]byte, []int) {
+	return file_rpc_auth_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *User) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *User) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *User) GetCreatedAt() string {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return ""
+}
+
+func (x *User) GetUpdatedAt() string {
+	if x != nil {
+		return x.UpdatedAt
+	}
+	return ""
+}
+
+var File_rpc_auth_service_proto protoreflect.FileDescriptor
+
+var file_rpc_auth_service_proto_rawDesc = []byte{
+	0x0a, 0x16, 0x72, 0x70, 0x63, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x04, 0x61, 0x75, 0x74, 0x68, 0x22, 0x43,
+	0x0a, 0x0f, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77,
+	0x6f, 0x72, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77,
+	0x6f, 0x72, 0x64, 0x22, 0x32, 0x0a, 0x10, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1e, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0a, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x55, 0x73, 0x65,
+	0x72, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x22, 0x40, 0x0a, 0x0c, 0x4c, 0x6f, 0x67, 0x69, 0x6e,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x1a, 0x0a,
+	0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x45, 0x0a, 0x0d, 0x4c, 0x6f, 0x67,
+	0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
+	0x12, 0x1e, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0a,
+	0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72,
+	0x22, 0x2c, 0x0a, 0x14, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0x37,
+	0x0a, 0x15, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1e, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0a, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x55, 0x73, 0x65,
+	0x72, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x22, 0x6a, 0x0a, 0x04, 0x55, 0x73, 0x65, 0x72, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x1d, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64,
+	0x5f, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x64, 0x41, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f,
+	0x61, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x64, 0x41, 0x74, 0x32, 0xc4, 0x01, 0x0a, 0x0b, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x12, 0x39, 0x0a, 0x08, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x12,
+	0x15, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x52, 0x65,
+	0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x30,
+	0x0a, 0x05, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x12, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x4c,
+	0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x13, 0x2e, 0x61, 0x75,
+	0x74, 0x68, 0x2e, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x48, 0x0a, 0x0d, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x12, 0x1a, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
+	0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e,
+	0x61, 0x75, 0x74, 0x68, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x6f, 0x6b,
+	0x65, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x15, 0x5a, 0x13, 0x61, 0x72,
+	0x67, 0x75, 0x73, 0x2d, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x72, 0x70, 0x63, 0x2f, 0x61, 0x75, 0x74,
+	0x68, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_rpc_auth_service_proto_rawDescOnce sync.Once
+	file_rpc_auth_service_proto_rawDescData = file_rpc_auth_service_proto_rawDesc
+)
+
+func file_rpc_auth_service_proto_rawDescGZIP() []byte {
+	file_rpc_auth_service_proto_rawDescOnce.Do(func() {
+		file_rpc_auth_service_proto_rawDescData = protoimpl.X.CompressGZIP(file_rpc_auth_service_proto_rawDescData)
+	})
+	return file_rpc_auth_service_proto_rawDescData
+}
+
+var file_rpc_auth_service_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
+var file_rpc_auth_service_proto_goTypes = []any{
+	(*RegisterRequest)(nil),       // 0: auth.RegisterRequest
+	(*RegisterResponse)(nil),      // 1: auth.RegisterResponse
+	(*LoginRequest)(nil),          // 2: auth.LoginRequest
+	(*LoginResponse)(nil),         // 3: auth.LoginResponse
+	(*ValidateTokenRequest)(nil),  // 4: auth.ValidateTokenRequest
+	(*ValidateTokenResponse)(nil), // 5: auth.ValidateTokenResponse
+	(*User)(nil),                  // 6: auth.User
+}
+var file_rpc_auth_service_proto_depIdxs = []int32{
+	6, // 0: auth.RegisterResponse.user:type_name -> auth.User
+	6, // 1: auth.LoginResponse.user:type_name -> auth.User
+	6, // 2: auth.ValidateTokenResponse.user:type_name -> auth.User
+	0, // 3: auth.AuthService.Register:input_type -> auth.RegisterRequest
+	2, // 4: auth.AuthService.Login:input_type -> auth.LoginRequest
+	4, // 5: auth.AuthService.ValidateToken:input_type -> auth.ValidateTokenRequest
+	1, // 6: auth.AuthService.Register:output_type -> auth.RegisterResponse
+	3, // 7: auth.AuthService.Login:output_type -> auth.LoginResponse
+	5, // 8: auth.AuthService.ValidateToken:output_type -> auth.ValidateTokenResponse
+	6, // [6:9] is the sub-list for method output_type
+	3, // [3:6] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_rpc_auth_service_proto_init() }
+func file_rpc_auth_service_proto_init() {
+	if File_rpc_auth_service_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_rpc_auth_service_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   7,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_rpc_auth_service_proto_goTypes,
+		DependencyIndexes: file_rpc_auth_service_proto_depIdxs,
+		MessageInfos:      file_rpc_auth_service_proto_msgTypes,
+	}.Build()
+	File_rpc_auth_service_proto = out.File
+	file_rpc_auth_service_proto_rawDesc = nil
+	file_rpc_auth_service_proto_goTypes = nil
+	file_rpc_auth_service_proto_depIdxs = nil
+}

@@ -0,0 +1,52 @@
+syntax = "proto3";
+
+package auth;
+option go_package = "argus-core/rpc/auth";
+
+// Authentication service handles user registration, login, and token validation.
+service AuthService {
+  // Register creates a new user account
+  rpc Register(RegisterRequest) returns (RegisterResponse);
+
+  // Login authenticates a user and returns a JWT token
+  rpc Login(LoginRequest) returns (LoginResponse);
+
+  // ValidateToken checks if a JWT token is valid and returns user information
+  rpc ValidateToken(ValidateTokenRequest) returns (ValidateTokenResponse);
+}
+
+// Request and Response messages
+message RegisterRequest {
+  string email = 1;
+  string password = 2;
+}
+
+message RegisterResponse {
+  User user = 1;
+}
+
+message LoginRequest {
+  string email = 1;
+  string password = 2;
+}
+
+message LoginResponse {
+  string token = 1;
+  User user = 2;
+}
+
+message ValidateTokenRequest {
+  string token = 1;
+}
+
+message ValidateTokenResponse {
+  User user = 1;
+}
+
+// Common messages
+message User {
+  string id = 1;
+  string email = 2;
+  string created_at = 3;
+  string updated_at = 4;
+}

@@ -0,0 +1,1675 @@
+// Code generated by protoc-gen-twirp v8.1.3, DO NOT EDIT.
+// source: rpc/auth/service.proto
+
+package auth
+
+import context "context"
+import fmt "fmt"
+import http "net/http"
+import io "io"
+import json "encoding/json"
+import strconv "strconv"
+import strings "strings"
+
+import protojson "google.golang.org/protobuf/encoding/protojson"
+import proto "google.golang.org/protobuf/proto"
+import twirp "github.com/twitchtv/twirp"
+import ctxsetters "github.com/twitchtv/twirp/ctxsetters"
+
+import bytes "bytes"
+import errors "errors"
+import path "path"
+import url "net/url"
+
+// Version compatibility assertion.
+// If the constant is not defined in the package, that likely means
+// the package needs to be updated to work with this generated code.
+// See https://twitchtv.github.io/twirp/docs/version_matrix.html
+const _ = twirp.TwirpPackageMinVersion_8_1_0
+
+// =====================
+// AuthService Interface
+// =====================
+
+// Authentication service handles user registration, login, and token validation.
+type AuthService interface {
+	// Register creates a new user account
+	Register(context.Context, *RegisterRequest) (*RegisterResponse, error)
+
+	// Login authenticates a user and returns a JWT token
+	Login(context.Context, *LoginRequest) (*LoginResponse, error)
+
+	// ValidateToken checks if a JWT token is valid and returns user information
+	ValidateToken(context.Context, *ValidateTokenRequest) (*ValidateTokenResponse, error)
+}
+
+// ===========================
+// AuthService Protobuf Client
+// ===========================
+
+type authServiceProtobufClient struct {
+	client      HTTPClient
+	urls        [3]string
+	interceptor twirp.Interceptor
+	opts        twirp.ClientOptions
+}
+
+// NewAuthServiceProtobufClient creates a Protobuf client that implements the AuthService interface.
+// It communicates using Protobuf and can be configured with a custom HTTPClient.
