diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..37d7e73
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+node_modules
+.env
diff --git a/README.md b/README.md
index 01534c8..e69de29 100644
--- a/README.md
+++ b/README.md
@@ -1,55 +0,0 @@
-![CF](https://camo.githubusercontent.com/70edab54bba80edb7493cad3135e9606781cbb6b/687474703a2f2f692e696d6775722e636f6d2f377635415363382e706e67) 18: Image Uploads w/ AWS S3
-===
-
-## Submission Instructions
-  * fork this repository & create a new branch for your work
-  * write all of your code in a directory named `lab-` + `<your name>` **e.g.** `lab-susan`
-  * push to your repository
-  * submit a pull request to this repository
-  * submit a link to your PR in canvas
-  * write a question and observation on canvas
-
-## Learning Objectives  
-* students will be able to upload static assets to AWS S3
-* students will be able to retrieve a cdn url that contains the previously uploaded static asset
-* students will be able to work with secret and public access keys
-
-## Requirements
-#### Configuration
-* `package.json`
-* `.eslintrc`
-* `.gitignore`
-* `README.md`
-
-#### Description
-* create an AWS account
-* create an AWS Access Key and Secret
-  * add the Access Key and Secret to your `.env` file
-* create a new model that represents a file type that you want to store on AWS S3
-  * ex: `.mp3`, `.mp4`, `.png`, etc
-* create a test that uploads one of these files to your route
-* use the `aws-sdk` to assist with uploading
-* use `multer` to parse the file upload request
-
-#### Server Endpoint
-* `POST` - `/api/resource/:resourceID/new-resource`
-
-#### Tests
-* `POST` - **200** - test that the upload worked and a resource object is returned
-
-#### Bonus
-* `DELETE` route - `/api/resource/:resourceID/new-resource/:new-resourceID`
-* Test: `DELETE` - **204** - test to ensure the object was deleted from s3
-
-#### Bonus: 3pts
-* try using the `deleteObject` method provided by the `aws-sdk` to delete an object *(file)* from S3
-  * you will need to pass in a `params` object that contains the associated Bucket and AWS object key in order to delete the object from s3
-  * ex:
-  ``` javascript
-  var params = {
-    Bucket: 's3-bucket-name',
-    Key: 'object-filename'
-  }
-  s3.deleteObject(params)
-  ```
-* don't forget to remove the resource from the DB
diff --git a/data/cubone.jpg b/data/cubone.jpg
new file mode 100644
index 0000000..4e4a2d9
Binary files /dev/null and b/data/cubone.jpg differ
diff --git a/lib/basic-auth-middleware.js b/lib/basic-auth-middleware.js
new file mode 100644
index 0000000..694b953
--- /dev/null
+++ b/lib/basic-auth-middleware.js
@@ -0,0 +1,36 @@
+'use strict';
+
+const createError = require('http-errors');
+const debug = require('debug')('pokegram:basic-auth-middleware');
+
+module.exports = function(req, res, next) {
+  debug('basic auth');
+
+  var authHeader = req.headers.authorization;
+  if (!authHeader) {
+    return next(createError(401, 'authorization header required'));
+  }
+
+  var base64str = authHeader.split('Basic ')[1];
+  if (!base64str) {
+    return next(createError(401, 'username and password required'));
+  }
+
+  var utf8str = new Buffer(base64str, 'base64').toString();
+  var authArr = utf8str.split(':');
+
+  req.auth = {
+    username: authArr[0],
+    password: authArr[1]
+  }
+
+  if (!req.auth.username) {
+    return next(createError(401, 'username required'));
+  }
+
+  if (!req.auth.password) {
+    return next(createError(401, 'password required'));
+  }
+
+  next();
+}
\ No newline at end of file
diff --git a/lib/bearer-auth-middleware.js b/lib/bearer-auth-middleware.js
new file mode 100644
index 0000000..4775d0d
--- /dev/null
+++ b/lib/bearer-auth-middleware.js
@@ -0,0 +1,34 @@
+'use strict';
+
+const jwt = require('jsonwebtoken');
+const createError = require('http-errors');
+const debug = require('debug')('pokegram:bearer-auth-middleware');
+
+const User = require('../model/user.js');
+
+module.exports = function(req, res, next) {
+  debug('bearer auth');
+
+  var authHeader = req.headers.authorization;
+  if(!authHeader) {
+    return next(createError(401, 'authorization header required'));
+  }
+
+  var token = authHeader.split('Bearer ')[1];
+  if(!token) {
