--- a/app/controllers/api/api_controller.rb
+++ b/app/controllers/api/api_controller.rb
@@ -38,27 +38,34 @@ class Api::ApiController < ActionController::Base
 
   protected
   def token_required
-    client_addr = env['HTTP_X_FORWARDED_FOR']
-    unless @client = Server.find_by_address(client_addr)
-      @client = Server.create(address: client_addr)
-      api_log(:info, 'server#create', @client.id, 'register', 'first request')
-    end
-
-    if authenticate_token
-      api_log(:debug, 'authenticate', @client.id, 'valid authentication.')
-    else
-      api_log(:error, 'authenticate', @client.id, 'invalid authentication.')
-      render_unauthorized
-    end
+    authenticate || render_unauthorized
   end
 
-  def authenticate_token
+  def authenticate
+    client_addr = env['HTTP_X_FORWARDED_FOR']
     authenticate_with_http_token do |token, options|
-      @client.is_authorized?(token)
+      if @client = User.find_by_api_key(token)
+        api_log(:verbose, nil, @client.id, 'user authenticated')
+      elsif client = Server.find_by_address(client_addr)
+        if client.is_authorized?(token)
+          @client = client
+          api_log(:verbose, nil, @client.id, 'server authenticated')
+        end
+      else
+        net = ENV['TRUSTED_NETWORK'].split('.')
+        if client_addr.split('.')[0..net.size - 1] == net
+          client = Server.create(address: client_addr)
+          api_log(:info, 'server#create', client.id, nil, 'trusted net')
+        end
+      end
     end
+    @client
   end
 
   def render_unauthorized
+    client_addr = env['HTTP_X_FORWARDED_FOR']
+    api_log(:error, nil, client_addr, 'unauthorized access')
+
     self.headers['WWW-Authenticate'] = 'Token realm="Kwanmun"'
     render json: error(401, :unauthorized), status: :unauthorized
   end
--- a/app/models/concerns/client_methods.rb
+++ b/app/models/concerns/client_methods.rb
@@ -22,7 +22,8 @@ module ClientMethods
   private
   def generate_api_key
     begin
-      self.api_key = Digest::SHA256.new.update(SecureRandom.base64).to_s
+      self.api_key = self.class.name[0].downcase
+      self.api_key += Digest::SHA256.new.update(SecureRandom.base64).to_s
     end while self.class.exists?(api_key: api_key)
   end
 end
--- a/config/application.yml.dist
+++ b/config/application.yml.dist
@@ -3,3 +3,5 @@ YEOKSA_DATABASE_USERNAME: @DATABASE_USERNAME@
 YEOKSA_DATABASE_PASSWORD: @DATABASE_PASSWORD@
 
 SECRET_KEY_BASE: @SECRET_KEY_BASE@
+
+TRUSTED_NETWORK: "192.168"

--- a/app/controllers/api/api_controller.rb
+++ b/app/controllers/api/api_controller.rb
@@ -17,12 +18,20 @@ class Api::ApiController < ActionController::Base
     end
   end
 
+  def gateway_log(mesg, result, tags=nil)
+    where = env['HTTP_X_FORWARDED_FOR']
+    process = env['HTTP_USER_AGENT']
+    service = params[:service_name]
+    action = params[:path]
+    target = result
+    log(:gateway, :info, process, mesg, where, action, target, nil, tags)
+  end
+
   def api_log(level, action, target, mesg=nil, why=nil, tags=nil)
     category = 'api'
     where = env['HTTP_X_FORWARDED_FOR']
--- /dev/null
+++ b/app/controllers/api/v1/gateway_controller.rb
@@ -0,0 +1,64 @@
+class Api::V1::GatewayController < Api::ApiController
+
+  # GET /s/:service_name/*path
+  def get
+    if @service = @client.services.find_by_name(params[:service_name])
+      conn = Faraday.new(url: @service.base_url,
+                         ssl: {verify: false}) do |faraday|
+        faraday.adapter Faraday.default_adapter
+      end
+      @result = set_result conn.get params[:path] + '.json'
+      gateway_log('<%s>/%s served with %s' % [@service.name,
+                                              params[:path],
+                                              @result[:status]],
+                  @result[:extra])
+    else
+      @result = set_error 404, 'Not Found'
+      gateway_log('no service found for client', @result[:extra])
+    end
+  end
+
+  # POST /s/:service_name/*path
+  def post
+    render_unauthorized
+  end
+
+  # PUT /s/:service_name/*path
+  def put
+    render_unauthorized
+  end
+
+  # DELETE /s/:service_name/*path
+  def delete
+    render_unauthorized
+  end
+
+  private
+  def set_result response
+    {
+      service: params[:service_name],
+      status: response.env.status,
+      response: JSON.parse(response.body),
+      extra: {
+        base_url: @service.base_url,
+        path: params[:path],
+        url: response.env.url.to_s,
+        method: response.env.method.upcase,
+        headers: response.env.response_headers,
+      }
+    }
+  end
+
+  def set_error status, reason
+    {
+      service: params[:service_name],
+      status: status,
+      response: nil,
+      extra: {
+        path: params[:path],
+        message: reason,
+      }
+    }
+  end
+end
+# vim: set ts=2 sw=2 expandtab:
--- /dev/null
+++ b/app/views/api/v1/gateway/get.json.jbuilder
@@ -0,0 +1 @@
+json.extract! @result, :service, :status, :response, :extra
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -18,6 +18,10 @@ Rails.application.routes.draw do
   namespace :api, defaults: {format: 'json'} do
     namespace :v1 do
       resources :logs
+      get 's/:service_name/*path', to: 'gateway#get'
+      post 's/:service_name/*path', to: 'gateway#post'
+      put 's/:service_name/*path', to: 'gateway#put'
+      delete 's/:service_name/*path', to: 'gateway#delete'
     end
   end