diff --git a/Dockerfile b/Dockerfile
index 90ca8e1..e53f7a8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,6 +4,11 @@ RUN apk add --no-cache crystal shards openssl openssl-dev musl-dev libc6-compat
 COPY . /opt/app/
 RUN cd /opt/app && \
     shards
+ENV KEMAL_ENV test
+
+RUN  cd /opt/app/ && crystal spec
+
+ENV KEMAL_ENV production
 
 RUN cd /opt/app/ && crystal build --mcpu $(gcc -march=native -Q --help=target|grep march|awk '{print $2}'|head -n 1) --release src/sales_backend.cr
 
diff --git a/shard.lock b/shard.lock
index 066ea07..9591870 100644
--- a/shard.lock
+++ b/shard.lock
@@ -12,3 +12,7 @@ shards:
     github: luislavena/radix
     version: 0.3.8
 
+  spec-kemal:
+    github: kemalcr/spec-kemal
+    version: 0.4.0
+
diff --git a/shard.yml b/shard.yml
index 8360fa9..100f870 100644
--- a/shard.yml
+++ b/shard.yml
@@ -13,5 +13,8 @@ crystal: 0.25.0
 dependencies:
   kemal:
     github: kemalcr/kemal
+    version: 0.23.0
+  spec-kemal:
+    github: kemalcr/spec-kemal
 
 license: MIT
diff --git a/spec/sales_backend_spec.cr b/spec/sales_backend_spec.cr
index f558edb..a6280a9 100644
--- a/spec/sales_backend_spec.cr
+++ b/spec/sales_backend_spec.cr
@@ -1,9 +1,37 @@
 require "./spec_helper"
 
+
 describe SalesBackend do
-  # TODO: Write tests
+  it "can render status" do
+      get "/"
+      String.from_json(Global.response.not_nil!.body).should eq "OK"
+  end
+
+  it "can add a user able to log in and out" do
+      Dir.mkdir_p Statics.data_path+"user"
+      usr = User.new("dummy@domain.com")
+      usr.password_hash = "mywordismypassword"
+      
+      post "/user", nil, usr.to_json
+      Global.response.not_nil!.status_code.should eq(200)
+      String.from_json(Global.response.not_nil!.body).should eq "OK"
+
+      post "/login", nil, usr.to_json
+      Global.response.not_nil!.status_code.should eq(200)
+      uuid=UUID.from_json(Global.response.not_nil!.body).not_nil!
+
+      headers = HTTP::Headers.new
+      headers["user"]=usr.email.to_s
+      headers["api_token"]=uuid.to_s
+      get "/user/", headers
+      Global.response.not_nil!.status_code.should eq(200)
+
+      usr.tokens = Array(UUID).new
+      usr.tokens.not_nil!.push uuid
+      post "/logout", nil, usr.to_json
+      Global.response.not_nil!.status_code.should eq(200)
 
-  it "works" do
-    false.should eq(true)
+      get "/user/", headers
+      Global.response.not_nil!.status_code.should eq(403)
   end
 end
diff --git a/spec/spec_helper.cr b/spec/spec_helper.cr
index f77bab5..210e15b 100644
--- a/spec/spec_helper.cr
+++ b/spec/spec_helper.cr
@@ -1,2 +1,2 @@
-require "spec"
+require "spec-kemal"
 require "../src/sales_backend"
diff --git a/src/config.cr b/src/config.cr
index 67eb30b..11f013f 100644
--- a/src/config.cr
+++ b/src/config.cr
@@ -1,5 +1,8 @@
 class Statics
     def self.data_path
+        if ENV["KEMAL_ENV"] == "test"
+            return "/tmp/"
+        end
         "/opt/app/data/"
     end
 
diff --git a/src/sales_backend/http/user.cr b/src/sales_backend/http/user.cr
index ad17155..9899e9d 100644
--- a/src/sales_backend/http/user.cr
+++ b/src/sales_backend/http/user.cr
@@ -160,5 +160,11 @@ end
 
 get "/user" do |context|
     context.response.content_type = "application/json"
-    authenticate!(context.request.headers["user"],UUID.new(context.request.headers["api_token"])).to_json
+    user : User | Nil
+    begin
+        user = authenticate!(context.request.headers["user"],UUID.new(context.request.headers["api_token"]))
+    rescue ex
+        halt context, status_code: 403, response: ex.to_s
+    end
+    user.not_nil!
 end
diff --git a/src/sales_backend/user.cr b/src/sales_backend/user.cr
index 8402d8f..fe65b15 100644
--- a/src/sales_backend/user.cr
+++ b/src/sales_backend/user.cr
@@ -19,4 +19,5 @@ class User
         active:         {type: Bool, default: false}, 
         type:           {type: UserType, default: UserType::Normal},
     )
+    def initialize(@email, @active = false, @type = UserType::Normal) end
 end
\ No newline at end of file