+func NewAuthServiceProtobufClient(baseURL string, client HTTPClient, opts ...twirp.ClientOption) AuthService {
+	if c, ok := client.(*http.Client); ok {
+		client = withoutRedirects(c)
+	}
+
+	clientOpts := twirp.ClientOptions{}
+	for _, o := range opts {
+		o(&clientOpts)
+	}
+
+	// Using ReadOpt allows backwards and forwards compatibility with new options in the future
+	literalURLs := false
+	_ = clientOpts.ReadOpt("literalURLs", &literalURLs)
+	var pathPrefix string
+	if ok := clientOpts.ReadOpt("pathPrefix", &pathPrefix); !ok {
+		pathPrefix = "/twirp" // default prefix
+	}
+
+	// Build method URLs: <baseURL>[<prefix>]/<package>.<Service>/<Method>
+	serviceURL := sanitizeBaseURL(baseURL)
+	serviceURL += baseServicePath(pathPrefix, "auth", "AuthService")
+	urls := [3]string{
+		serviceURL + "Register",
+		serviceURL + "Login",
+		serviceURL + "ValidateToken",
+	}
+
+	return &authServiceProtobufClient{
+		client:      client,
+		urls:        urls,
+		interceptor: twirp.ChainInterceptors(clientOpts.Interceptors...),
+		opts:        clientOpts,
+	}
+}
+
+func (c *authServiceProtobufClient) Register(ctx context.Context, in *RegisterRequest) (*RegisterResponse, error) {
+	ctx = ctxsetters.WithPackageName(ctx, "auth")
+	ctx = ctxsetters.WithServiceName(ctx, "AuthService")
+	ctx = ctxsetters.WithMethodName(ctx, "Register")
+	caller := c.callRegister
+	if c.interceptor != nil {
+		caller = func(ctx context.Context, req *RegisterRequest) (*RegisterResponse, error) {
+			resp, err := c.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*RegisterRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*RegisterRequest) when calling interceptor")
+					}
+					return c.callRegister(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*RegisterResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*RegisterResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+	return caller(ctx, in)
+}
+
+func (c *authServiceProtobufClient) callRegister(ctx context.Context, in *RegisterRequest) (*RegisterResponse, error) {
+	out := new(RegisterResponse)
+	ctx, err := doProtobufRequest(ctx, c.client, c.opts.Hooks, c.urls[0], in, out)
+	if err != nil {
+		twerr, ok := err.(twirp.Error)
+		if !ok {
+			twerr = twirp.InternalErrorWith(err)
+		}
+		callClientError(ctx, c.opts.Hooks, twerr)
+		return nil, err
+	}
+
+	callClientResponseReceived(ctx, c.opts.Hooks)
+
+	return out, nil
+}
+
+func (c *authServiceProtobufClient) Login(ctx context.Context, in *LoginRequest) (*LoginResponse, error) {
+	ctx = ctxsetters.WithPackageName(ctx, "auth")
+	ctx = ctxsetters.WithServiceName(ctx, "AuthService")
+	ctx = ctxsetters.WithMethodName(ctx, "Login")
+	caller := c.callLogin
+	if c.interceptor != nil {
+		caller = func(ctx context.Context, req *LoginRequest) (*LoginResponse, error) {
+			resp, err := c.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*LoginRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*LoginRequest) when calling interceptor")
+					}
+					return c.callLogin(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*LoginResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*LoginResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+	return caller(ctx, in)
+}
+
+func (c *authServiceProtobufClient) callLogin(ctx context.Context, in *LoginRequest) (*LoginResponse, error) {
+	out := new(LoginResponse)
+	ctx, err := doProtobufRequest(ctx, c.client, c.opts.Hooks, c.urls[1], in, out)
+	if err != nil {
+		twerr, ok := err.(twirp.Error)
+		if !ok {
+			twerr = twirp.InternalErrorWith(err)
+		}
+		callClientError(ctx, c.opts.Hooks, twerr)
+		return nil, err
+	}
+
+	callClientResponseReceived(ctx, c.opts.Hooks)
+
+	return out, nil
+}
+
+func (c *authServiceProtobufClient) ValidateToken(ctx context.Context, in *ValidateTokenRequest) (*ValidateTokenResponse, error) {
+	ctx = ctxsetters.WithPackageName(ctx, "auth")
+	ctx = ctxsetters.WithServiceName(ctx, "AuthService")
+	ctx = ctxsetters.WithMethodName(ctx, "ValidateToken")
+	caller := c.callValidateToken
+	if c.interceptor != nil {
+		caller = func(ctx context.Context, req *ValidateTokenRequest) (*ValidateTokenResponse, error) {
+			resp, err := c.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*ValidateTokenRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*ValidateTokenRequest) when calling interceptor")
+					}
+					return c.callValidateToken(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*ValidateTokenResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*ValidateTokenResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+	return caller(ctx, in)
+}
+
+func (c *authServiceProtobufClient) callValidateToken(ctx context.Context, in *ValidateTokenRequest) (*ValidateTokenResponse, error) {
+	out := new(ValidateTokenResponse)
+	ctx, err := doProtobufRequest(ctx, c.client, c.opts.Hooks, c.urls[2], in, out)
+	if err != nil {
+		twerr, ok := err.(twirp.Error)
+		if !ok {
+			twerr = twirp.InternalErrorWith(err)
+		}
+		callClientError(ctx, c.opts.Hooks, twerr)
+		return nil, err
+	}
+
+	callClientResponseReceived(ctx, c.opts.Hooks)
+
+	return out, nil
+}
+
+// =======================
+// AuthService JSON Client
+// =======================
+
+type authServiceJSONClient struct {
+	client      HTTPClient
+	urls        [3]string
+	interceptor twirp.Interceptor
+	opts        twirp.ClientOptions
+}
+
+// NewAuthServiceJSONClient creates a JSON client that implements the AuthService interface.
+// It communicates using JSON and can be configured with a custom HTTPClient.
+func NewAuthServiceJSONClient(baseURL string, client HTTPClient, opts ...twirp.ClientOption) AuthService {
+	if c, ok := client.(*http.Client); ok {
+		client = withoutRedirects(c)
+	}
+
+	clientOpts := twirp.ClientOptions{}
+	for _, o := range opts {
+		o(&clientOpts)
+	}
+
+	// Using ReadOpt allows backwards and forwards compatibility with new options in the future
+	literalURLs := false
+	_ = clientOpts.ReadOpt("literalURLs", &literalURLs)
+	var pathPrefix string
+	if ok := clientOpts.ReadOpt("pathPrefix", &pathPrefix); !ok {
+		pathPrefix = "/twirp" // default prefix
+	}
+
+	// Build method URLs: <baseURL>[<prefix>]/<package>.<Service>/<Method>
+	serviceURL := sanitizeBaseURL(baseURL)
+	serviceURL += baseServicePath(pathPrefix, "auth", "AuthService")
+	urls := [3]string{
+		serviceURL + "Register",
+		serviceURL + "Login",
+		serviceURL + "ValidateToken",
+	}
+
+	return &authServiceJSONClient{
+		client:      client,
+		urls:        urls,
+		interceptor: twirp.ChainInterceptors(clientOpts.Interceptors...),
+		opts:        clientOpts,
+	}
+}
+
+func (c *authServiceJSONClient) Register(ctx context.Context, in *RegisterRequest) (*RegisterResponse, error) {
+	ctx = ctxsetters.WithPackageName(ctx, "auth")
+	ctx = ctxsetters.WithServiceName(ctx, "AuthService")
+	ctx = ctxsetters.WithMethodName(ctx, "Register")
+	caller := c.callRegister
+	if c.interceptor != nil {
+		caller = func(ctx context.Context, req *RegisterRequest) (*RegisterResponse, error) {
+			resp, err := c.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*RegisterRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*RegisterRequest) when calling interceptor")
+					}
+					return c.callRegister(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*RegisterResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*RegisterResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+	return caller(ctx, in)
+}
+
+func (c *authServiceJSONClient) callRegister(ctx context.Context, in *RegisterRequest) (*RegisterResponse, error) {
+	out := new(RegisterResponse)
+	ctx, err := doJSONRequest(ctx, c.client, c.opts.Hooks, c.urls[0], in, out)
+	if err != nil {
+		twerr, ok := err.(twirp.Error)
+		if !ok {
+			twerr = twirp.InternalErrorWith(err)
+		}
+		callClientError(ctx, c.opts.Hooks, twerr)
+		return nil, err
+	}
+
+	callClientResponseReceived(ctx, c.opts.Hooks)
+
+	return out, nil
+}
+
+func (c *authServiceJSONClient) Login(ctx context.Context, in *LoginRequest) (*LoginResponse, error) {
+	ctx = ctxsetters.WithPackageName(ctx, "auth")
+	ctx = ctxsetters.WithServiceName(ctx, "AuthService")
+	ctx = ctxsetters.WithMethodName(ctx, "Login")
+	caller := c.callLogin
+	if c.interceptor != nil {
+		caller = func(ctx context.Context, req *LoginRequest) (*LoginResponse, error) {