+    return next(createError(401, 'token required'));
+  }
+
+  jwt.verify(token, process.env.APP_SECRET, (err, decoded) => {
+    if(err) return next(err);
+
+    User.findOne({findHash: decoded.token})
+    .then(user => {
+      req.user = user;
+      next();
+    })
+    .catch(err => {
+      next(createError(401, err.message));
+    });
+  });
+};
\ No newline at end of file
diff --git a/lib/error-middleware.js b/lib/error-middleware.js
new file mode 100644
index 0000000..73b8277
--- /dev/null
+++ b/lib/error-middleware.js
@@ -0,0 +1,28 @@
+'use strict';
+
+const createError = require('http-errors');
+const debug = require('debug')('pokegram:error-middleware');
+
+module.exports = function(err, req, res, next) {
+  debug('error middleware');
+
+  console.error('message:', err.message);
+  console.error('name:', err.name);
+
+  if (err.status) {
+    res.status(err.status).send(err.name);
+    next();
+    return;
+  }
+
+  if (err.name === 'ValidationError') {
+    err = createError(400, err.message);
+    res.status(err.status).send(err.name);
+    next();
+    return;
+  }
+
+  err = createError(500, err.message);
+  res.status(err.status).send(err.name);
+  next();
+}
\ No newline at end of file
diff --git a/model/gallery.js b/model/gallery.js
new file mode 100644
index 0000000..860cf10
--- /dev/null
+++ b/model/gallery.js
@@ -0,0 +1,13 @@
+'use strict';
+
+const mongoose = require('mongoose');
+const Schema = mongoose.Schema;
+
+const gallerySchema = Schema({
+  name: {type: String, required: true},
+  description: {type: String, required: true},
+  created: {type: Date, required: true, default: Date.now},
+  userID: {type: Schema.Types.ObjectId, required: true}
+});
+
+module.exports = mongoose.model('gallery', gallerySchema);
\ No newline at end of file
diff --git a/model/pokemon.js b/model/pokemon.js
new file mode 100644
index 0000000..818768b
--- /dev/null
+++ b/model/pokemon.js
@@ -0,0 +1,16 @@
+'use strict';
+
+const mongoose = require('mongoose');
+const Schema = mongoose.Schema;
+
+const pokemonSchema = Schema({
+  name: { type: String, required: true },
+  year: { type: String, required: true },
+  userID: { type: Schema.Types.ObjectId, required: true },
+  pokemonID: { type: Schema.Types.ObjectId, required: true },
+  audioURI: { type: String, required: true, unique: true },
+  objectKey: { type: String, required: true, unique: true },
+  created: { type: Date, default: Date.now }
+});
+
+module.exports = mongoose.model('pokemon', pokemonSchema);
\ No newline at end of file
diff --git a/model/user.js b/model/user.js
new file mode 100644
index 0000000..ee55e25
--- /dev/null
+++ b/model/user.js
@@ -0,0 +1,74 @@
+'use strict';
+
+const crypto = require('crypto');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const mongoose = require('mongoose');
+const createError = require('http-errors');
+const Promise = require('bluebird');
+const debug = require('debug')('pokegram:user');
+
+const Schema = mongoose.Schema;
+
+const userSchema = Schema({
+  username: { type: String, required: true, unique: true },
+  email: { type: String, required: true, unique: true },
+  password: { type: String, required: true },
+  findHash: { type: String, unique: true }
+});
+
+userSchema.methods.generatePasswordHash = function(password) {
+  debug('generatePasswordHash');
+  
+  return new Promise((resolve, reject) => {
+    bcrypt.hash(password, 10, (err, hash) => {
+      if(err) return reject(err);
+      this.password = hash;
+      resolve(this);
+    });
+  });
+}
+
+userSchema.methods.comparePasswordHash = function(password) {
+  debug('comparePasswordHash');
+  return new Promise((resolve, reject) => {
+    bcrypt.compare(password, this.password, (err, valid) => {
+      if(err) return reject(err);
+      if(!valid) return reject(createError(401, 'invalid password'));
+      resolve(this);
+    });
+  });
+}
+
+userSchema.methods.generateFindHash = function() {
+  debug('generateFindHash');
+  
+  return new Promise((resolve, reject) => {
+    let tries = 0;
+
+  _generateFindHash.call(this);
+
+    function _generateFindHash() {
+      this.findHash = crypto.randomBytes(32).toString('hex');
+      this.save()
+      .then(() => resolve(this.findHash))
