diff --git a/auth.py b/auth.py
index d563f47..227b26a 100644
--- a/auth.py
+++ b/auth.py
@@ -11,11 +11,10 @@ import datetime
 auth_bp = Blueprint("auth", __name__)
 
 # =====================================================
-# SECRET KEY (only your program has this)
+# SECRET KEY (only for this program)
 # =====================================================
 # Generate once using: Fernet.generate_key()
 _SECRET_KEY = b'YFK7QCyTzhyLO4vqrnRxvDAI5uu8mXEYrInEjbRoQgs='
-
 fernet = Fernet(_SECRET_KEY)
 
 # =====================================================
@@ -62,9 +61,6 @@ def is_cookie_ok_to_autologin(cookie_content):
         return user
     return 0
 
-
-
-
 #. @auth_bp.route("/", methods=["GET", "POST"])
 @auth_bp.route("/login", methods=["GET", "POST"])
 def login():
@@ -73,7 +69,7 @@ def login():
     userid = is_cookie_ok_to_autologin(username)
     if userid>0:
         user = User.query.filter_by(id=userid).first()
-        if user and user.is_approved:
+        if user and user.is_approved and user.group_id>0:
             login_user(user)
             return redirect(url_for("lists.home"))
     
@@ -82,9 +78,10 @@ def login():
         if user and user.check_password(request.form["password"]):
             if not user.is_approved:
                 return render_template("pending.html")
-            login_user(user)
-            return redirect(url_for("lists.home"))
-        flash("Invalid credentials")
+            if user.group_id>0:
+                login_user(user)
+                return redirect(url_for("lists.home"))
+        flash("Invalid key credentials.")
         Log.info(f"Authorization failure for user '{request.form["name"]}' ")
 
     
@@ -98,8 +95,11 @@ def register():
     if request.method == "POST":
         user = User(name=request.form["name"])
         user.set_password(request.form["password"])
-        db.session.add(user)
-        db.session.commit()
+        group_id = user.get_group_id(request.form["password"])
+        if group_id > 0:
+            user.group_id = group_id
+            db.session.add(user)
+            db.session.commit()
         return render_template("pending.html")
     return render_template("register.html")
 
diff --git a/models.py b/models.py
index f48f0e5..52b0677 100644
--- a/models.py
+++ b/models.py
@@ -8,6 +8,7 @@ db = SQLAlchemy() # Create the extension object
 class User(UserMixin, db.Model):
     id = db.Column(db.Integer, primary_key=True)
     updated_at = db.Column(db.TIMESTAMP, default=datetime.now(), onupdate=datetime.now(), nullable=False)
+    group_id = db.Column(db.Integer, default=0, nullable=False)
     name = db.Column(db.String(40), unique=True, nullable=False)
     password_hash = db.Column(db.String(256))
     is_admin = db.Column(db.Boolean, default=False)
@@ -51,7 +52,12 @@ class User(UserMixin, db.Model):
         shared = Shared.query.filter_by(user_id=self.id, listofitem_id=listofitem_id).first()
         return True if shared else False
 
-
+    def set_group_id(self, secret):
+        group = Group.query.filter_by(secret=secret).first()
+        if group:
+            return group.id
+        else:
+            return 0
 
 class ListOfItems(db.Model):
     id = db.Column(db.Integer, primary_key=True)
@@ -97,3 +103,9 @@ class Item(db.Model):
 class Shared(db.Model):
     user_id = db.Column(db.Integer, primary_key=True)
     listofitem_id = db.Column(db.Integer, primary_key=True)
+
+class Group(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    updated_at = db.Column(db.TIMESTAMP, default=datetime.now(), onupdate=datetime.now(), nullable=False)
+    secret = db.Column(db.String(128))
+
diff --git a/update_db.py b/update_db.py
index e0817f3..41de30b 100644
--- a/update_db.py
+++ b/update_db.py
@@ -1,16 +1,39 @@
 from lapp import create_app
 import sqlalchemy as sa
-from models import db, Item
+from models import db, Item, Group, User
 
 app = create_app()
 app.app_context().push()
-query = sa.select(Item).where(Item.quantity == 0)
-items = db.session.scalars(query).all()
+# query = sa.select(Item).where(Item.quantity == 0)
+# items = db.session.scalars(query).all()
 
-# items=Item.query.filter_by(quantity='').all()
-for i in items:
-    print(f"{i.label} {i.quantity} {i.unit}")
-    i.quantity = 1
-    i.unit = 'x'
+# # items=Item.query.filter_by(quantity='').all()
+# for i in items:
+#     print(f"{i.label} {i.quantity} {i.unit}")
+#     i.quantity = 1
+#     i.unit = 'x'
+
+
+# add column
+
+# result1 = db.session.execute(sa.text('ALTER TABLE user DROP group_id'))
+# result2 = db.session.execute(sa.text('ALTER TABLE user ADD group_id INT'))
+# db.session.commit()
+
+# add the first group secret
+# gr = Group(secret='102938764918372c419283764d91873246d91283746d910283746d19283764cfv')
+# db.session.add(gr)
+# db.session.commit()
+
+# add the first ket to all users
+# users = User.query.all()
+# for u in users:
+#     u.group_id = 1
+# db.session.commit()
+
+
+# add the second group secret
+# gr = Group(secret='9999')
+# db.session.add(gr)
+# db.session.commit()
 
-db.session.commit()
\ No newline at end of file