diff --git a/grpc/java/BUILD b/grpc/java/BUILD
index 33a8dc9..0ca5360 100644
--- a/grpc/java/BUILD
+++ b/grpc/java/BUILD
@@ -16,6 +16,7 @@ java_grpc_library(
         "//proto:answer-proto",
         "//proto:concept-proto",
         "//proto:connection-proto",
+        "//proto:authentication-proto",
         "//proto:logic-proto",
         "//proto:options-proto",
         "//proto:query-proto",
diff --git a/grpc/nodejs/BUILD b/grpc/nodejs/BUILD
index 6233662..74860c2 100644
--- a/grpc/nodejs/BUILD
+++ b/grpc/nodejs/BUILD
@@ -32,6 +32,7 @@ ts_grpc_compile(
         "//proto:answer-proto",
         "//proto:concept-proto",
         "//proto:connection-proto",
+        "//proto:authentication-proto",
         "//proto:logic-proto",
         "//proto:options-proto",
         "//proto:query-proto",
diff --git a/grpc/rust/BUILD b/grpc/rust/BUILD
index 5d608c9..2c98ea8 100644
--- a/grpc/rust/BUILD
+++ b/grpc/rust/BUILD
@@ -19,6 +19,7 @@ rust_tonic_compile(
         "//proto:answer-proto",
         "//proto:concept-proto",
         "//proto:connection-proto",
+        "//proto:authentication-proto",
         "//proto:logic-proto",
         "//proto:options-proto",
         "//proto:query-proto",
diff --git a/grpc/rust/build.rs b/grpc/rust/build.rs
index e5008cc..6e91838 100644
--- a/grpc/rust/build.rs
+++ b/grpc/rust/build.rs
@@ -5,6 +5,7 @@
 fn main() -> std::io::Result<()> {
     let protos = vec![
         "../../proto/answer.proto",
+        "../../proto/authentication.proto",
         "../../proto/concept.proto",
         "../../proto/connection.proto",
         "../../proto/database.proto",
diff --git a/proto/BUILD b/proto/BUILD
index 9c9ec50..756f318 100644
--- a/proto/BUILD
+++ b/proto/BUILD
@@ -11,6 +11,7 @@ proto_library(
     srcs = [":typedb-service.proto"],
     deps = [
         ":connection-proto",
+        ":authentication-proto",
         ":server-proto",
         ":user-proto",
         ":database-proto",
@@ -39,6 +40,11 @@ proto_library(
     deps = [":concept-proto"],
 )
 
+proto_library(
+    name = "authentication-proto",
+    srcs = ["authentication.proto"],
+)
+
 proto_library(
     name = "concept-proto",
     srcs = ["concept.proto"],
@@ -48,8 +54,9 @@ proto_library(
     name = "connection-proto",
     srcs = ["connection.proto"],
     deps = [
-        ":version-proto",
-        ":database-proto"
+        ":authentication-proto",
+        ":database-proto",
+        ":version-proto"
     ],
 )
 
diff --git a/proto/authentication.proto b/proto/authentication.proto
new file mode 100644
index 0000000..5a93162
--- /dev/null
+++ b/proto/authentication.proto
@@ -0,0 +1,29 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+syntax = "proto3";
+
+package typedb.protocol;
+
+message Authentication {
+  message Token {
+    message Create {
+      message Req {
+        message Password {
+          string username = 1;
+          string password = 2;
+        }
+
+        oneof credentials {
+          Password password = 1;
+          // extend by other credential kinds
+        }
+      }
+
+      message Res {
+        string token = 1;
+      }
+    }
+  }
+}
diff --git a/proto/connection.proto b/proto/connection.proto
index b7f5105..6123524 100644
--- a/proto/connection.proto
+++ b/proto/connection.proto
@@ -4,8 +4,9 @@
 
 syntax = "proto3";
 
-import "proto/version.proto";
+import "proto/authentication.proto";
 import "proto/database.proto";
+import "proto/version.proto";
 
 package typedb.protocol;
 
@@ -16,16 +17,18 @@ message Connection {
       Version version = 1;
       string driver_lang = 2;
       string driver_version = 3;
+
+      Authentication.Token.Create.Req authentication = 4;
     }
 
     message Res {
       uint64 server_duration_millis = 1;
       ConnectionID connection_id = 2;
 
-      // TODO: initial Token
-
       // pre-send all databases and replica info
       DatabaseManager.All.Res databases_all = 3;
+
+      Authentication.Token.Create.Res authentication = 4;
     }
   }
 }
diff --git a/proto/query.proto b/proto/query.proto
index bfae4c9..0ffc7a4 100644
--- a/proto/query.proto
+++ b/proto/query.proto
@@ -6,7 +6,6 @@ syntax = "proto3";
 
 import "proto/answer.proto";
 import "proto/options.proto";
-import "proto/concept.proto";
 
 package typedb.protocol;
 
diff --git a/proto/typedb-service.proto b/proto/typedb-service.proto
index 4f693cd..beffa1b 100644
--- a/proto/typedb-service.proto
+++ b/proto/typedb-service.proto
@@ -4,6 +4,7 @@
 
 syntax = "proto3";
 
+import "proto/authentication.proto";
 import "proto/connection.proto";
 import "proto/database.proto";
 import "proto/server.proto";
@@ -17,6 +18,9 @@ service TypeDB {
     // Connection API
     rpc connection_open (Connection.Open.Req) returns (Connection.Open.Res);
 
+    // Authentication API
+    rpc authentication_token_create (Authentication.Token.Create.Req) returns (Authentication.Token.Create.Res);
+
     // Server Manager API
     rpc servers_all (ServerManager.All.Req) returns (ServerManager.All.Res);
 
diff --git a/proto/version.proto b/proto/version.proto
index 683ce5d..f414540 100644
--- a/proto/version.proto
+++ b/proto/version.proto
@@ -7,7 +7,7 @@ syntax = "proto3";
 package typedb.protocol;
 
 enum Version {
-  reserved 1, 2, 3; // add past version numbers into the reserved range
+  reserved 1, 2, 3, 4; // add past version numbers into the reserved range
   UNSPECIFIED = 0;
-  VERSION = 4;
+  VERSION = 5;
 }