+      .catch(err => {
+        if (tries > 3) return reject(err);
+        tries++;
+        _generateFindHash.call(this);
+      });
+    }
+  });
+}
+
+userSchema.methods.generateToken = function() {
+  debug('generateToken');
+  
+  return new Promise((resolve, reject) => {
+    this.generateFindHash()
+    .then(findHash => resolve(jwt.sign({ token: findHash }, process.env.APP_SECRET)))
+    .catch(err => reject(err));
+  });
+}
+
+module.exports = mongoose.model('user', userSchema);
\ No newline at end of file
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..736dd9a
--- /dev/null
+++ b/package.json
@@ -0,0 +1,42 @@
+{
+  "name": "17-bearer-auth",
+  "version": "1.0.0",
+  "description": "![CF](https://camo.githubusercontent.com/70edab54bba80edb7493cad3135e9606781cbb6b/687474703a2f2f692e696d6775722e636f6d2f377635415363382e706e67) 17: Bearer Auth ===",
+  "main": "server.js",
+  "directories": {
+    "test": "test"
+  },
+  "dependencies": {
+    "bcrypt": "^1.0.2",
+    "bluebird": "^3.5.0",
+    "body-parser": "^1.17.2",
+    "cors": "^2.8.4",
+    "debug": "^2.6.8",
+    "dotenv": "^4.0.0",
+    "express": "^4.15.4",
+    "http-errors": "^1.6.2",
+    "jsonwebtoken": "^7.4.2",
+    "mongoose": "^4.11.6",
+    "morgan": "^1.8.2",
+  },
+  "devDependencies": {
+    "chai": "^4.1.1",
+    "mocha": "^3.5.0",
+    "superagent": "^3.5.2"
+  },
+  "scripts": {
+    "test": "DEBUG='pokemon*' mocha",
+    "start": "DEBUG='pokemon*' node server.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Loaye/17-bearer-auth.git"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "bugs": {
+    "url": "https://github.com/Loaye/17-bearer-auth/issues"
+  },
+  "homepage": "https://github.com/Loaye/17-bearer-auth#readme"
+}
diff --git a/route/auth-router.js b/route/auth-router.js
new file mode 100644
index 0000000..6937fb7
--- /dev/null
+++ b/route/auth-router.js
@@ -0,0 +1,34 @@
+'use strict';
+
+const jsonParser = require('body-parser').json();
+const debug = require('debug')('pokegram:auth-router');
+const Router = require('express').Router;
+const basicAuth = require('../lib/basic-auth-middleware.js');
+const User = require('../model/user.js');
+
+const authRouter = module.exports = Router();
+
+authRouter.post('/api/signup', jsonParser, function(req, res, next) {
+  debug('POST: /api/signup');
+
+  let password = req.body.password;
+  delete req.body.password;
+
+  let user = new User(req.body);
+
+  user.generatePasswordHash(password)
+  .then( user => user.save())
+  .then( user => user.generateToken())
+  .then( token => res.send(token))
+  .catch(next);
+});
+
+authRouter.get('/api/signin', basicAuth, function(req, res, next) {
+  debug('GET: /api/signin');
+
+  User.findOne({ username: req.auth.username })
+  .then( user => user.comparePasswordHash(req.auth.password))
+  .then( user => user.generateToken())
+  .then( token => res.send(token))
+  .catch(next);
+});
\ No newline at end of file
diff --git a/route/gallery-router.js b/route/gallery-router.js
new file mode 100644
index 0000000..08f69c0
--- /dev/null
+++ b/route/gallery-router.js
@@ -0,0 +1,280 @@
+'use strict';
+
+const expect = require('chai').expect;
+const request = require('superagent');
+const Promise = require('bluebird');
+
+const User = require('../model/user.js');
+const Pokemon = require('../model/pokemon.js');
+
+const url = `http://localhost:${process.env.PORT}`;
+
+const exampleUser = {
+  username: 'exampleruser',
+  password: '12345',
+  email: 'example@test.com'
+};
+
+const examplePokemon = {
+  name: 'example name',
+  type: 'example type',
+  gen: 'example gen'
+};
+
+describe('Pokemon Routes', function() {
+  afterEach(done => {
+    Promise.all([
+      User.remove({}),
+      Pokemon.remove({})
+    ])
+    .then( () => done())
+    .catch(done);
+  });
+
+  describe('POST: /api/pokemon', () => {
+    beforeEach(done => {
+      new User(exampleUser)
+      .generatePasswordHash(exampleUser.password)
+      .then(user => user.save())
+      .then(user => {
+        this.tempUser = user;
+        return user.generateToken();
+      })
+      .then(token => {
+        this.tempToken = token;
+        done();
+      })
+      .catch(done);
+    });
+
+    it('should return a pokemon', done => {
