diff --git a/nixie-server/src/main.rs b/nixie-server/src/main.rs
index 27be1d7..a413147 100644
--- a/nixie-server/src/main.rs
+++ b/nixie-server/src/main.rs
@@ -9,7 +9,6 @@ use axum::response::IntoResponse;
 use axum::routing::get;
 use axum_login::AuthManagerLayerBuilder;
 use axum_login::AuthnBackend;
-use axum_login::login_required;
 use displaydoc::Display;
 use notify_debouncer_full::DebouncedEvent;
 use notify_debouncer_full::notify::EventKind;
@@ -28,6 +27,7 @@ use tower_sessions_sqlx_store::SqliteStore;
 use tracing::error;
 use tracing_subscriber::EnvFilter;
 
+pub mod settings;
 pub mod users;
 
 pub type WebResult<T> = Result<T, AppError>;
@@ -150,9 +150,8 @@ async fn run() -> anyhow::Result<()> {
     let reloader = livereload.reloader();
 
     let app = Router::new()
-        .route("/protected", get(show_protected))
-        .route_layer(login_required!(Backend, login_url = "/login"))
         .merge(users::routes())
+        .merge(settings::routes())
         .route("/", get(show_index))
         .layer(auth_layer)
         .layer(livereload)
diff --git a/nixie-server/src/settings/mod.rs b/nixie-server/src/settings/mod.rs
new file mode 100644
index 0000000..ec8816d
--- /dev/null
+++ b/nixie-server/src/settings/mod.rs
@@ -0,0 +1,23 @@
+use axum::Router;
+use axum::routing::get;
+use axum::routing::post;
+use axum_login::login_required;
+
+use crate::AppState;
+
+pub fn routes() -> Router<AppState> {
+    Router::new()
+        .route("/settings", get(show_settings))
+        .route("/settings/change_password", get(show_change_password))
+        .route("/settings/change_password", post(do_change_password))
+        .route("/settings/api_keys", get(show_api_keys))
+        .route_layer(login_required!(crate::Backend, login_url = "/login"))
+}
+
+async fn show_settings() {}
+
+async fn show_change_password() {}
+
+async fn do_change_password() {}
+
+async fn show_api_keys() {}