diff --git a/crates/dtrack-http/src/main.rs b/crates/dtrack-http/src/main.rs
index fb9ff85..8097727 100644
--- a/crates/dtrack-http/src/main.rs
+++ b/crates/dtrack-http/src/main.rs
@@ -1,17 +1,10 @@
 mod admin;
+mod gate;
 
-use std::collections::HashSet;
 use std::sync::Arc;
 
 use anyhow::{Context, Result};
-use axum::{
-    extract::{Request, State},
-    http::{header::AUTHORIZATION, StatusCode},
-    middleware::{self, Next},
-    response::Response,
-    routing::get,
-    Router,
-};
+use axum::{middleware, routing::get, Router};
 use dtrack_core::{DtrackClient, DtrackConfig};
 use dtrack_tools::{shared_client, DtrackServer};
 use rmcp::transport::streamable_http_server::{
@@ -19,55 +12,6 @@ use rmcp::transport::streamable_http_server::{
 };
 use tokio::sync::RwLock;
 
-/// Bearer-Token-Gate fuer den /mcp-Endpoint.
-///
-/// Stage 2: eine flache Token-Liste aus `DTRACK_HTTP_TOKENS` (kommagetrennt).
-/// Rechte pro Token (Permission-Engine) folgen spaeter.
-#[derive(Clone)]
-struct AuthState {
-    tokens: Arc<HashSet<String>>,
-    allow_all: bool,
-}
-
-impl AuthState {
-    fn from_env() -> Self {
-        let raw = std::env::var("DTRACK_HTTP_TOKENS").unwrap_or_default();
-        let tokens: HashSet<String> = raw
-            .split(',')
-            .map(str::trim)
-            .filter(|s| !s.is_empty())
-            .map(str::to_owned)
-            .collect();
-        let allow_all = tokens.is_empty();
-        if allow_all {
-            tracing::warn!(
-                "DTRACK_HTTP_TOKENS leer -- /mcp ist UNGESCHUETZT (nur fuer lokale Tests)."
-            );
-        }
-        Self {
-            tokens: Arc::new(tokens),
-            allow_all,
-        }
-    }
-}
-
-async fn auth_mw(State(auth): State<AuthState>, req: Request, next: Next) -> Result<Response, StatusCode> {
-    if auth.allow_all {
-        return Ok(next.run(req).await);
-    }
-    let presented = req
-        .headers()
-        .get(AUTHORIZATION)
-        .and_then(|h| h.to_str().ok())
-        .and_then(|h| h.strip_prefix("Bearer "))
-        .map(str::trim);
-
-    match presented {
-        Some(tok) if auth.tokens.contains(tok) => Ok(next.run(req).await),
-        _ => Err(StatusCode::UNAUTHORIZED),
-    }
-}
-
 #[tokio::main]
 async fn main() -> Result<()> {
     tracing_subscriber::fmt()
@@ -96,10 +40,10 @@ async fn main() -> Result<()> {
         Default::default(),
     );
 
-    let auth = AuthState::from_env();
+    let gate = gate::Gate::from_env()?;
     let mcp = Router::new()
         .nest_service("/mcp", mcp_service)
-        .layer(middleware::from_fn_with_state(auth, auth_mw));
+        .layer(middleware::from_fn_with_state(gate, gate::gate_mw));
 
     let admin_router = admin::router(app_state, admin::AdminAuth::from_env());