+      request.post(`${url}/api/pokemon`)
+      .send(examplePokemon)
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        if(err) return done(err);
+        expect(res.body.name).to.equal(examplePokemon.name);
+        expect(res.body.type).to.equal(examplePokemon.genre);
+        expect(res.body.gen).to.equal(examplePokemon.gen);
+        expect(res.body.userID).to.equal(this.tempUser._id.toString());
+        done();
+      });
+    });
+
+    it('should return 401', done => {
+      request.post(`${url}/api/pokemon`)
+      .send(examplePokemon)
+      .end((err, res) => {
+        expect(res.status).to.equal(401);
+        done();
+      });
+    });
+
+    it('should return 400', done => {
+      request.post(`${url}/api/pokemon`)
+      .send({ name: 'fakename', type: 'faketype' })
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        expect(res.status).to.equal(400);
+        done();
+      });
+    });
+  });
+
+  describe('GET: /api/pokemon/:id', () => {
+    before(done => {
+      new User(exampleUser)
+      .generatePasswordHash(exampleUser.password)
+      .then(user => user.save())
+      .then(user => {
+        this.tempUser = user;
+        return user.generateToken();
+      })
+      .then(token => {
+        this.tempToken = token;
+        done();
+      })
+      .catch(done);
+    });
+
+    before(done => {
+      examplePokemon.userID = this.tempUser._id.toString();
+      new Pokemon(examplePokemon).save()
+      .then(pokemon => {
+        this.tempPokemon = pokemon;
+        done();
+      })
+      .catch(done);
+    });
+
+    after(() => {
+      delete examplePokemon.userID;
+    });
+
+    it('should return a pokemon', done => {
+      request.get(`${url}/api/pokemon/${this.tempPokemon._id}`)
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        if(err) return done(err);
+        expect(res.body.name).to.equal(examplePokemon.name);
+        expect(res.body.gen).to.equal(examplePokemon.gen);
+        expect(res.body.type).to.equal(examplePokemon.type);
+        expect(res.body.userID).to.equal(this.tempUser._id.toString());
+        done();
+      });
+    });
+
+    it('should return 404', done => {
+      request.get(`${url}/api/pokemon`)
+      .end((err, res) => {
+        expect(res.status).to.equal(404);
+        done();
+      });
+    });
+
+    it('should return 401', done => {
+      request.get(`${url}/api/pokemon/${this.tempPokemon._id}`)
+      .end((err, res) => {
+        expect(res.status).to.equal(401);
+        done();
+      });
+    });
+  });
+
+  describe('PUT: /api/pokemon/:id', function() {
+    beforeEach(done => {
+      new User(exampleUser)
+      .generatePasswordHash(exampleUser.password)
+      .then(user => user.save())
+      .then(user => {
+        this.tempUser = user;
+        return user.generateToken();
+      })
+      .then(token => {
+        this.tempToken = token;
+        done();
+      })
+      .catch(done);
+    });
+
+    beforeEach(done => {
+      examplePokemon.userID = this.tempUser._id.toString();
+      new Pokemon(examplePokemon).save()
+      .then(pokemon => {
+        this.tempPokemon = pokemon;
+        done();
+      })
+      .catch(done);
+    });
+
+    after( () => {
+      delete examplePokemon.userID;
+    });
+
+    it('should return a pokemon', done => {
+      request.put(`${url}/api/pokemon/${this.tempPokemon._id}`)
+      .send({ name: 'new pokemon name' })
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        if(err) return done(err);
+        expect(res.status).to.equal(200);
+        expect(res.body.name).to.equal('new pokemon name');
+        done();
+      });
+    });
+
+    it('should return 404', done => {
+      request.put(`${url}/api/pokemon`)
+      .end((err, res) => {
+        expect(res.status).to.equal(404);
+        done();
+      });
+    });
+
+    it('should return 401', done => {
+      request.put(`${url}/api/pokemon/${this.tempPokemon._id}`)
+      .end((err, res) => {
+        expect(res.status).to.equal(401);
+        done();
+      });
+    });
+
+    it('should return 400', done => {
+      request.post(`${url}/api/pokemon`)
+      .send({ name: 'fakename', type: 'faketype' })