+			resp, err := c.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*LoginRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*LoginRequest) when calling interceptor")
+					}
+					return c.callLogin(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*LoginResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*LoginResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+	return caller(ctx, in)
+}
+
+func (c *authServiceJSONClient) callLogin(ctx context.Context, in *LoginRequest) (*LoginResponse, error) {
+	out := new(LoginResponse)
+	ctx, err := doJSONRequest(ctx, c.client, c.opts.Hooks, c.urls[1], in, out)
+	if err != nil {
+		twerr, ok := err.(twirp.Error)
+		if !ok {
+			twerr = twirp.InternalErrorWith(err)
+		}
+		callClientError(ctx, c.opts.Hooks, twerr)
+		return nil, err
+	}
+
+	callClientResponseReceived(ctx, c.opts.Hooks)
+
+	return out, nil
+}
+
+func (c *authServiceJSONClient) ValidateToken(ctx context.Context, in *ValidateTokenRequest) (*ValidateTokenResponse, error) {
+	ctx = ctxsetters.WithPackageName(ctx, "auth")
+	ctx = ctxsetters.WithServiceName(ctx, "AuthService")
+	ctx = ctxsetters.WithMethodName(ctx, "ValidateToken")
+	caller := c.callValidateToken
+	if c.interceptor != nil {
+		caller = func(ctx context.Context, req *ValidateTokenRequest) (*ValidateTokenResponse, error) {
+			resp, err := c.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*ValidateTokenRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*ValidateTokenRequest) when calling interceptor")
+					}
+					return c.callValidateToken(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*ValidateTokenResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*ValidateTokenResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+	return caller(ctx, in)
+}
+
+func (c *authServiceJSONClient) callValidateToken(ctx context.Context, in *ValidateTokenRequest) (*ValidateTokenResponse, error) {
+	out := new(ValidateTokenResponse)
+	ctx, err := doJSONRequest(ctx, c.client, c.opts.Hooks, c.urls[2], in, out)
+	if err != nil {
+		twerr, ok := err.(twirp.Error)
+		if !ok {
+			twerr = twirp.InternalErrorWith(err)
+		}
+		callClientError(ctx, c.opts.Hooks, twerr)
+		return nil, err
+	}
+
+	callClientResponseReceived(ctx, c.opts.Hooks)
+
+	return out, nil
+}
+
+// ==========================
+// AuthService Server Handler
+// ==========================
+
+type authServiceServer struct {
+	AuthService
+	interceptor      twirp.Interceptor
+	hooks            *twirp.ServerHooks
+	pathPrefix       string // prefix for routing
+	jsonSkipDefaults bool   // do not include unpopulated fields (default values) in the response
+	jsonCamelCase    bool   // JSON fields are serialized as lowerCamelCase rather than keeping the original proto names
+}
+
+// NewAuthServiceServer builds a TwirpServer that can be used as an http.Handler to handle
+// HTTP requests that are routed to the right method in the provided svc implementation.
+// The opts are twirp.ServerOption modifiers, for example twirp.WithServerHooks(hooks).
+func NewAuthServiceServer(svc AuthService, opts ...interface{}) TwirpServer {
+	serverOpts := newServerOpts(opts)
+
+	// Using ReadOpt allows backwards and forwards compatibility with new options in the future
+	jsonSkipDefaults := false
+	_ = serverOpts.ReadOpt("jsonSkipDefaults", &jsonSkipDefaults)
+	jsonCamelCase := false
+	_ = serverOpts.ReadOpt("jsonCamelCase", &jsonCamelCase)
+	var pathPrefix string
+	if ok := serverOpts.ReadOpt("pathPrefix", &pathPrefix); !ok {
+		pathPrefix = "/twirp" // default prefix
+	}
+
+	return &authServiceServer{
+		AuthService:      svc,
+		hooks:            serverOpts.Hooks,
+		interceptor:      twirp.ChainInterceptors(serverOpts.Interceptors...),
+		pathPrefix:       pathPrefix,
+		jsonSkipDefaults: jsonSkipDefaults,
+		jsonCamelCase:    jsonCamelCase,
+	}
+}
+
+// writeError writes an HTTP response with a valid Twirp error format, and triggers hooks.
+// If err is not a twirp.Error, it will get wrapped with twirp.InternalErrorWith(err)
+func (s *authServiceServer) writeError(ctx context.Context, resp http.ResponseWriter, err error) {
+	writeError(ctx, resp, err, s.hooks)
+}
+
+// handleRequestBodyError is used to handle error when the twirp server cannot read request
+func (s *authServiceServer) handleRequestBodyError(ctx context.Context, resp http.ResponseWriter, msg string, err error) {
+	if context.Canceled == ctx.Err() {
+		s.writeError(ctx, resp, twirp.NewError(twirp.Canceled, "failed to read request: context canceled"))
+		return
+	}
+	if context.DeadlineExceeded == ctx.Err() {
+		s.writeError(ctx, resp, twirp.NewError(twirp.DeadlineExceeded, "failed to read request: deadline exceeded"))
+		return
+	}
+	s.writeError(ctx, resp, twirp.WrapError(malformedRequestError(msg), err))
+}
+
+// AuthServicePathPrefix is a convenience constant that may identify URL paths.
+// Should be used with caution, it only matches routes generated by Twirp Go clients,
+// with the default "/twirp" prefix and default CamelCase service and method names.
+// More info: https://twitchtv.github.io/twirp/docs/routing.html
+const AuthServicePathPrefix = "/twirp/auth.AuthService/"
+
+func (s *authServiceServer) ServeHTTP(resp http.ResponseWriter, req *http.Request) {
+	ctx := req.Context()
+	ctx = ctxsetters.WithPackageName(ctx, "auth")
+	ctx = ctxsetters.WithServiceName(ctx, "AuthService")
+	ctx = ctxsetters.WithResponseWriter(ctx, resp)
+
+	var err error
+	ctx, err = callRequestReceived(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	if req.Method != "POST" {
+		msg := fmt.Sprintf("unsupported method %q (only POST is allowed)", req.Method)
+		s.writeError(ctx, resp, badRouteError(msg, req.Method, req.URL.Path))
+		return
+	}
+
+	// Verify path format: [<prefix>]/<package>.<Service>/<Method>
+	prefix, pkgService, method := parseTwirpPath(req.URL.Path)
+	if pkgService != "auth.AuthService" {
+		msg := fmt.Sprintf("no handler for path %q", req.URL.Path)
+		s.writeError(ctx, resp, badRouteError(msg, req.Method, req.URL.Path))
+		return
+	}
+	if prefix != s.pathPrefix {
+		msg := fmt.Sprintf("invalid path prefix %q, expected %q, on path %q", prefix, s.pathPrefix, req.URL.Path)
+		s.writeError(ctx, resp, badRouteError(msg, req.Method, req.URL.Path))
+		return
+	}
+
+	switch method {
+	case "Register":
+		s.serveRegister(ctx, resp, req)
+		return
+	case "Login":
+		s.serveLogin(ctx, resp, req)
+		return
+	case "ValidateToken":
+		s.serveValidateToken(ctx, resp, req)
+		return
+	default:
+		msg := fmt.Sprintf("no handler for path %q", req.URL.Path)
+		s.writeError(ctx, resp, badRouteError(msg, req.Method, req.URL.Path))
+		return
+	}
+}
+
+func (s *authServiceServer) serveRegister(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	header := req.Header.Get("Content-Type")
+	i := strings.Index(header, ";")
+	if i == -1 {
+		i = len(header)
+	}
+	switch strings.TrimSpace(strings.ToLower(header[:i])) {
+	case "application/json":
+		s.serveRegisterJSON(ctx, resp, req)
+	case "application/protobuf":
+		s.serveRegisterProtobuf(ctx, resp, req)
+	default:
+		msg := fmt.Sprintf("unexpected Content-Type: %q", req.Header.Get("Content-Type"))
+		twerr := badRouteError(msg, req.Method, req.URL.Path)
+		s.writeError(ctx, resp, twerr)
+	}
+}
+
+func (s *authServiceServer) serveRegisterJSON(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	var err error
+	ctx = ctxsetters.WithMethodName(ctx, "Register")
+	ctx, err = callRequestRouted(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	d := json.NewDecoder(req.Body)
+	rawReqBody := json.RawMessage{}
+	if err := d.Decode(&rawReqBody); err != nil {
+		s.handleRequestBodyError(ctx, resp, "the json request could not be decoded", err)
+		return
+	}
+	reqContent := new(RegisterRequest)
+	unmarshaler := protojson.UnmarshalOptions{DiscardUnknown: true}
+	if err = unmarshaler.Unmarshal(rawReqBody, reqContent); err != nil {
+		s.handleRequestBodyError(ctx, resp, "the json request could not be decoded", err)
+		return
+	}
+
+	handler := s.AuthService.Register
+	if s.interceptor != nil {
+		handler = func(ctx context.Context, req *RegisterRequest) (*RegisterResponse, error) {
+			resp, err := s.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*RegisterRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*RegisterRequest) when calling interceptor")
+					}
