diff --git a/src/db.rs b/src/db.rs
index 942b2fa..38178e5 100644
--- a/src/db.rs
+++ b/src/db.rs
@@ -46,7 +46,9 @@ impl OAuthDatabase {
         self.psql_execute("create table Scopes(scope_id uuid primary key, resource_id uuid, scope_name text, scope_desc text)", &[]).await?;
         self.psql_execute("create table ApplicationAccess(access_id uuid primary key, client_id uuid, scope_id uuid)", &[]).await?;
         self.psql_execute("create table Users(user_id uuid primary key, user_name text)", &[]).await?;
-        self.psql_execute("create table MasterDBAccess(master_db_token bytea primary key, master_db_desc text)", &[]).await?;
+        self.psql_execute("create table MasterDBAccess(master_db_id uuid primary key, master_db_token bytea primary key, master_db_desc text)", &[]).await?;
+        self.psql_execute("create table ResourceDBAccess(resource_db_id uuid primary key, resource_id uuid, resource_db_token bytea, resource_db_desc text)", &[]).await?;
+        self.psql_execute("create table ClientDBAccess(client_db_id uuid primary key, client_id uuid, client_db_token bytea, client_db_desc text)", &[]).await?;
         Ok(())
     }
 
@@ -93,6 +95,18 @@ impl OAuthDatabase {
         self.psql_execute("insert into Users(user_id, user_name) values ($1, $2)", &[&user.user_id, &user.user_name]).await?;
         Ok(user)
     }
+
+    /// Issue a master token.
+    /// Applicant: master
+    pub async fn trusted_issue_master_token(&mut self, description: &String) -> Result<crate::oauth_types::oauth_access::OAuthMasterDBAccess, tokio_postgres::Error> {
+        // TEST: functionality
+        let access = crate::oauth_types::oauth_access::OAuthMasterDBAccess::create(description);
+        let hashed = crate::oauth_types::oauth_access::OAuthHashedMasterDBAccess::from(&access);
+        self.psql_execute("insert into MasterDBAccess(master_db_id, master_db_token, master_db_desc) values($1, $2, $3)", &[&hashed.master_db_id, &hashed.master_db_token, &hashed.master_db_desc]).await?;
+        Ok(access)
+    }
+
+    // TODO: other type of db tokens
 }
 
 #[cfg(test)]
diff --git a/src/oauth_types/oauth_access.rs b/src/oauth_types/oauth_access.rs
index 5212a2a..481df9c 100644
--- a/src/oauth_types/oauth_access.rs
+++ b/src/oauth_types/oauth_access.rs
@@ -34,7 +34,6 @@ impl OAuthMasterDBAccess {
     // TEST: functionality
     pub fn create(description: &String) -> Self {
         Self {
-            // TODO: token_id
             master_db_id: Uuid::new_v4(),
             master_db_token: crate::misc::random_256(),
             master_db_desc: description.to_owned(),
@@ -83,6 +82,7 @@ pub struct OAuthResourceDBAccess {
 }
 
 impl OAuthResourceDBAccess {
+    // TEST: functionality
     pub fn create(resource_id: &Uuid, description: &String) -> Self {
         Self {
             resource_db_id: Uuid::new_v4(),
@@ -109,6 +109,7 @@ pub struct OAuthHashedResourceDBAccess {
 }
 
 impl OAuthHashedResourceDBAccess {
+    // TEST: functionality
     pub fn from(access: &OAuthResourceDBAccess) -> Self {
         Self {
             resource_db_id: access.resource_db_id.to_owned(),
@@ -126,3 +127,56 @@ impl OAuthHashedResourceDBAccess {
         }
     }
 }
+
+pub struct OAuthClientDBAccess {
+    pub client_db_id: Uuid,
+    pub client_id: Uuid,
+    pub client_db_token: crate::misc::U256,
+    pub client_db_desc: String,
+}
+
+impl OAuthClientDBAccess {
+    pub fn create(client_id: &Uuid, description: &String) -> Self {
+        Self {
+            client_db_id: Uuid::new_v4(),
+            client_id: client_id.to_owned(),
+            client_db_token: crate::misc::random_256(),
+            client_db_desc: description.to_owned(),
+        }
+    }
+    pub fn new(client_db_id: &Uuid, client_id: &Uuid, client_db_token: &crate::misc::U256, client_db_desc: &String) -> Self {
+        Self {
+            client_db_id: client_db_id.to_owned(),
+            client_id: client_id.to_owned(),
+            client_db_token: client_db_token.to_owned(),
+            client_db_desc: client_db_desc.to_owned(),
+        }
+    }
+}
+
+pub struct OAuthHashedClientDBAccess {
+    pub client_db_id: Uuid,
+    pub client_id: Uuid,
+    pub client_db_token: Vec<u8>,
+    pub client_db_desc: String
+}
+
+impl OAuthHashedClientDBAccess {
+    pub fn from(access: &OAuthClientDBAccess) -> Self {
+        Self {
+            client_db_id: access.client_db_id.to_owned(),
+            client_id: access.client_id.to_owned(),
+            client_db_token: crate::misc::digest(&access.client_db_token),
+            client_db_desc: access.client_db_desc.to_owned(),
+        }
+    }
+    pub fn new(client_db_id: &Uuid, client_id: &Uuid, client_db_token: &Vec<u8>, client_db_desc: &String) -> Self {
+        Self {
+            client_db_id: client_db_id.to_owned(),
+            client_id: client_id.to_owned(),
+            client_db_token: client_db_token.to_owned(),
+            client_db_desc: client_db_desc.to_owned(),
+        }
+    }
+}
+