diff --git a/cmd/zrok/create.go b/cmd/zrok/create.go
index f2584046..1163d4f7 100644
--- a/cmd/zrok/create.go
+++ b/cmd/zrok/create.go
@@ -3,6 +3,7 @@ package main
 import (
 	"github.com/openziti-test-kitchen/zrok/rest_model"
 	"github.com/openziti-test-kitchen/zrok/rest_zrok_client/identity"
+	"github.com/openziti/foundation/v2/term"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )
@@ -18,18 +19,36 @@ var createCmd = &cobra.Command{
 }
 
 var createAccountCmd = &cobra.Command{
-	Use:   "account <username>",
+	Use:   "account",
 	Short: "create new zrok account",
-	Run: func(_ *cobra.Command, args []string) {
+	Run: func(_ *cobra.Command, _ []string) {
+		username, err := term.Prompt("New Username: ")
+		if err != nil {
+			panic(err)
+		}
+		password, err := term.PromptPassword("New Password: ", false)
+		if err != nil {
+			panic(err)
+		}
+		confirm, err := term.PromptPassword("Confirm Password: ", false)
+		if err != nil {
+			panic(err)
+		}
+		if confirm != password {
+			panic("confirmed password mismatch")
+		}
+
 		zrok := newZrokClient()
 		req := identity.NewCreateAccountParams()
 		req.Body = &rest_model.AccountRequest{
-			Username: args[0],
+			Username: username,
+			Password: password,
 		}
 		resp, err := zrok.Identity.CreateAccount(req)
 		if err != nil {
 			panic(err)
 		}
+
 		logrus.Infof("api token = '%v'", resp.Payload.APIToken)
 	},
 }
diff --git a/controller/controller.go b/controller/controller.go
index 6134603b..46a4ca6d 100644
--- a/controller/controller.go
+++ b/controller/controller.go
@@ -1,6 +1,8 @@
 package controller
 
 import (
+	"crypto/sha512"
+	"encoding/hex"
 	"github.com/go-openapi/loads"
 	"github.com/go-openapi/runtime/middleware"
 	"github.com/openziti-test-kitchen/zrok/controller/store"
@@ -48,11 +50,41 @@ func versionHandler(_ metadata.VersionParams) middleware.Responder {
 
 func createAccountHandler(params identity.CreateAccountParams) middleware.Responder {
 	logrus.Infof("received account request for username '%v'", params.Body.Username)
-	apiToken, err := generateApiToken()
+	if params.Body == nil || params.Body.Username == "" || params.Body.Password == "" {
+		return middleware.Error(500, errors.Errorf("invalid username or password"))
+	}
+
+	token, err := generateApiToken()
 	if err != nil {
 		return middleware.Error(500, err.Error())
 	}
+
+	a := &store.Account{
+		Username: params.Body.Username,
+		Password: hashPassword(params.Body.Password),
+		Token:    token,
+	}
+	tx, err := str.Begin()
+	if err != nil {
+		return middleware.Error(500, err.Error())
+	}
+	id, err := str.CreateAccount(a, tx)
+	if err != nil {
+		_ = tx.Rollback()
+		return middleware.Error(500, err.Error())
+	}
+	if err := tx.Commit(); err != nil {
+		logrus.Errorf("error comitting: %v", err)
+	}
+
+	logrus.Infof("account created with id = '%v'", id)
 	return identity.NewCreateAccountCreated().WithPayload(&rest_model.AccountResponse{
-		APIToken: apiToken,
+		APIToken: token,
 	})
 }
+
+func hashPassword(raw string) string {
+	hash := sha512.New()
+	hash.Write([]byte(raw))
+	return hex.EncodeToString(hash.Sum(nil))
+}