+					return s.AuthService.Register(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*RegisterResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*RegisterResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+
+	// Call service method
+	var respContent *RegisterResponse
+	func() {
+		defer ensurePanicResponses(ctx, resp, s.hooks)
+		respContent, err = handler(ctx, reqContent)
+	}()
+
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+	if respContent == nil {
+		s.writeError(ctx, resp, twirp.InternalError("received a nil *RegisterResponse and nil error while calling Register. nil responses are not supported"))
+		return
+	}
+
+	ctx = callResponsePrepared(ctx, s.hooks)
+
+	marshaler := &protojson.MarshalOptions{UseProtoNames: !s.jsonCamelCase, EmitUnpopulated: !s.jsonSkipDefaults}
+	respBytes, err := marshaler.Marshal(respContent)
+	if err != nil {
+		s.writeError(ctx, resp, wrapInternal(err, "failed to marshal json response"))
+		return
+	}
+
+	ctx = ctxsetters.WithStatusCode(ctx, http.StatusOK)
+	resp.Header().Set("Content-Type", "application/json")
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBytes)))
+	resp.WriteHeader(http.StatusOK)
+
+	if n, err := resp.Write(respBytes); err != nil {
+		msg := fmt.Sprintf("failed to write response, %d of %d bytes written: %s", n, len(respBytes), err.Error())
+		twerr := twirp.NewError(twirp.Unknown, msg)
+		ctx = callError(ctx, s.hooks, twerr)
+	}
+	callResponseSent(ctx, s.hooks)
+}
+
+func (s *authServiceServer) serveRegisterProtobuf(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	var err error
+	ctx = ctxsetters.WithMethodName(ctx, "Register")
+	ctx, err = callRequestRouted(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	buf, err := io.ReadAll(req.Body)
+	if err != nil {
+		s.handleRequestBodyError(ctx, resp, "failed to read request body", err)
+		return
+	}
+	reqContent := new(RegisterRequest)
+	if err = proto.Unmarshal(buf, reqContent); err != nil {
+		s.writeError(ctx, resp, malformedRequestError("the protobuf request could not be decoded"))
+		return
+	}
+
+	handler := s.AuthService.Register
+	if s.interceptor != nil {
+		handler = func(ctx context.Context, req *RegisterRequest) (*RegisterResponse, error) {
+			resp, err := s.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*RegisterRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*RegisterRequest) when calling interceptor")
+					}
+					return s.AuthService.Register(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*RegisterResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*RegisterResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+
+	// Call service method
+	var respContent *RegisterResponse
+	func() {
+		defer ensurePanicResponses(ctx, resp, s.hooks)
+		respContent, err = handler(ctx, reqContent)
+	}()
+
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+	if respContent == nil {
+		s.writeError(ctx, resp, twirp.InternalError("received a nil *RegisterResponse and nil error while calling Register. nil responses are not supported"))
+		return
+	}
+
+	ctx = callResponsePrepared(ctx, s.hooks)
+
+	respBytes, err := proto.Marshal(respContent)
+	if err != nil {
+		s.writeError(ctx, resp, wrapInternal(err, "failed to marshal proto response"))
+		return
+	}
+
+	ctx = ctxsetters.WithStatusCode(ctx, http.StatusOK)
+	resp.Header().Set("Content-Type", "application/protobuf")
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBytes)))
+	resp.WriteHeader(http.StatusOK)
+	if n, err := resp.Write(respBytes); err != nil {
+		msg := fmt.Sprintf("failed to write response, %d of %d bytes written: %s", n, len(respBytes), err.Error())
+		twerr := twirp.NewError(twirp.Unknown, msg)
+		ctx = callError(ctx, s.hooks, twerr)
+	}
+	callResponseSent(ctx, s.hooks)
+}
+
+func (s *authServiceServer) serveLogin(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	header := req.Header.Get("Content-Type")
+	i := strings.Index(header, ";")
+	if i == -1 {
+		i = len(header)
+	}
+	switch strings.TrimSpace(strings.ToLower(header[:i])) {
+	case "application/json":
+		s.serveLoginJSON(ctx, resp, req)
+	case "application/protobuf":
+		s.serveLoginProtobuf(ctx, resp, req)
+	default:
+		msg := fmt.Sprintf("unexpected Content-Type: %q", req.Header.Get("Content-Type"))
+		twerr := badRouteError(msg, req.Method, req.URL.Path)
+		s.writeError(ctx, resp, twerr)
+	}
+}
+
+func (s *authServiceServer) serveLoginJSON(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	var err error
+	ctx = ctxsetters.WithMethodName(ctx, "Login")
+	ctx, err = callRequestRouted(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	d := json.NewDecoder(req.Body)
+	rawReqBody := json.RawMessage{}
+	if err := d.Decode(&rawReqBody); err != nil {
+		s.handleRequestBodyError(ctx, resp, "the json request could not be decoded", err)
+		return
+	}
+	reqContent := new(LoginRequest)
+	unmarshaler := protojson.UnmarshalOptions{DiscardUnknown: true}
+	if err = unmarshaler.Unmarshal(rawReqBody, reqContent); err != nil {
+		s.handleRequestBodyError(ctx, resp, "the json request could not be decoded", err)
+		return
+	}
+
+	handler := s.AuthService.Login
+	if s.interceptor != nil {
+		handler = func(ctx context.Context, req *LoginRequest) (*LoginResponse, error) {
+			resp, err := s.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*LoginRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*LoginRequest) when calling interceptor")
+					}
+					return s.AuthService.Login(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*LoginResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*LoginResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+
+	// Call service method
+	var respContent *LoginResponse
+	func() {
+		defer ensurePanicResponses(ctx, resp, s.hooks)
+		respContent, err = handler(ctx, reqContent)
+	}()
+
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+	if respContent == nil {
+		s.writeError(ctx, resp, twirp.InternalError("received a nil *LoginResponse and nil error while calling Login. nil responses are not supported"))
+		return
+	}
+
+	ctx = callResponsePrepared(ctx, s.hooks)
+
+	marshaler := &protojson.MarshalOptions{UseProtoNames: !s.jsonCamelCase, EmitUnpopulated: !s.jsonSkipDefaults}
+	respBytes, err := marshaler.Marshal(respContent)
+	if err != nil {
+		s.writeError(ctx, resp, wrapInternal(err, "failed to marshal json response"))
+		return
+	}
+
+	ctx = ctxsetters.WithStatusCode(ctx, http.StatusOK)
+	resp.Header().Set("Content-Type", "application/json")
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBytes)))
+	resp.WriteHeader(http.StatusOK)
+
+	if n, err := resp.Write(respBytes); err != nil {
+		msg := fmt.Sprintf("failed to write response, %d of %d bytes written: %s", n, len(respBytes), err.Error())
+		twerr := twirp.NewError(twirp.Unknown, msg)
+		ctx = callError(ctx, s.hooks, twerr)
+	}
+	callResponseSent(ctx, s.hooks)
+}
+
+func (s *authServiceServer) serveLoginProtobuf(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	var err error
+	ctx = ctxsetters.WithMethodName(ctx, "Login")
+	ctx, err = callRequestRouted(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	buf, err := io.ReadAll(req.Body)
+	if err != nil {
+		s.handleRequestBodyError(ctx, resp, "failed to read request body", err)
+		return
+	}
+	reqContent := new(LoginRequest)
+	if err = proto.Unmarshal(buf, reqContent); err != nil {
+		s.writeError(ctx, resp, malformedRequestError("the protobuf request could not be decoded"))
+		return
+	}
+
+	handler := s.AuthService.Login
+	if s.interceptor != nil {
+		handler = func(ctx context.Context, req *LoginRequest) (*LoginResponse, error) {
+			resp, err := s.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*LoginRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*LoginRequest) when calling interceptor")
+					}
+					return s.AuthService.Login(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*LoginResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*LoginResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+
+	// Call service method
+	var respContent *LoginResponse
+	func() {
+		defer ensurePanicResponses(ctx, resp, s.hooks)
+		respContent, err = handler(ctx, reqContent)
+	}()
+
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+	if respContent == nil {
+		s.writeError(ctx, resp, twirp.InternalError("received a nil *LoginResponse and nil error while calling Login. nil responses are not supported"))
