diff --git a/Gopkg.lock b/Gopkg.lock
index 41234e6..463de4b 100644
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -1,6 +1,25 @@
 # This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
 
 
+[[projects]]
+  digest = "1:db932d4696ed23e244a69a60d258a23816aceb012a95e4c3871c711d4fc120e7"
+  name = "github.com/boj/redistore"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "fc113767cd6b051980f260d6dbe84b2740c46ab0"
+  version = "v1.2"
+
+[[projects]]
+  digest = "1:0594af97b2f4cec6554086eeace6597e20a4b69466eb4ada25adf9f4300dddd2"
+  name = "github.com/garyburd/redigo"
+  packages = [
+    "internal",
+    "redis",
+  ]
+  pruneopts = "UT"
+  revision = "a69d19351219b6dd56f274f96d85a7014a2ec34e"
+  version = "v1.6.0"
+
 [[projects]]
   digest = "1:2b59aca2665ff804f6606c8829eaee133ddd3aefbc841014660d961b0034f888"
   name = "github.com/gin-contrib/cors"
@@ -17,6 +36,14 @@
   pruneopts = "UT"
   revision = "22d885f9ecc78bf4ee5d72b937e4bbcdc58e8cae"
 
+[[projects]]
+  branch = "master"
+  digest = "1:a9fc00ef112bb3d3f057c7f41c00e5a5dd56ce36381103d753938458b2356ca1"
+  name = "github.com/gin-gonic/contrib"
+  packages = ["sessions"]
+  pruneopts = "UT"
+  revision = "39cfb9727134fef3120d2458fce5fab14265a46c"
+
 [[projects]]
   digest = "1:489e108f21464371ebf9cb5c30b1eceb07c6dd772dff073919267493dd9d04ea"
   name = "github.com/gin-gonic/gin"
@@ -37,6 +64,30 @@
   revision = "b4deda0973fb4c70b50d226b1af49f3da59f5265"
   version = "v1.1.0"
 
+[[projects]]
+  digest = "1:c79fb010be38a59d657c48c6ba1d003a8aa651fa56b579d959d74573b7dff8e1"
+  name = "github.com/gorilla/context"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "08b5f424b9271eedf6f9f0ce86cb9396ed337a42"
+  version = "v1.1.1"
+
+[[projects]]
+  digest = "1:e72d1ebb8d395cf9f346fd9cbc652e5ae222dd85e0ac842dc57f175abed6d195"
+  name = "github.com/gorilla/securecookie"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "e59506cc896acb7f7bf732d4fdf5e25f7ccd8983"
+  version = "v1.1.1"
+
+[[projects]]
+  digest = "1:0fe783ea0c04c7d13f7c55d8f74b01b17e18a8320e7deecf578b41ef99b27205"
+  name = "github.com/gorilla/sessions"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "03b6f63cc43ef9c7240a635a5e22b13180e822b8"
+  version = "v1.1.1"
+
 [[projects]]
   branch = "master"
   digest = "1:7654989089e5bd5b6734ec3be8b695e87d3f1f8d95620b343fd7d3995a5b60d7"
@@ -115,6 +166,7 @@
   analyzer-version = 1
   input-imports = [
     "github.com/gin-contrib/cors",
+    "github.com/gin-gonic/contrib/sessions",
     "github.com/gin-gonic/gin",
     "github.com/gin-gonic/gin/binding",
     "github.com/jmoiron/sqlx",
diff --git a/model/account.go b/model/account.go
index d815f1e..8350243 100644
--- a/model/account.go
+++ b/model/account.go
@@ -6,11 +6,11 @@ import (
 
 // Account - table
 type Account struct {
-	ID       string    `db:"id"`
-	Account  string    `db:"account"`
-	Password string    `db:"password"`
-	Ctime    time.Time `db:"ctime"`
-	Mtime    time.Time `db:"mtime"`
+	ID       string    `db:"id" cc:"id"`
+	Account  string    `db:"account" cc:"account"`
+	Password string    `db:"password" cc:"password"`
+	Ctime    time.Time `db:"ctime" cc:"ctime"`
+	Mtime    time.Time `db:"mtime" cc:"ctime"`
 }
 
 // GetAllAccount -
@@ -24,7 +24,8 @@ func GetAllAccount() (accs []Account, err error) {
 
 // GetAccount -
 func GetAccount(account string) (acc *Account, err error) {
-	err = x.Select(acc, `select * from "public"."account" where "account" = $1`, account)
+	acc = &Account{}
+	err = x.Get(acc, `select * from "public"."account" where "account" = $1`, account)
 	if err != nil {
 		return nil, err
 	}
diff --git a/router/api/api.go b/router/api/api.go
index 439140a..74535c1 100644
--- a/router/api/api.go
+++ b/router/api/api.go
@@ -3,6 +3,8 @@ package api
 import (
 	"git.trj.tw/golang/mtfosbot/model"
 	"git.trj.tw/golang/mtfosbot/module/context"
+	"git.trj.tw/golang/mtfosbot/module/utils"
+	"github.com/gin-gonic/contrib/sessions"
 	"golang.org/x/crypto/bcrypt"
 )
 
@@ -20,7 +22,7 @@ func UserLogin(c *context.Context) {
 
 	acc, err := model.GetAccount(bodyArg.Account)
 	if err != nil {
-		c.ServerError(nil)
+		c.ServerError(`account or password error`)
 		return
 	}
 
@@ -30,4 +32,13 @@ func UserLogin(c *context.Context) {
 		return
 	}
 
+	accInt := utils.ToMap(acc)
+	delete(accInt, "password")
+	session := sessions.Default(c.Context)
+
+	session.Set("user", accInt)
+	session.Set("loginType", "system")
+	session.Save()
+
+	c.Success(nil)
 }
diff --git a/router/routes/routes.go b/router/routes/routes.go
index 583f9ef..b7622f7 100644
--- a/router/routes/routes.go
+++ b/router/routes/routes.go
@@ -1,19 +1,33 @@
 package routes
 
 import (
+	"log"
+
+	"git.trj.tw/golang/mtfosbot/module/context"
+	"git.trj.tw/golang/mtfosbot/router/api"
 	"github.com/gin-contrib/cors"
+	"github.com/gin-gonic/contrib/sessions"
 	"github.com/gin-gonic/gin"
 )
 
 // NewServ - create new gin server
 func NewServ() *gin.Engine {
 	r := gin.New()
+
+	store, err := sessions.NewRedisStore(10, "tcp", "localhost:6379", "")
+	if err != nil {
+		log.Fatal(err)
+	}
+
 	// access log
 	r.Use(gin.Logger())
 	// error catch
 	r.Use(gin.Recovery())
 	// enable cors
 	r.Use(cors.Default())
+	// session
+	r.Use(sessions.Sessions("gin:sess", store))
+
 	return r
 }
 
@@ -24,4 +38,9 @@ func SetRoutes(r *gin.Engine) {
 			"message": "ok",
 		})
 	})
+
+	apiGroup := r.Group("/api")
+	{
+		apiGroup.POST("/login", context.PatchCtx(api.UserLogin))
+	}
 }