2 files changed, 8 insertions, 2 deletions

diff --git a/README.md b/README.md
index 10e98cd..664336c 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,8 @@ $ curl --location --request POST 'localhost:8080/transaction' --header 'Content-
 
 ## authentication
 Students generate their own `keypairs` and authenticate with their METU Student IDs.
+Some JWT scheme, coming up.
+
 Authenticated students propose transactions, between them and another node (=public keys) or between the grader (=bank) and themselves.
 
 ## transactions
diff --git a/TODO.md b/TODO.md
index 3f8c3ea..7b58d96 100644
--- a/TODO.md
+++ b/TODO.md
@@ -7,8 +7,12 @@
 - [ ] check the nonce for incoming blocks
 
 ## Authentication
-- [ ] pick a user authentication scheme
-    - [ ] implement it
+- [X] pick a user authentication scheme = [JWT](https://tools.ietf.org/html/rfc7519) Seems perfect
+- [ ] implement JWT
+    - https://blog.logrocket.com/jwt-authentication-in-rust/
+    - https://crates.io/crates/jsonwebtoken
+    - https://jwt.io/introduction/
+    - https://jwt.io/#debugger-io
 - [ ] users should be able to _sign_ their transactions
 
 ## Done & Brag