+		return
+	}
+
+	ctx = callResponsePrepared(ctx, s.hooks)
+
+	respBytes, err := proto.Marshal(respContent)
+	if err != nil {
+		s.writeError(ctx, resp, wrapInternal(err, "failed to marshal proto response"))
+		return
+	}
+
+	ctx = ctxsetters.WithStatusCode(ctx, http.StatusOK)
+	resp.Header().Set("Content-Type", "application/protobuf")
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBytes)))
+	resp.WriteHeader(http.StatusOK)
+	if n, err := resp.Write(respBytes); err != nil {
+		msg := fmt.Sprintf("failed to write response, %d of %d bytes written: %s", n, len(respBytes), err.Error())
+		twerr := twirp.NewError(twirp.Unknown, msg)
+		ctx = callError(ctx, s.hooks, twerr)
+	}
+	callResponseSent(ctx, s.hooks)
+}
+
+func (s *authServiceServer) serveValidateToken(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	header := req.Header.Get("Content-Type")
+	i := strings.Index(header, ";")
+	if i == -1 {
+		i = len(header)
+	}
+	switch strings.TrimSpace(strings.ToLower(header[:i])) {
+	case "application/json":
+		s.serveValidateTokenJSON(ctx, resp, req)
+	case "application/protobuf":
+		s.serveValidateTokenProtobuf(ctx, resp, req)
+	default:
+		msg := fmt.Sprintf("unexpected Content-Type: %q", req.Header.Get("Content-Type"))
+		twerr := badRouteError(msg, req.Method, req.URL.Path)
+		s.writeError(ctx, resp, twerr)
+	}
+}
+
+func (s *authServiceServer) serveValidateTokenJSON(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	var err error
+	ctx = ctxsetters.WithMethodName(ctx, "ValidateToken")
+	ctx, err = callRequestRouted(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	d := json.NewDecoder(req.Body)
+	rawReqBody := json.RawMessage{}
+	if err := d.Decode(&rawReqBody); err != nil {
+		s.handleRequestBodyError(ctx, resp, "the json request could not be decoded", err)
+		return
+	}
+	reqContent := new(ValidateTokenRequest)
+	unmarshaler := protojson.UnmarshalOptions{DiscardUnknown: true}
+	if err = unmarshaler.Unmarshal(rawReqBody, reqContent); err != nil {
+		s.handleRequestBodyError(ctx, resp, "the json request could not be decoded", err)
+		return
+	}
+
+	handler := s.AuthService.ValidateToken
+	if s.interceptor != nil {
+		handler = func(ctx context.Context, req *ValidateTokenRequest) (*ValidateTokenResponse, error) {
+			resp, err := s.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*ValidateTokenRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*ValidateTokenRequest) when calling interceptor")
+					}
+					return s.AuthService.ValidateToken(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*ValidateTokenResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*ValidateTokenResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+
+	// Call service method
+	var respContent *ValidateTokenResponse
+	func() {
+		defer ensurePanicResponses(ctx, resp, s.hooks)
+		respContent, err = handler(ctx, reqContent)
+	}()
+
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+	if respContent == nil {
+		s.writeError(ctx, resp, twirp.InternalError("received a nil *ValidateTokenResponse and nil error while calling ValidateToken. nil responses are not supported"))
+		return
+	}
+
+	ctx = callResponsePrepared(ctx, s.hooks)
+
+	marshaler := &protojson.MarshalOptions{UseProtoNames: !s.jsonCamelCase, EmitUnpopulated: !s.jsonSkipDefaults}
+	respBytes, err := marshaler.Marshal(respContent)
+	if err != nil {
+		s.writeError(ctx, resp, wrapInternal(err, "failed to marshal json response"))
+		return
+	}
+
+	ctx = ctxsetters.WithStatusCode(ctx, http.StatusOK)
+	resp.Header().Set("Content-Type", "application/json")
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBytes)))
+	resp.WriteHeader(http.StatusOK)
+
+	if n, err := resp.Write(respBytes); err != nil {
+		msg := fmt.Sprintf("failed to write response, %d of %d bytes written: %s", n, len(respBytes), err.Error())
+		twerr := twirp.NewError(twirp.Unknown, msg)
+		ctx = callError(ctx, s.hooks, twerr)
+	}
+	callResponseSent(ctx, s.hooks)
+}
+
+func (s *authServiceServer) serveValidateTokenProtobuf(ctx context.Context, resp http.ResponseWriter, req *http.Request) {
+	var err error
+	ctx = ctxsetters.WithMethodName(ctx, "ValidateToken")
+	ctx, err = callRequestRouted(ctx, s.hooks)
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+
+	buf, err := io.ReadAll(req.Body)
+	if err != nil {
+		s.handleRequestBodyError(ctx, resp, "failed to read request body", err)
+		return
+	}
+	reqContent := new(ValidateTokenRequest)
+	if err = proto.Unmarshal(buf, reqContent); err != nil {
+		s.writeError(ctx, resp, malformedRequestError("the protobuf request could not be decoded"))
+		return
+	}
+
+	handler := s.AuthService.ValidateToken
+	if s.interceptor != nil {
+		handler = func(ctx context.Context, req *ValidateTokenRequest) (*ValidateTokenResponse, error) {
+			resp, err := s.interceptor(
+				func(ctx context.Context, req interface{}) (interface{}, error) {
+					typedReq, ok := req.(*ValidateTokenRequest)
+					if !ok {
+						return nil, twirp.InternalError("failed type assertion req.(*ValidateTokenRequest) when calling interceptor")
+					}
+					return s.AuthService.ValidateToken(ctx, typedReq)
+				},
+			)(ctx, req)
+			if resp != nil {
+				typedResp, ok := resp.(*ValidateTokenResponse)
+				if !ok {
+					return nil, twirp.InternalError("failed type assertion resp.(*ValidateTokenResponse) when calling interceptor")
+				}
+				return typedResp, err
+			}
+			return nil, err
+		}
+	}
+
+	// Call service method
+	var respContent *ValidateTokenResponse
+	func() {
+		defer ensurePanicResponses(ctx, resp, s.hooks)
+		respContent, err = handler(ctx, reqContent)
+	}()
+
+	if err != nil {
+		s.writeError(ctx, resp, err)
+		return
+	}
+	if respContent == nil {
+		s.writeError(ctx, resp, twirp.InternalError("received a nil *ValidateTokenResponse and nil error while calling ValidateToken. nil responses are not supported"))
+		return
+	}
+
+	ctx = callResponsePrepared(ctx, s.hooks)
+
+	respBytes, err := proto.Marshal(respContent)
+	if err != nil {
+		s.writeError(ctx, resp, wrapInternal(err, "failed to marshal proto response"))
+		return
+	}
+
+	ctx = ctxsetters.WithStatusCode(ctx, http.StatusOK)
+	resp.Header().Set("Content-Type", "application/protobuf")
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBytes)))
+	resp.WriteHeader(http.StatusOK)
+	if n, err := resp.Write(respBytes); err != nil {
+		msg := fmt.Sprintf("failed to write response, %d of %d bytes written: %s", n, len(respBytes), err.Error())
+		twerr := twirp.NewError(twirp.Unknown, msg)
+		ctx = callError(ctx, s.hooks, twerr)
+	}
+	callResponseSent(ctx, s.hooks)
+}
+
+func (s *authServiceServer) ServiceDescriptor() ([]byte, int) {
+	return twirpFileDescriptor0, 0
+}
+
+func (s *authServiceServer) ProtocGenTwirpVersion() string {
+	return "v8.1.3"
+}
+
+// PathPrefix returns the base service path, in the form: "/<prefix>/<package>.<Service>/"
+// that is everything in a Twirp route except for the <Method>. This can be used for routing,
+// for example to identify the requests that are targeted to this service in a mux.
+func (s *authServiceServer) PathPrefix() string {
+	return baseServicePath(s.pathPrefix, "auth", "AuthService")
+}
+
+// =====
+// Utils
+// =====
+
+// HTTPClient is the interface used by generated clients to send HTTP requests.
+// It is fulfilled by *(net/http).Client, which is sufficient for most users.
+// Users can provide their own implementation for special retry policies.
+//
+// HTTPClient implementations should not follow redirects. Redirects are
+// automatically disabled if *(net/http).Client is passed to client
+// constructors. See the withoutRedirects function in this file for more
+// details.
+type HTTPClient interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// TwirpServer is the interface generated server structs will support: they're
+// HTTP handlers with additional methods for accessing metadata about the
+// service. Those accessors are a low-level API for building reflection tools.
+// Most people can think of TwirpServers as just http.Handlers.
+type TwirpServer interface {
+	http.Handler
+
+	// ServiceDescriptor returns gzipped bytes describing the .proto file that
+	// this service was generated from. Once unzipped, the bytes can be
+	// unmarshalled as a
+	// google.golang.org/protobuf/types/descriptorpb.FileDescriptorProto.
