             user = try User.query().filter("access_token", accessToken.string).first()
             // process here
         case let apiKey as APIKey:
-            let hashedSecret = try Hash.make(Hash.Method.sha512, Array(apiKey.secret.utf8))
-            let hashedPassword = String(describing: (hashedSecret, encoding: String.Encoding.utf8))
-            user = try User.query().filter("username", apiKey.id).filter("password", hashedPassword).first()
+            user = try User.query().filter("username", apiKey.id).first()
+            
+            guard user != nil else {
+                throw UserError.noSuchUser
+            }
+            
+            let matched = try BCrypt.verify(password: apiKey.secret, matchesHash: (user?.password)!)
+            if matched == false {
+                    throw AuthError.invalidCredentials
+            }
+            
         default:
             throw AuthError.invalidCredentials
         }
         
-        guard let u = user else {
-            throw AuthError.invalidCredentials
-        }
-        
-        return u
+        return user!
     }
     
     static func register(credentials: Credentials) throws -> Auth.User {

            let username = apiKey.id
            let password = apiKey.secret
            
            let hashedPassword = try Hash.make(Hash.Method.sha512, Array(password.utf8))
            var user = User(username: username, password: String(describing: (hashedPassword, encoding: String.Encoding.utf8)))
            
            let tempUser = try User.query().filter("username", username).first()
            

import Foundation
import Auth
import Hash
import BCrypt

final class User: Model {
    var id: Node?
