diff --git a/src/core/server/app/handlers/auth/local.ts b/src/core/server/app/handlers/auth/local.ts
new file mode 100644
index 000000000..dbd47bb50
--- /dev/null
+++ b/src/core/server/app/handlers/auth/local.ts
@@ -0,0 +1,8 @@
+import { RequestHandler } from "express";
+
+import { Request } from "talk-server/types/express";
+
+export const signup: RequestHandler = async (req: Request, res, next) => {
+  // TODO: implement
+  res.send("ok");
+};
diff --git a/src/core/server/app/middleware/passport/index.ts b/src/core/server/app/middleware/passport/index.ts
index 1b6968564..cd857a172 100644
--- a/src/core/server/app/middleware/passport/index.ts
+++ b/src/core/server/app/middleware/passport/index.ts
@@ -1,4 +1,4 @@
-import { NextFunction, Response } from "express";
+import { NextFunction, RequestHandler, Response } from "express";
 import { Db } from "mongodb";
 import passport, { Authenticator } from "passport";
 
@@ -10,7 +10,7 @@ import { Request } from "talk-server/types/express";
 export type VerifyCallback = (
   err?: Error | null,
   user?: User | null,
-  info?: object
+  info?: { message: string }
 ) => void;
 
 export interface PassportOptions {
@@ -32,28 +32,33 @@ export function createPassport({
   return auth;
 }
 
+export const handle = (
+  err: Error | null,
+  user: User | null
+): RequestHandler => (req: Request, res, next) => {
+  if (err) {
+    // TODO: wrap error?
+    return next(err);
+  }
+
+  // Set the cache control headers.
+  res.header("Cache-Control", "private, no-cache, no-store, must-revalidate");
+  res.header("Expires", "-1");
+  res.header("Pragma", "no-cache");
+
+  // Send back the details!
+
+  // TODO: return the token instead of the user.
+  res.json({ user });
+};
+
 export const authenticate = (
   authenticator: passport.Authenticator,
-  name: string
-) => (req: Request, res: Response, next: NextFunction) =>
+  name: string,
+  options?: any
+): RequestHandler => (req: Request, res, next) =>
   authenticator.authenticate(
     name,
-    { session: false },
-    (err: Error | null, user: User | null) => {
-      if (err) {
-        // TODO: wrap error?
-        return next(err);
-      }
-
-      // Set the cache control headers.
-      res.header(
-        "Cache-Control",
-        "private, no-cache, no-store, must-revalidate"
-      );
-      res.header("Expires", "-1");
-      res.header("Pragma", "no-cache");
-
-      // Send back the details!
-      res.json({ user });
-    }
+    { ...options, session: false },
+    (err: Error | null, user: User | null) => handle(err, user)(req, res, next)
   )(req, res, next);
diff --git a/src/core/server/app/middleware/passport/local.ts b/src/core/server/app/middleware/passport/local.ts
index 4aa707153..67dfe3b02 100644
--- a/src/core/server/app/middleware/passport/local.ts
+++ b/src/core/server/app/middleware/passport/local.ts
@@ -8,13 +8,12 @@ import {
 } from "talk-server/models/user";
 import { Request } from "talk-server/types/express";
 
-async function verify(
-  db: Db,
+const verifyFactory = (db: Db) => async (
   req: Request,
   email: string,
   password: string,
   done: VerifyCallback
-) {
+) => {
   try {
     // The tenant is guaranteed at this point.
     const tenant = req.tenant!;
@@ -42,7 +41,7 @@ async function verify(
   } catch (err) {
     return done(err);
   }
-}
+};
 
 export interface LocalStrategyOptions {
   db: Db;
@@ -56,6 +55,6 @@ export function createLocalStrategy({ db }: LocalStrategyOptions) {
       session: false,
       passReqToCallback: true,
     },
-    verify.bind(null, db)
+    verifyFactory(db)
   );
 }
diff --git a/src/core/server/app/router.ts b/src/core/server/app/router.ts
index a1a668b51..ba7c9e5da 100644
--- a/src/core/server/app/router.ts
+++ b/src/core/server/app/router.ts
@@ -5,6 +5,7 @@ import tenantMiddleware from "talk-server/app/middleware/tenant";
 import managementGraphMiddleware from "talk-server/graph/management/middleware";
 import tenantGraphMiddleware from "talk-server/graph/tenant/middleware";
 
+import { signup } from "talk-server/app/handlers/auth/local";
 import { authenticate } from "talk-server/app/middleware/passport";
 import { AppOptions } from "./index";
 import playground from "./middleware/playground";
@@ -38,6 +39,7 @@ async function createTenantRouter(app: AppOptions, options: RouterOptions) {
     express.json(),
     authenticate(options.passport, "local")
   );
+  router.use("/auth/local/signup", express.json(), signup);
   router.use("/auth/oidc", authenticate(options.passport, "oidc"));
   router.use("/auth/oidc/callback", authenticate(options.passport, "oidc"));
   // router.use("/auth/google", options.passport.authenticate("google"));