+	//
+	// The returned integer is the index of this particular service within that
+	// FileDescriptorProto's 'Service' slice of ServiceDescriptorProtos. This is a
+	// low-level field, expected to be used for reflection.
+	ServiceDescriptor() ([]byte, int)
+
+	// ProtocGenTwirpVersion is the semantic version string of the version of
+	// twirp used to generate this file.
+	ProtocGenTwirpVersion() string
+
+	// PathPrefix returns the HTTP URL path prefix for all methods handled by this
+	// service. This can be used with an HTTP mux to route Twirp requests.
+	// The path prefix is in the form: "/<prefix>/<package>.<Service>/"
+	// that is, everything in a Twirp route except for the <Method> at the end.
+	PathPrefix() string
+}
+
+func newServerOpts(opts []interface{}) *twirp.ServerOptions {
+	serverOpts := &twirp.ServerOptions{}
+	for _, opt := range opts {
+		switch o := opt.(type) {
+		case twirp.ServerOption:
+			o(serverOpts)
+		case *twirp.ServerHooks: // backwards compatibility, allow to specify hooks as an argument
+			twirp.WithServerHooks(o)(serverOpts)
+		case nil: // backwards compatibility, allow nil value for the argument
+			continue
+		default:
+			panic(fmt.Sprintf("Invalid option type %T, please use a twirp.ServerOption", o))
+		}
+	}
+	return serverOpts
+}
+
+// WriteError writes an HTTP response with a valid Twirp error format (code, msg, meta).
+// Useful outside of the Twirp server (e.g. http middleware), but does not trigger hooks.
+// If err is not a twirp.Error, it will get wrapped with twirp.InternalErrorWith(err)
+func WriteError(resp http.ResponseWriter, err error) {
+	writeError(context.Background(), resp, err, nil)
+}
+
+// writeError writes Twirp errors in the response and triggers hooks.
+func writeError(ctx context.Context, resp http.ResponseWriter, err error, hooks *twirp.ServerHooks) {
+	// Convert to a twirp.Error. Non-twirp errors are converted to internal errors.
+	var twerr twirp.Error
+	if !errors.As(err, &twerr) {
+		twerr = twirp.InternalErrorWith(err)
+	}
+
+	statusCode := twirp.ServerHTTPStatusFromErrorCode(twerr.Code())
+	ctx = ctxsetters.WithStatusCode(ctx, statusCode)
+	ctx = callError(ctx, hooks, twerr)
+
+	respBody := marshalErrorToJSON(twerr)
+
+	resp.Header().Set("Content-Type", "application/json") // Error responses are always JSON
+	resp.Header().Set("Content-Length", strconv.Itoa(len(respBody)))
+	resp.WriteHeader(statusCode) // set HTTP status code and send response
+
+	_, writeErr := resp.Write(respBody)
+	if writeErr != nil {
+		// We have three options here. We could log the error, call the Error
+		// hook, or just silently ignore the error.
+		//
+		// Logging is unacceptable because we don't have a user-controlled
+		// logger; writing out to stderr without permission is too rude.
+		//
+		// Calling the Error hook would confuse users: it would mean the Error
+		// hook got called twice for one request, which is likely to lead to
+		// duplicated log messages and metrics, no matter how well we document
+		// the behavior.
+		//
+		// Silently ignoring the error is our least-bad option. It's highly
+		// likely that the connection is broken and the original 'err' says
+		// so anyway.
+		_ = writeErr
+	}
+
+	callResponseSent(ctx, hooks)
+}
+
+// sanitizeBaseURL parses the the baseURL, and adds the "http" scheme if needed.
+// If the URL is unparsable, the baseURL is returned unchanged.
+func sanitizeBaseURL(baseURL string) string {
+	u, err := url.Parse(baseURL)
+	if err != nil {
+		return baseURL // invalid URL will fail later when making requests
+	}
+	if u.Scheme == "" {
+		u.Scheme = "http"
+	}
+	return u.String()
+}
+
+// baseServicePath composes the path prefix for the service (without <Method>).
+// e.g.: baseServicePath("/twirp", "my.pkg", "MyService")
+//
+//	returns => "/twirp/my.pkg.MyService/"
+//
+// e.g.: baseServicePath("", "", "MyService")
+//
+//	returns => "/MyService/"
+func baseServicePath(prefix, pkg, service string) string {
+	fullServiceName := service
+	if pkg != "" {
+		fullServiceName = pkg + "." + service
+	}
+	return path.Join("/", prefix, fullServiceName) + "/"
+}
+
+// parseTwirpPath extracts path components form a valid Twirp route.
+// Expected format: "[<prefix>]/<package>.<Service>/<Method>"
+// e.g.: prefix, pkgService, method := parseTwirpPath("/twirp/pkg.Svc/MakeHat")
+func parseTwirpPath(path string) (string, string, string) {
+	parts := strings.Split(path, "/")
+	if len(parts) < 2 {
+		return "", "", ""
+	}
+	method := parts[len(parts)-1]
+	pkgService := parts[len(parts)-2]
+	prefix := strings.Join(parts[0:len(parts)-2], "/")
+	return prefix, pkgService, method
+}
+
+// getCustomHTTPReqHeaders retrieves a copy of any headers that are set in
+// a context through the twirp.WithHTTPRequestHeaders function.
+// If there are no headers set, or if they have the wrong type, nil is returned.
+func getCustomHTTPReqHeaders(ctx context.Context) http.Header {
+	header, ok := twirp.HTTPRequestHeaders(ctx)
+	if !ok || header == nil {
+		return nil
+	}
+	copied := make(http.Header)
+	for k, vv := range header {
+		if vv == nil {
+			copied[k] = nil
+			continue
+		}
+		copied[k] = make([]string, len(vv))
+		copy(copied[k], vv)
+	}
+	return copied
+}
+
+// newRequest makes an http.Request from a client, adding common headers.
+func newRequest(ctx context.Context, url string, reqBody io.Reader, contentType string) (*http.Request, error) {
+	req, err := http.NewRequest("POST", url, reqBody)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if customHeader := getCustomHTTPReqHeaders(ctx); customHeader != nil {
+		req.Header = customHeader
+	}
+	req.Header.Set("Accept", contentType)
+	req.Header.Set("Content-Type", contentType)
+	req.Header.Set("Twirp-Version", "v8.1.3")
+	return req, nil
+}
+
+// JSON serialization for errors
+type twerrJSON struct {
+	Code string            `json:"code"`
+	Msg  string            `json:"msg"`
+	Meta map[string]string `json:"meta,omitempty"`
+}
+
+// marshalErrorToJSON returns JSON from a twirp.Error, that can be used as HTTP error response body.
+// If serialization fails, it will use a descriptive Internal error instead.
+func marshalErrorToJSON(twerr twirp.Error) []byte {
+	// make sure that msg is not too large
+	msg := twerr.Msg()
+	if len(msg) > 1e6 {
+		msg = msg[:1e6]
+	}
+
+	tj := twerrJSON{
+		Code: string(twerr.Code()),
+		Msg:  msg,
+		Meta: twerr.MetaMap(),
+	}
+
+	buf, err := json.Marshal(&tj)
+	if err != nil {
+		buf = []byte("{\"type\": \"" + twirp.Internal + "\", \"msg\": \"There was an error but it could not be serialized into JSON\"}") // fallback
+	}
+
+	return buf
+}
+
+// errorFromResponse builds a twirp.Error from a non-200 HTTP response.
+// If the response has a valid serialized Twirp error, then it's returned.
+// If not, the response status code is used to generate a similar twirp
+// error. See twirpErrorFromIntermediary for more info on intermediary errors.
+func errorFromResponse(resp *http.Response) twirp.Error {
+	statusCode := resp.StatusCode
+	statusText := http.StatusText(statusCode)
+
+	if isHTTPRedirect(statusCode) {
+		// Unexpected redirect: it must be an error from an intermediary.
+		// Twirp clients don't follow redirects automatically, Twirp only handles
+		// POST requests, redirects should only happen on GET and HEAD requests.
+		location := resp.Header.Get("Location")
+		msg := fmt.Sprintf("unexpected HTTP status code %d %q received, Location=%q", statusCode, statusText, location)
+		return twirpErrorFromIntermediary(statusCode, msg, location)
+	}
+
+	respBodyBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return wrapInternal(err, "failed to read server error response body")
+	}
+
+	var tj twerrJSON
+	dec := json.NewDecoder(bytes.NewReader(respBodyBytes))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&tj); err != nil || tj.Code == "" {
+		// Invalid JSON response; it must be an error from an intermediary.
