diff --git a/crates/nxmesh-master/src/db/entities/mod.rs b/crates/nxmesh-master/src/db/entities/mod.rs
index 2de2bd6..8d9aed4 100644
--- a/crates/nxmesh-master/src/db/entities/mod.rs
+++ b/crates/nxmesh-master/src/db/entities/mod.rs
@@ -5,6 +5,7 @@ pub mod prelude;
 pub mod agents;
 pub mod certificates;
 pub mod organizations;
+pub mod setup_tokens;
 pub mod upstreams;
 pub mod users;
 pub mod virtual_hosts;
diff --git a/crates/nxmesh-master/src/db/entities/setup_tokens.rs b/crates/nxmesh-master/src/db/entities/setup_tokens.rs
new file mode 100644
index 0000000..48ec232
--- /dev/null
+++ b/crates/nxmesh-master/src/db/entities/setup_tokens.rs
@@ -0,0 +1,21 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(table_name = "setup_tokens")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: Uuid,
+    #[sea_orm(unique)]
+    pub token_hash: String,
+    pub expires_at: DateTimeWithTimeZone,
+    pub used_at: Option<DateTimeWithTimeZone>,
+    pub created_at: DateTimeWithTimeZone,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/migration/src/lib.rs b/migration/src/lib.rs
index 110a7bd..c945c3b 100644
--- a/migration/src/lib.rs
+++ b/migration/src/lib.rs
@@ -7,6 +7,7 @@ mod m20240301_000004_create_virtual_hosts;
 mod m20240301_000005_create_upstreams;
 mod m20240301_000006_create_certificates;
 mod m20240301_000007_create_users;
+mod m20240301_000008_create_setup_tokens;
 
 pub struct Migrator;
 
@@ -21,6 +22,7 @@ impl MigratorTrait for Migrator {
             Box::new(m20240301_000005_create_upstreams::Migration),
             Box::new(m20240301_000006_create_certificates::Migration),
             Box::new(m20240301_000007_create_users::Migration),
+            Box::new(m20240301_000008_create_setup_tokens::Migration),
         ]
     }
 }
diff --git a/migration/src/m20240301_000008_create_setup_tokens.rs b/migration/src/m20240301_000008_create_setup_tokens.rs
new file mode 100644
index 0000000..5b2c077
--- /dev/null
+++ b/migration/src/m20240301_000008_create_setup_tokens.rs
@@ -0,0 +1,60 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(
+                Table::create()
+                    .table(SetupTokens::Table)
+                    .if_not_exists()
+                    .col(
+                        ColumnDef::new(SetupTokens::Id)
+                            .uuid()
+                            .not_null()
+                            .primary_key(),
+                    )
+                    .col(
+                        ColumnDef::new(SetupTokens::TokenHash)
+                            .string()
+                            .not_null()
+                            .unique_key(),
+                    )
+                    .col(
+                        ColumnDef::new(SetupTokens::ExpiresAt)
+                            .timestamp_with_time_zone()
+                            .not_null(),
+                    )
+                    .col(
+                        ColumnDef::new(SetupTokens::UsedAt)
+                            .timestamp_with_time_zone(),
+                    )
+                    .col(
+                        ColumnDef::new(SetupTokens::CreatedAt)
+                            .timestamp_with_time_zone()
+                            .not_null(),
+                    )
+                    .to_owned(),
+            )
+            .await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(SetupTokens::Table).to_owned())
+            .await
+    }
+}
+
+#[derive(DeriveIden)]
+enum SetupTokens {
+    Table,
+    Id,
+    TokenHash,
+    ExpiresAt,
+    UsedAt,
+    CreatedAt,
+}