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        expect(res.status).to.equal(400);
+        done();
+      });
+    });
+  });
+
+  describe('DELETE: /api/pokemon/:id', function() {
+    beforeEach(done => {
+      new User(exampleUser)
+      .generatePasswordHash(exampleUser.password)
+      .then(user => user.save())
+      .then(user => {
+        this.tempUser = user;
+        return user.generateToken();
+      })
+      .then(token => {
+        this.tempToken = token;
+        done();
+      })
+      .catch(done);
+    });
+
+    beforeEach(done => {
+      examplePokemon.userID = this.tempUser._id.toString();
+      new Pokemon(examplePokemon).save()
+      .then(pokemon => {
+        this.tempPokemon = pokemon;
+        done();
+      })
+      .catch(done);
+    });
+
+    it('should return 204', done => {
+      request.delete(`${url}/api/pokemon/${this.tempPokemon._id}`)
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        if(err) return done(err);
+        expect(res.status).to.equal(204);
+        done();
+      });
+    });
+
+    it('should return 404', done => {
+      request.delete(`${url}/api/pokemon`)
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        expect(res.status).to.equal(404);
+        done();
+      });
+    });
+
+    it('should return 401', done => {
+      request.delete(`${url}/api/pokemon/${this.tempPokemon._id}`)
+      .end((err, res) => {
+        expect(res.status).to.equal(401);
+        done();
+      });
+    });
+  });
+});
\ No newline at end of file
diff --git a/route/pokemon-router.js b/route/pokemon-router.js
new file mode 100644
index 0000000..163b3e6
--- /dev/null
+++ b/route/pokemon-router.js
@@ -0,0 +1,68 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const del = require('del');
+const AWS = require('aws-sdk');
+const multer = require('multer');
+const Router = require('express').Router;
+const createError = require('http-errors');
+const debug = require('debug')('pokegram:pokemon-router');
+
+const Pokemon = require('../model/pokemon.js');
+const Gallery = require('../model/gallery.js');
+const bearerAuth = require('../lib/bearer-auth-middleware.js');
+
+AWS.config.setPromisesDependency(require('bluebird'));
+
+const s3 = new AWS.S3();
+const dataDir = `${__dirname}/../data`;
+const upload = multer({dest: dataDir});
+
+const pokemonRouter = module.exports = Router();
+
+function s3uploadProm(params) {
+  return new Promise((resolve, reject) => {
+    s3.upload(params, (err, s3data) => {
+      resolve(s3data);
+    });
+  });
+}
+
+pokemonRouter.post('/api/gallery/:galleryId/pokemon', bearerAuth, upload.single('image'), function(req, res, next) {
+  debug('POST: /api/gallery/:galleryID/pokemon');
+
+  if(!req.file) {
+    return next(createError(404, 'file not found'));
+  }
+
+  if(!req.file.path) {
+    return next(createError(500, 'file not saved'));
+  }
+
+  let ext = path.extname(req.file.originalName);
+
+  let params = {
+    ACL: 'public-read',
+    Bucket: process.env.AWS_BUCKET,
+    Key: `${req.file.filename}${ext}`,
+    Body: fs.createReadStream(req.file.path),
+  };
+
+  Gallery.findById(req.params.galleryID)
+  .then(() => s3uploadProm(params))
+  .then(s3data => {
+    del(['${dataDir}/*']);
+    let pokemonData = {
+      name: req.body.name,
+      description: req.body.description,
+      objectKey: s3data.Key,
+      imageURI: s3data.Location,
+      userID: req.user._id,
+      galleryID: req.params.galleryID,
+    }
+    return new Pokemon(pokemonData).save();
+  })
+  .then(pokemon => res.json(pokemon))
+  .catch(err => next(err));
+});
\ No newline at end of file
diff --git a/server.js b/server.js
new file mode 100644
index 0000000..4df253d
--- /dev/null
+++ b/server.js
@@ -0,0 +1,31 @@
+'use strict';
+
+const express = require('express');
+const debug = require('debug')('poke:server');
+const dotenv = require('dotenv');
+const mongoose = require('mongoose');
+const morgan = require('morgan');
+const cors = require('cors');
+
+const authRouter = require('./route/auth-route.js');
+const galleryRouter = require('./route/gallery-router.js');
+const pokemonRouter = require('./route/pokemon-route.js');
+const errors = require('./lib/error-middleware.js');
+
+dotenv.load();
+
