diff --git a/src/client.ts b/src/client.ts
index bfe0b32..95c0f0a 100644
--- a/src/client.ts
+++ b/src/client.ts
@@ -1,11 +1,10 @@
-export interface LiveRunMove {
-  latency: number;
-  cursor: number;
-  changes?: {
-    from: number;
-    to: number;
-    insert: string;
-  };
+var cookies: string | undefined;
+
+export function getCookies(): string | undefined {
+  return cookies;
+}
+export function setCookies(c: string) {
+  cookies = c;
 }
 
 export async function submitRun() {}
diff --git a/src/server.ts b/src/server.ts
index ce3f2b2..2e3a329 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -2,15 +2,16 @@ import * as vscode from "vscode";
 import express from "express";
 import * as http from "http";
 import cors from "cors";
+import { getCookies, setCookies } from "./client";
 
-let server: http.Server | undefined;
+var server: http.Server | undefined;
 
 const app = express();
 
+app.use(express.json());
 app.use(
   cors({
     origin: (origin, callback) => {
-      // allow requests with no origin (e.g., direct curl)
       if (
         !origin ||
         origin.includes("localhost") ||
@@ -25,10 +26,19 @@ app.use(
   }),
 );
 
+app.post("/auth", (req, res) => {
+  const { saveCookies } = req.body;
+
+  setCookies(saveCookies);
+
+  res.json({ ok: true });
+});
+
 app.get("/start-run/:problemId", (req, res) => {
   const { problemId } = req.params;
 
-  // trigger VS Code command
+  if (!getCookies()) return res.json({ ok: false, code: "auth" });
+
   vscode.commands.executeCommand("devrun-vscode.startRun", problemId);
 
   res.json({ ok: true, problemId });
diff --git a/src/types.ts b/src/types.ts
new file mode 100644
index 0000000..3ba77b9
--- /dev/null
+++ b/src/types.ts
@@ -0,0 +1,9 @@
+export interface LiveRunMove {
+  latency: number;
+  cursor: number;
+  changes?: {
+    from: number;
+    to: number;
+    insert: string;
+  };
+}