diff --git a/towndb/towndb.go b/towndb/towndb.go
index c13418a..074c069 100644
--- a/towndb/towndb.go
+++ b/towndb/towndb.go
@@ -153,6 +153,7 @@ func UserForEmail(db *sql.DB, address string) (*TownUser, error) {
 	if err != nil {
 		return nil, err
 	}
+	defer stmt.Close()
 	row := stmt.QueryRow(address)
 	u := &TownUser{}
 	if err = row.Scan(&u.ID, &u.Username); err != nil {
@@ -183,8 +184,41 @@ type AuthCode struct {
 }
 
 func (c *AuthCode) Insert(db *sql.DB) error {
-	// TODO
+	stmt, err := db.Prepare(`
+	INSERT INTO auth_codes (code, email)
+	VALUES ?, ?`)
+	if err != nil {
+		return err
+	}
+
+	defer stmt.Close()
+
+	result, err := stmt.Exec(c.Code, c.Email)
+	if err != nil {
+		return err
+	}
+
+	liid, err := result.LastInsertId()
+	if err != nil {
+		return err
+	}
+
+	c.ID = liid
+
 	return nil
 }
 
+func (c *AuthCode) Hydrate(db *sql.DB) error {
+	stmt, err := db.Prepare(`
+	SELECT id, email, used, created
+	FROM auth_codes
+	WHERE code = ?`)
+	if err != nil {
+		return err
+	}
+	defer stmt.Close()
+
+	return stmt.QueryRow(c.Code).Scan(&c.ID, &c.Email, &c.Used, &c.Created)
+}
+
 // TODO other auth code as needed