+const app = express();
+const PORT = process.env.PORT || 3000;
+mongoose.connect(process.env.MONGODB_URI);
+
+app.use(cors());
+app.use(morgan('dev'));
+
+app.use(authRouter);
+app.use(galleryRouter);
+app.use(pokemonRouter);
+app.use(errors);
+
+app.listen(PORT, () => {
+  debug(`Listening on: ${PORT}`);
+});
\ No newline at end of file
diff --git a/test/auth-route-test.js b/test/auth-route-test.js
new file mode 100644
index 0000000..9b0e0c8
--- /dev/null
+++ b/test/auth-route-test.js
@@ -0,0 +1,72 @@
+'use strict';
+
+const expect = require('chai').expect;
+const request = require('superagent');
+const mongoose = require('mongoose');
+const Promise = require('bluebird');
+const User = require('../model/user.js');
+
+require('../server.js');
+
+const url = `http://localhost:${process.env.PORT}`;
+
+const exampleUser = {
+  username: 'exampleuser',
+  password: '1234',
+  email: 'exampleuser@test.com'
+}
+
+describe('Auth Routes', function() {
+  describe('POST: /api/signup', function() {
+    describe('with a valid body', function() {
+      after(done => {
+        User.remove({})
+        .then(() => done())
+        .catch(done);
+      });
+
+      it('should return a token', done => {
+        request.post(`${url}/api/signup`)
+        .send(exampleUser)
+        .end((err, res) => {
+          if (err) return done(err);
+          console.log('POST: /api/signup TOKEN:', res.text, '\n');
+          expect(res.status).to.equal(200);
+          expect(res.text).to.be.a('string');
+          done();
+        });
+      });
+    });
+  });
+
+  describe('GET: /api/signin', function() {
+    describe('with a valid body', function() {
+      before( done => {
+        let user = new User(exampleUser);
+        user.generatePasswordHash(exampleUser.password)
+        .then( user => user.save())
+        .then( user => {
+          this.tempUser = user;
+          done();
+        });
+      });
+
+      after( done => {
+        User.remove({})
+        .then( () => done())
+        .catch(done);
+      });
+
+      it('should return a token', done => {
+        request.get(`${url}/api/signin`)
+        .auth('exampleuser', '1234')
+        .end((err, res) => {
+          console.log('signed in user:', this.tempUser);
+          console.log('GET: /api/signin TOKEN:', res.text);
+          expect(res.status).to.equal(200);
+          done();
+        });
+      });
+    });
+  });
+});
\ No newline at end of file
diff --git a/test/gallery-route-test.js b/test/gallery-route-test.js
new file mode 100644
index 0000000..92567ba
--- /dev/null
+++ b/test/gallery-route-test.js
@@ -0,0 +1,113 @@
+'use strict';
+
+const expect = require('chai').expect;
+const request = require('superagent');
+const Promise = require('bluebird');
+const mongoose = require('mongoose');
+
+const User = require('../model/user.js');
+const Gallery = require('../model/gallery.js');
+
+const url = `http://localhost:${process.env.PORT}`;
+
+const exampleUser = {
+  username: 'exampleuser',
+  password: '12345',
+  email: 'exampleuser@test.com'
+};
+
+const exampleGallery = {
+  name: 'test gallery',
+  description: 'test gallery description',
+};
+
+describe('Gallery Routes', function() {
+  afterEach(done => {
+    promise.all([
+      User.remove({}),
+      Gallery.remove({})
+    ])
+    .then(() => done())
+    .catch(done);
+  });
+
+  describe('POST: /api/gallery', () => {
+    before(done => {
+      new User(exampleUser)
+      .generatePasswordHash(exampleGallery.password)
+      .then(user => user.save())
+      .then(user => {
+        this.tempUser = user;
+        return user.generateToken();
+      })
+      .then(token => {
+        this.tempToken = token;
+      })
+      .catch(done);
+    })
+
+    it('should return a gallery', done => {
+      request.post(`${url}/api/gallery`)
+      .send(exampleGallery)
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        if(err) return done(err);
+        let date = new Date(res.body.created).toString();
+        expect(res.body.name).to.equal(exampleGallery.name);
+        expect(res.body.description).to.equal(exampleGallery.description);
+        expect(res.body.userID).to.equal(this.tempUser._id.toString());
+        expect(date).to.not.equal('Invalid Date');
