diff --git a/README.md b/README.md
index ee1742a..194d1b8 100644
--- a/README.md
+++ b/README.md
@@ -44,7 +44,7 @@ Download latest version of Vagrant from [downloads.vagrantup.com](http://downloa
 
 
 ## Design References
-A similar data model might allready [exist](http://www.databaseanswers.org/data_models/generic_foundation/index.htm) [out](http://www.databaseanswers.org/data_models/organisations_and_people_and_transactions/index.htm) [there](http://www.databaseanswers.org/data_models/organisations_and_people/index.htm).
+A similar data model might allready [exist](http://www.databaseanswers.org/data_models/generic_foundation/index.htm) [out](http://www.databaseanswers.org/data_models/organisations_and_people_and_transactions/index.htm) [there](http://www.databaseanswers.org/data_models/organisations_and_people/index.htm), [somewhere](http://www.databaseanswers.org/data_models/magazine_subscriptions/index.htm).
 
 ## Developer References
 
diff --git a/dusken/urls.py b/dusken/urls.py
index 37d1bd2..5be6189 100644
--- a/dusken/urls.py
+++ b/dusken/urls.py
@@ -18,4 +18,5 @@ v1_api.register(InstitutionResource())
 urlpatterns = patterns('',
     url(r'^admin/', include(admin.site.urls)),
     url(r'^api/', include(v1_api.urls)),
+    url(r'^authenticate/', 'dusken.views.authenticate')
 )
diff --git a/dusken/views.py b/dusken/views.py
index 60f00ef..9821402 100644
--- a/dusken/views.py
+++ b/dusken/views.py
@@ -1 +1,19 @@
-# Create your views here.
+import json
+from django.contrib.auth.forms import AuthenticationForm
+from django.http import HttpResponse
+from django.views.decorators.csrf import csrf_exempt
+
+@csrf_exempt
+def authenticate(request):
+    # TODO is this right?
+    if request.method == "POST":
+        form = AuthenticationForm(data=request.POST)
+        if form.is_valid():
+            # get apikey and return it
+            user = form.get_user()
+            api_key = user.api_key.key
+            return HttpResponse(json.dumps({'api_key': api_key}), content_type='application/javascript; charset=utf8')
+        else:
+            return HttpResponse(json.dumps({'error': 'unauthorized'}), content_type='application/javascript; charset=utf8', status=401)
+    else:
+        return HttpResponse(json.dumps({'error': 'unauthorized'}), content_type='application/javascript; charset=utf8', status=401)