+		msg := fmt.Sprintf("Error from intermediary with HTTP status code %d %q", statusCode, statusText)
+		return twirpErrorFromIntermediary(statusCode, msg, string(respBodyBytes))
+	}
+
+	errorCode := twirp.ErrorCode(tj.Code)
+	if !twirp.IsValidErrorCode(errorCode) {
+		msg := "invalid type returned from server error response: " + tj.Code
+		return twirp.InternalError(msg).WithMeta("body", string(respBodyBytes))
+	}
+
+	twerr := twirp.NewError(errorCode, tj.Msg)
+	for k, v := range tj.Meta {
+		twerr = twerr.WithMeta(k, v)
+	}
+	return twerr
+}
+
+// twirpErrorFromIntermediary maps HTTP errors from non-twirp sources to twirp errors.
+// The mapping is similar to gRPC: https://github.com/grpc/grpc/blob/master/doc/http-grpc-status-mapping.md.
+// Returned twirp Errors have some additional metadata for inspection.
+func twirpErrorFromIntermediary(status int, msg string, bodyOrLocation string) twirp.Error {
+	var code twirp.ErrorCode
+	if isHTTPRedirect(status) { // 3xx
+		code = twirp.Internal
+	} else {
+		switch status {
+		case 400: // Bad Request
+			code = twirp.Internal
+		case 401: // Unauthorized
+			code = twirp.Unauthenticated
+		case 403: // Forbidden
+			code = twirp.PermissionDenied
+		case 404: // Not Found
+			code = twirp.BadRoute
+		case 429: // Too Many Requests
+			code = twirp.ResourceExhausted
+		case 502, 503, 504: // Bad Gateway, Service Unavailable, Gateway Timeout
+			code = twirp.Unavailable
+		default: // All other codes
+			code = twirp.Unknown
+		}
+	}
+
+	twerr := twirp.NewError(code, msg)
+	twerr = twerr.WithMeta("http_error_from_intermediary", "true") // to easily know if this error was from intermediary
+	twerr = twerr.WithMeta("status_code", strconv.Itoa(status))
+	if isHTTPRedirect(status) {
+		twerr = twerr.WithMeta("location", bodyOrLocation)
+	} else {
+		twerr = twerr.WithMeta("body", bodyOrLocation)
+	}
+	return twerr
+}
+
+func isHTTPRedirect(status int) bool {
+	return status >= 300 && status <= 399
+}
+
+// wrapInternal wraps an error with a prefix as an Internal error.
+// The original error cause is accessible by github.com/pkg/errors.Cause.
+func wrapInternal(err error, prefix string) twirp.Error {
+	return twirp.InternalErrorWith(&wrappedError{prefix: prefix, cause: err})
+}
+
+type wrappedError struct {
+	prefix string
+	cause  error
+}
+
+func (e *wrappedError) Error() string { return e.prefix + ": " + e.cause.Error() }
+func (e *wrappedError) Unwrap() error { return e.cause } // for go1.13 + errors.Is/As
+func (e *wrappedError) Cause() error  { return e.cause } // for github.com/pkg/errors
+
+// ensurePanicResponses makes sure that rpc methods causing a panic still result in a Twirp Internal
+// error response (status 500), and error hooks are properly called with the panic wrapped as an error.
+// The panic is re-raised so it can be handled normally with middleware.
+func ensurePanicResponses(ctx context.Context, resp http.ResponseWriter, hooks *twirp.ServerHooks) {
+	if r := recover(); r != nil {
+		// Wrap the panic as an error so it can be passed to error hooks.
+		// The original error is accessible from error hooks, but not visible in the response.
+		err := errFromPanic(r)
+		twerr := &internalWithCause{msg: "Internal service panic", cause: err}
+		// Actually write the error
+		writeError(ctx, resp, twerr, hooks)
+		// If possible, flush the error to the wire.
+		f, ok := resp.(http.Flusher)
+		if ok {
+			f.Flush()
+		}
+
+		panic(r)
+	}
+}
+
+// errFromPanic returns the typed error if the recovered panic is an error, otherwise formats as error.
+func errFromPanic(p interface{}) error {
+	if err, ok := p.(error); ok {
+		return err
+	}
+	return fmt.Errorf("panic: %v", p)
+}
+
+// internalWithCause is a Twirp Internal error wrapping an original error cause,
+// but the original error message is not exposed on Msg(). The original error
+// can be checked with go1.13+ errors.Is/As, and also by (github.com/pkg/errors).Unwrap
+type internalWithCause struct {
+	msg   string
+	cause error
+}
+
+func (e *internalWithCause) Unwrap() error                               { return e.cause } // for go1.13 + errors.Is/As
+func (e *internalWithCause) Cause() error                                { return e.cause } // for github.com/pkg/errors
+func (e *internalWithCause) Error() string                               { return e.msg + ": " + e.cause.Error() }
+func (e *internalWithCause) Code() twirp.ErrorCode                       { return twirp.Internal }
+func (e *internalWithCause) Msg() string                                 { return e.msg }
+func (e *internalWithCause) Meta(key string) string                      { return "" }
+func (e *internalWithCause) MetaMap() map[string]string                  { return nil }
+func (e *internalWithCause) WithMeta(key string, val string) twirp.Error { return e }
+
+// malformedRequestError is used when the twirp server cannot unmarshal a request
+func malformedRequestError(msg string) twirp.Error {
+	return twirp.NewError(twirp.Malformed, msg)
+}
+
+// badRouteError is used when the twirp server cannot route a request
+func badRouteError(msg string, method, url string) twirp.Error {
+	err := twirp.NewError(twirp.BadRoute, msg)
+	err = err.WithMeta("twirp_invalid_route", method+" "+url)
+	return err
+}
+
+// withoutRedirects makes sure that the POST request can not be redirected.
+// The standard library will, by default, redirect requests (including POSTs) if it gets a 302 or
+// 303 response, and also 301s in go1.8. It redirects by making a second request, changing the
+// method to GET and removing the body. This produces very confusing error messages, so instead we
+// set a redirect policy that always errors. This stops Go from executing the redirect.
+//
+// We have to be a little careful in case the user-provided http.Client has its own CheckRedirect
+// policy - if so, we'll run through that policy first.
+//
+// Because this requires modifying the http.Client, we make a new copy of the client and return it.
+func withoutRedirects(in *http.Client) *http.Client {
+	copy := *in
+	copy.CheckRedirect = func(req *http.Request, via []*http.Request) error {
+		if in.CheckRedirect != nil {
+			// Run the input's redirect if it exists, in case it has side effects, but ignore any error it
+			// returns, since we want to use ErrUseLastResponse.
+			err := in.CheckRedirect(req, via)
+			_ = err // Silly, but this makes sure generated code passes errcheck -blank, which some people use.
+		}
+		return http.ErrUseLastResponse
+	}
+	return &copy
+}
+
+// doProtobufRequest makes a Protobuf request to the remote Twirp service.
+func doProtobufRequest(ctx context.Context, client HTTPClient, hooks *twirp.ClientHooks, url string, in, out proto.Message) (_ context.Context, err error) {
+	reqBodyBytes, err := proto.Marshal(in)
+	if err != nil {
+		return ctx, wrapInternal(err, "failed to marshal proto request")
+	}
+	reqBody := bytes.NewBuffer(reqBodyBytes)
+	if err = ctx.Err(); err != nil {
+		return ctx, wrapInternal(err, "aborted because context was done")
+	}
+
+	req, err := newRequest(ctx, url, reqBody, "application/protobuf")
+	if err != nil {
+		return ctx, wrapInternal(err, "could not build request")
+	}
+	ctx, err = callClientRequestPrepared(ctx, hooks, req)
+	if err != nil {
+		return ctx, err
+	}
+
+	req = req.WithContext(ctx)
+	resp, err := client.Do(req)
+	if err != nil {
+		return ctx, wrapInternal(err, "failed to do request")
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if err = ctx.Err(); err != nil {
+		return ctx, wrapInternal(err, "aborted because context was done")
+	}
+
+	if resp.StatusCode != 200 {
+		return ctx, errorFromResponse(resp)
+	}
+
+	respBodyBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return ctx, wrapInternal(err, "failed to read response body")
+	}
+	if err = ctx.Err(); err != nil {
+		return ctx, wrapInternal(err, "aborted because context was done")
+	}
+
+	if err = proto.Unmarshal(respBodyBytes, out); err != nil {
+		return ctx, wrapInternal(err, "failed to unmarshal proto response")
+	}
+	return ctx, nil
+}
+
+// doJSONRequest makes a JSON request to the remote Twirp service.