+        done();
+      });
+    });
+  });
+
+  describe('GET: /api/gallery/:id', () => {
+    before(done => {
+      new User(exampleUser)
+      .generatePasswordHash(exampleUser.password)
+      .then(user => user.save())
+      .then(user => {
+        this.tempUser = user;
+        return user.generateToken()
+      })
+      .then(token => {
+        this.tempToken = token;
+        done();
+      })
+      .catch(done);
+    })
+
+    before(done => {
+      exampleGallery.userID = this.tempUser._id.toString();
+      new Gallery(exampleGallery).save()
+      .then(gallery => {
+        this.tempGallery = gallery;
+        done();
+      })
+      .catch(done);
+    });
+
+    after(() => {
+      delete exampleGallery.userID;
+    });
+
+    it('should return a gallery', done => {
+      request.get(`${url}/api/gallery/${this.tempGallery._id}`)
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        if(err) return done(err);
+        let date = new Date(res.body.created).toString();
+        expect(res.body.name).to.equal(exampleGallery.name);
+        expect(res.body.description).to.equal(exampleGallery.description);
+        expect(res.body.userID).to.equal(this.tempUser._id.toString());
+        expect(date).to.not.equal('Invalid Date');
+        done();
+      });
+    });
+  });
+});
\ No newline at end of file
diff --git a/test/pokemon-route-test.js b/test/pokemon-route-test.js
new file mode 100644
index 0000000..2f3df94
--- /dev/null
+++ b/test/pokemon-route-test.js
@@ -0,0 +1,280 @@
+'use strict';
+
+const expect = require('chai').expect;
+const request = require('superagent');
+const Promise = require('bluebird');
+
+const User = require('../model/user.js');
+const Pokemon = require('../model/pokemon.js');
+
+const url = `http://localhost:${process.env.PORT}`;
+
+const exampleUser = {
+  username: 'exampleruser',
+  password: '12345',
+  email: 'example@test.com'
+};
+
+const examplePokemon = {
+  name: 'example name',
+  type: 'example type',
+  gen: 'example gen'
+};
+
+describe('Pokemon Routes', function() {
+  afterEach(done => {
+    Promise.all([
+      User.remove({}),
+      Pokemon.remove({})
+    ])
+    .then(() => done())
+    .catch(done);
+  });
+
+  describe('POST: /api/pokemon', () => {
+    beforeEach(done => {
+      new User(exampleUser)
+      .generatePasswordHash(exampleUser.password)
+      .then(user => user.save())
+      .then(user => {
+        this.tempUser = user;
+        return user.generateToken();
+      })
+      .then(token => {
+        this.tempToken = token;
+        done();
+      })
+      .catch(done);
+    });
+
+    it('should return a pokemon', done => {
+      request.post(`${url}/api/pokemon`)
+      .send(examplePokemon)
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        if(err) return done(err);
+        expect(res.name).to.equal(examplePokemon.name);
+        expect(res.body.type).to.equal(examplePokemon.type);
+        expect(res.body.gen).to.equal(examplePokemon.gen);
+        expect(res.body.userID).to.equal(this.tempUser._id.toString());
+        done();
+      });
+    });
+
+    it('should return 401', done => {
+      request.post(`${url}/api/pokemon`)
+      .send(examplePokemon)
+      .end((err, res) => {
+        expect(res.status).to.equal(401);
+        done();
+      });
+    });
+
+    it('should return 400', done => {
+      request.post(`${url}/api/pokemon`)
+      .send({ name: 'fakename', type: 'faketype' })
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        expect(res.status).to.equal(400);
+        done();
+      });
+    });
+  });
+
+  describe('GET: /api/pokemon/:id', () => {
+    before(done => {
+      new User(exampleUser)
+      .generatePasswordHash(exampleUser.password)
+      .then(user => user.save())
+      .then(user => {
+        this.tempUser = user;
+        return user.generateToken();
+      })
+      .then(token => {
+        this.tempToken = token;
+        done();
+      })
+      .catch(done);
+    });
+
+    before(done => {
+      examplePokemon.userID = this.tempUser._id.toString();
+      new Pokemon(examplePokemon).save()
+      .then(pokemon => {
+        this.tempPokemon = pokemon;
+        done();
+      })
