diff --git a/src/main/java/ch/dlmw/swisssignchallenge/controllers/TokenController.java b/src/main/java/ch/dlmw/swisssignchallenge/controllers/TokenController.java
index c9ecc21..16d3bd2 100644
--- a/src/main/java/ch/dlmw/swisssignchallenge/controllers/TokenController.java
+++ b/src/main/java/ch/dlmw/swisssignchallenge/controllers/TokenController.java
@@ -1,16 +1,38 @@
 package ch.dlmw.swisssignchallenge.controllers;
 
+import ch.dlmw.swisssignchallenge.utils.JwtUtil;
 import org.openapitools.api.TokenApi;
 import org.openapitools.model.CreateSessionRequest;
 import org.openapitools.model.CreateSessionResponse;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.web.bind.annotation.RestController;
 
 @RestController
 public class TokenController implements TokenApi {
+    private final AuthenticationManager authenticationManager;
+    private final UserDetailsService userDetailsService;
+    private final JwtUtil jwtUtil;
+
+    public TokenController(AuthenticationManager authenticationManager, UserDetailsService userDetailsService, JwtUtil jwtUtil) {
+        this.authenticationManager = authenticationManager;
+        this.userDetailsService = userDetailsService;
+        this.jwtUtil = jwtUtil;
+    }
+
     @Override
     public ResponseEntity<CreateSessionResponse> createToken(CreateSessionRequest createSessionRequest) {
-        var response = new CreateSessionResponse("blabla");
+        authenticationManager.authenticate(
+                new UsernamePasswordAuthenticationToken(createSessionRequest.getUsername(), createSessionRequest.getPassword())
+        );
+
+        UserDetails userDetails = userDetailsService.loadUserByUsername(createSessionRequest.getUsername());
+
+        var response = new CreateSessionResponse(jwtUtil.generateToken(userDetails));
+
         return ResponseEntity.ok(response);
     }
 }