+func doJSONRequest(ctx context.Context, client HTTPClient, hooks *twirp.ClientHooks, url string, in, out proto.Message) (_ context.Context, err error) {
+	marshaler := &protojson.MarshalOptions{UseProtoNames: true}
+	reqBytes, err := marshaler.Marshal(in)
+	if err != nil {
+		return ctx, wrapInternal(err, "failed to marshal json request")
+	}
+	if err = ctx.Err(); err != nil {
+		return ctx, wrapInternal(err, "aborted because context was done")
+	}
+
+	req, err := newRequest(ctx, url, bytes.NewReader(reqBytes), "application/json")
+	if err != nil {
+		return ctx, wrapInternal(err, "could not build request")
+	}
+	ctx, err = callClientRequestPrepared(ctx, hooks, req)
+	if err != nil {
+		return ctx, err
+	}
+
+	req = req.WithContext(ctx)
+	resp, err := client.Do(req)
+	if err != nil {
+		return ctx, wrapInternal(err, "failed to do request")
+	}
+
+	defer func() {
+		cerr := resp.Body.Close()
+		if err == nil && cerr != nil {
+			err = wrapInternal(cerr, "failed to close response body")
+		}
+	}()
+
+	if err = ctx.Err(); err != nil {
+		return ctx, wrapInternal(err, "aborted because context was done")
+	}
+
+	if resp.StatusCode != 200 {
+		return ctx, errorFromResponse(resp)
+	}
+
+	d := json.NewDecoder(resp.Body)
+	rawRespBody := json.RawMessage{}
+	if err := d.Decode(&rawRespBody); err != nil {
+		return ctx, wrapInternal(err, "failed to unmarshal json response")
+	}
+	unmarshaler := protojson.UnmarshalOptions{DiscardUnknown: true}
+	if err = unmarshaler.Unmarshal(rawRespBody, out); err != nil {
+		return ctx, wrapInternal(err, "failed to unmarshal json response")
+	}
+	if err = ctx.Err(); err != nil {
+		return ctx, wrapInternal(err, "aborted because context was done")
+	}
+	return ctx, nil
+}
+
+// Call twirp.ServerHooks.RequestReceived if the hook is available
+func callRequestReceived(ctx context.Context, h *twirp.ServerHooks) (context.Context, error) {
+	if h == nil || h.RequestReceived == nil {
+		return ctx, nil
+	}
+	return h.RequestReceived(ctx)
+}
+
+// Call twirp.ServerHooks.RequestRouted if the hook is available
+func callRequestRouted(ctx context.Context, h *twirp.ServerHooks) (context.Context, error) {
+	if h == nil || h.RequestRouted == nil {
+		return ctx, nil
+	}
+	return h.RequestRouted(ctx)
+}
+
+// Call twirp.ServerHooks.ResponsePrepared if the hook is available
+func callResponsePrepared(ctx context.Context, h *twirp.ServerHooks) context.Context {
+	if h == nil || h.ResponsePrepared == nil {
+		return ctx
+	}
+	return h.ResponsePrepared(ctx)
+}
+
+// Call twirp.ServerHooks.ResponseSent if the hook is available
+func callResponseSent(ctx context.Context, h *twirp.ServerHooks) {
+	if h == nil || h.ResponseSent == nil {
+		return
+	}
+	h.ResponseSent(ctx)
+}
+
+// Call twirp.ServerHooks.Error if the hook is available
+func callError(ctx context.Context, h *twirp.ServerHooks, err twirp.Error) context.Context {
+	if h == nil || h.Error == nil {
+		return ctx
+	}
+	return h.Error(ctx, err)
+}
+
+func callClientResponseReceived(ctx context.Context, h *twirp.ClientHooks) {
+	if h == nil || h.ResponseReceived == nil {
+		return
+	}
+	h.ResponseReceived(ctx)
+}
+
+func callClientRequestPrepared(ctx context.Context, h *twirp.ClientHooks, req *http.Request) (context.Context, error) {
+	if h == nil || h.RequestPrepared == nil {
+		return ctx, nil
+	}
+	return h.RequestPrepared(ctx, req)
+}
+
+func callClientError(ctx context.Context, h *twirp.ClientHooks, err twirp.Error) {
+	if h == nil || h.Error == nil {
+		return
+	}
+	h.Error(ctx, err)
+}
+
+var twirpFileDescriptor0 = []byte{
+	// 338 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x52, 0xbb, 0x4e, 0x03, 0x31,
+	0x10, 0x54, 0x8e, 0x0b, 0x4a, 0x36, 0x04, 0x90, 0xf3, 0x50, 0x74, 0x08, 0x84, 0xae, 0xa2, 0x80,
+	0x04, 0x85, 0x02, 0xd1, 0x11, 0x10, 0x12, 0x05, 0xd5, 0xf1, 0x28, 0x68, 0x90, 0x39, 0xaf, 0x12,
+	0x43, 0x88, 0x0f, 0x3f, 0xe0, 0x07, 0xf9, 0x30, 0x74, 0xb6, 0x2f, 0x2f, 0x82, 0x84, 0x28, 0x77,
+	0x66, 0x3d, 0xbb, 0xb3, 0x63, 0x68, 0xcb, 0x2c, 0xed, 0x51, 0xa3, 0x47, 0x3d, 0x85, 0xf2, 0x83,
+	0xa7, 0xd8, 0xcd, 0xa4, 0xd0, 0x82, 0x84, 0x39, 0x16, 0x5f, 0xc2, 0x56, 0x82, 0x43, 0xae, 0x34,
+	0xca, 0x04, 0xdf, 0x0d, 0x2a, 0x4d, 0x9a, 0x50, 0xc6, 0x37, 0xca, 0xc7, 0x9d, 0xd2, 0x7e, 0xe9,
+	0xa0, 0x9a, 0xb8, 0x82, 0x44, 0x50, 0xc9, 0xa8, 0x52, 0x9f, 0x42, 0xb2, 0x4e, 0x60, 0x89, 0x69,
+	0x1d, 0xf7, 0x61, 0x7b, 0x26, 0xa2, 0x32, 0x31, 0x51, 0x48, 0xf6, 0x20, 0x34, 0x0a, 0xa5, 0x15,
+	0xa9, 0xf5, 0xa1, 0x9b, 0x4f, 0xeb, 0xde, 0x2b, 0x94, 0x89, 0xc5, 0xe3, 0x73, 0xd8, 0xb8, 0x11,
+	0x43, 0x3e, 0xf9, 0xff, 0xd4, 0x2b, 0xa8, 0x7b, 0x05, 0x3f, 0xb2, 0x09, 0x65, 0x2d, 0x5e, 0x71,
+	0x52, 0x48, 0xd8, 0x62, 0xba, 0x48, 0xf0, 0xcb, 0x22, 0x87, 0xd0, 0x7c, 0xa0, 0x63, 0xce, 0xa8,
+	0xc6, 0xbb, 0xfc, 0xc1, 0xdc, 0x42, 0x3f, 0xd5, 0xe2, 0x53, 0x68, 0x2d, 0x75, 0xff, 0xd1, 0xef,
+	0x0b, 0x84, 0x79, 0x45, 0x36, 0x21, 0xe0, 0xcc, 0x6b, 0x06, 0x9c, 0xcd, 0x7c, 0x07, 0xf3, 0xbe,
+	0x77, 0x01, 0x52, 0x89, 0x54, 0x23, 0x7b, 0xa2, 0xba, 0xb3, 0x66, 0xa9, 0xaa, 0x47, 0x06, 0x3a,
+	0xa7, 0x4d, 0xc6, 0x0a, 0x3a, 0x74, 0xb4, 0x47, 0x06, 0xba, 0xff, 0x55, 0x82, 0xda, 0xc0, 0xe8,
+	0xd1, 0xad, 0x0b, 0x9c, 0x9c, 0x41, 0xa5, 0xc8, 0x87, 0xb4, 0xdc, 0x66, 0x4b, 0xa1, 0x47, 0xed,
+	0x65, 0xd8, 0xdb, 0x3a, 0x86, 0xb2, 0x3d, 0x32, 0x21, 0xae, 0x61, 0x3e, 0xb3, 0xa8, 0xb1, 0x80,
+	0xf9, 0x17, 0xd7, 0x50, 0x5f, 0xb8, 0x10, 0x89, 0x5c, 0xd7, 0xaa, 0x23, 0x47, 0x3b, 0x2b, 0x39,
+	0xa7, 0x74, 0xd1, 0x7a, 0x6c, 0x50, 0x39, 0x34, 0xea, 0x28, 0x15, 0x12, 0x7b, 0xc5, 0x37, 0x7e,
+	0x5e, 0xb7, 0xff, 0xf7, 0xe4, 0x3b, 0x00, 0x00, 0xff, 0xff, 0xc8, 0xd4, 0x3c, 0xb4, 0xd9, 0x02,
+	0x00, 0x00,
+}