+      .catch(done);
+    });
+
+    after(() => {
+      delete examplePokemon.userID;
+    });
+
+    it('should return a pokemon', done => {
+      request.get(`${url}/api/pokemon/${this.tempPokemon._id}`)
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        if(err) return done(err);
+        expect(res.body.name).to.equal(examplePokemon.name);
+        expect(res.body.type).to.equal(examplePokemon.type);
+        expect(res.body.gen).to.equal(examplePokemon.gen);
+        expect(res.body.userID).to.equal(this.tempUser._id.toString());
+        done();
+      });
+    });
+
+    it('should return 404', done => {
+      request.get(`${url}/api/pokemon`)
+      .end((err, res) => {
+        expect(res.status).to.equal(404);
+        done();
+      });
+    });
+
+    it('should return 401', done => {
+      request.get(`${url}/api/pokemon/${this.tempPokemon._id}`)
+      .end((err, res) => {
+        expect(res.status).to.equal(401);
+        done();
+      });
+    });
+  });
+
+  describe('PUT: /api/pokemon/:id', function() {
+    beforeEach(done => {
+      new User(exampleUser)
+      .generatePasswordHash(exampleUser.password)
+      .then(user => user.save())
+      .then(user => {
+        this.tempUser = user;
+        return user.generateToken();
+      })
+      .then(token => {
+        this.tempToken = token;
+        done();
+      })
+      .catch(done);
+    });
+
+    beforeEach(done => {
+      examplePokemon.userID = this.tempUser._id.toString();
+      new Pokemon(examplePokemon).save()
+      .then(pokemon => {
+        this.tempPokemon = pokemon;
+        done();
+      })
+      .catch(done);
+    });
+
+    after(() => {
+      delete examplePokemon.userID;
+    });
+
+    it('should return a pokemon', done => {
+      request.put(`${url}/api/pokemon/${this.tempPokemon._id}`)
+      .send({ name: 'new pokemon name' })
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        if(err) return done(err);
+        expect(res.status).to.equal(200);
+        expect(res.body.name).to.equal('new pokemon name');
+        done();
+      });
+    });
+
+    it('should return 404', done => {
+      request.put(`${url}/api/pokemon`)
+      .end((err, res) => {
+        expect(res.status).to.equal(404);
+        done();
+      });
+    });
+
+    it('should return 401', done => {
+      request.put(`${url}/api/pokemon/${this.tempPokemon._id}`)
+      .end((err, res) => {
+        expect(res.status).to.equal(401);
+        done();
+      });
+    });
+
+    it('should return 400', done => {
+      request.post(`${url}/api/pokemon`)
+      .send({ name: 'fakename', type: 'faketype' })
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        expect(res.status).to.equal(400);
+        done();
+      });
+    });
+  });
+
+  describe('DELETE: /api/pokemon/:id', function() {
+    beforeEach(done => {
+      new User(exampleUser)
+      .generatePasswordHash(exampleUser.password)
+      .then(user => user.save())
+      .then(user => {
+        this.tempUser = user;
+        return user.generateToken();
+      })
+      .then(token => {
+        this.tempToken = token;
+        done();
+      })
+      .catch(done);
+    });
+
+    beforeEach(done => {
+      examplePokemon.userID = this.tempUser._id.toString();
+      new Pokemon(examplePokemon).save()
+      .then(pokemon => {
+        this.tempPokemon = pokemon;
+        done();
+      })
+      .catch(done);
+    });
+
+    it('should return 204', done => {
+      request.delete(`${url}/api/pokemon/${this.tempPokemon._id}`)
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        if(err) return done(err);
+        expect(res.status).to.equal(204);
+        done();
+      });
+    });
+
+    it('should return 404', done => {
+      request.delete(`${url}/api/pokemon`)
+      .set({
+        Authorization: `Bearer ${this.tempToken}`
+      })
+      .end((err, res) => {
+        expect(res.status).to.equal(404);
+        done();
+      });
+    });
+
+    it('should return 401', done => {
+      request.delete(`${url}/api/pokemon/${this.tempPokemon._id}`)
+      .end((err, res) => {
+        expect(res.status).to.equal(401);
+        done();
+      });
+    });
+  });
+});
\ No newline at end of file