diff --git a/proto/headscale/v1/apikey.proto b/proto/headscale/v1/apikey.proto
new file mode 100644
index 00000000..749e5c22
--- /dev/null
+++ b/proto/headscale/v1/apikey.proto
@@ -0,0 +1,35 @@
+syntax = "proto3";
+package headscale.v1;
+option  go_package = "github.com/juanfont/headscale/gen/go/v1";
+
+import "google/protobuf/timestamp.proto";
+
+message ApiKey {
+    uint64                    id         = 1;
+    string                    prefix     = 2;
+    google.protobuf.Timestamp expiration = 3;
+    google.protobuf.Timestamp created_at = 4;
+    google.protobuf.Timestamp last_seen  = 5;
+}
+
+message CreateApiKeyRequest {
+    google.protobuf.Timestamp expiration = 1;
+}
+
+message CreateApiKeyResponse {
+    string api_key = 1;
+}
+
+message ExpireApiKeyRequest {
+    string prefix = 1;
+}
+
+message ExpireApiKeyResponse {
+}
+
+message ListApiKeysRequest {
+}
+
+message ListApiKeysResponse {
+    repeated ApiKey api_keys = 1;
+}
diff --git a/proto/headscale/v1/headscale.proto b/proto/headscale/v1/headscale.proto
index f7332a88..3cbbb8ed 100644
--- a/proto/headscale/v1/headscale.proto
+++ b/proto/headscale/v1/headscale.proto
@@ -8,6 +8,7 @@ import "headscale/v1/namespace.proto";
 import "headscale/v1/preauthkey.proto";
 import "headscale/v1/machine.proto";
 import "headscale/v1/routes.proto";
+import "headscale/v1/apikey.proto";
 // import "headscale/v1/device.proto";
 
 service HeadscaleService {
@@ -131,6 +132,28 @@ service HeadscaleService {
     }
     // --- Route end ---
 
+    // --- ApiKeys start ---
+    rpc CreateApiKey(CreateApiKeyRequest) returns (CreateApiKeyResponse) {
+        option (google.api.http) = {
+            post: "/api/v1/apikey"
+            body: "*"
+        };
+    }
+
+    rpc ExpireApiKey(ExpireApiKeyRequest) returns (ExpireApiKeyResponse) {
+        option (google.api.http) = {
+            post: "/api/v1/apikey/expire"
+            body: "*"
+        };
+    }
+
+    rpc ListApiKeys(ListApiKeysRequest) returns (ListApiKeysResponse) {
+        option (google.api.http) = {
+            get: "/api/v1/apikey"
+        };
+    }
+    // --- ApiKeys end ---
+
     // Implement Tailscale API
     // rpc GetDevice(GetDeviceRequest) returns(GetDeviceResponse) {
     //     option(google.api.http) = {
diff --git a/proto/headscale/v1/machine.proto b/proto/headscale/v1/machine.proto
index 9b032122..47664e15 100644
--- a/proto/headscale/v1/machine.proto
+++ b/proto/headscale/v1/machine.proto
@@ -14,13 +14,13 @@ enum RegisterMethod {
 }
 
 message Machine {
-    uint64 id           = 1;
-    string machine_key  = 2;
-    string node_key     = 3;
-    string disco_key    = 4;
-    repeated string ip_addresses   = 5;
-    string name         = 6;
-    Namespace namespace = 7;
+    uint64          id           = 1;
+    string          machine_key  = 2;
+    string          node_key     = 3;
+    string          disco_key    = 4;
+    repeated string ip_addresses = 5;
+    string          name         = 6;
+    Namespace namespace          = 7;
 
     bool           registered      = 8;
     RegisterMethod register_method = 9;