diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,49 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
+and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.2.0] - 2019-03-04
+
+# Added
+
+- #168 LTS-13 support @domenkozar
+- #161 /api/v1/install support @domenkozar
+- #168 private binary caches support @domenkozar
+
+### Changed
+
+- #168 remove swagger UI @domenkozar
+
+## [0.1.0.3] - 2018-11-27
+
+### Changed
+
+- Remove redundant orphan instance for swagger2-2.3.1 @domenkozar
+
+## [0.1.0.2] - 2018-09-27
+
+### Changed
+
+- #132 Remove autogenerated cabal file from git @domenkozar
+- NarC now strips the extension @domenkozar
+- added `BinaryCacheAuthenticated` @domenkozar
+- #118 User: add email field @domenkozar
+- Update dependencies to Stackage LTS-12 @domenkozar
+
+### Changed
+
+## [0.1.0.1] - 2018-07-06
+
+### Changed
+
+- #95 Upgrade to servant-0.14.1 @domenkozar
+
+## [0.1.0.0] - 2018-07-01
+
+### Added
+- Initial release @domenkozar
diff --git a/ChangeLog.md b/ChangeLog.md
deleted file mode 100644
--- a/ChangeLog.md
+++ /dev/null
@@ -1,37 +0,0 @@
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
-and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
-
-## [Unreleased]
-
-## [0.1.0.3] - 2018-11-27
-
-### Changed
-
-- Remove redundant orphan instance for swagger2-2.3.1 @domenkozar
-
-## [0.1.0.2] - 2018-09-27
-
-### Changed
-
-- #132 Remove autogenerated cabal file from git @domenkozar
-- NarC now strips the extension @domenkozar
-- added `BinaryCacheAuthenticated` @domenkozar
-- #118 User: add email field @domenkozar
-- Update dependencies to Stackage LTS-12 @domenkozar
-
-### Changed
-
-## [0.1.0.1] - 2018-07-06
-
-### Changed
-
-- #95 Upgrade to servant-0.14.1 @domenkozar
-
-## [0.1.0.0] - 2018-07-01
-
-### Added
-- Initial release @domenkozar
diff --git a/cachix-api.cabal b/cachix-api.cabal
--- a/cachix-api.cabal
+++ b/cachix-api.cabal
@@ -1,6 +1,6 @@
 cabal-version:  2.2
 name:           cachix-api
-version:        0.1.0.3
+version:        0.2.0
 synopsis:       Servant HTTP API specification for https://cachix.org
 homepage:       https://github.com/cachix/cachix#readme
 bug-reports:    https://github.com/cachix/cachix/issues
@@ -12,7 +12,7 @@
 build-type:     Simple
 
 extra-source-files:
-    ChangeLog.md
+    CHANGELOG.md
     README.md
 
 common defaults
@@ -28,36 +28,41 @@
   import: defaults
   exposed-modules:
       Cachix.Api
+      Cachix.Api.Error
       Cachix.Api.Signing
       Cachix.Api.Types
       Cachix.Types.BinaryCacheAuthenticated
+      Cachix.Types.BinaryCacheCreate
       Cachix.Types.ContentTypes
+      Cachix.Types.GitHubTeam
       Cachix.Types.NarInfoCreate
       Cachix.Types.Servant
       Cachix.Types.Session
+      Cachix.Types.SigningKeyCreate
       Cachix.Types.SwaggerOrphans
   hs-source-dirs:
       src
   build-depends:
       aeson
-    , amazonka
     , base >=4.7 && <5
     , base16-bytestring
     , bytestring
     , conduit >=1.3.0
     , cookie
     , cryptonite
+    , deepseq
+    , exceptions
     , http-api-data
     , http-media
     , lens
     , memory
+    , resourcet
     , servant >=0.14.1
+    , servant-client
     , servant-auth
     , servant-auth-server
     , servant-auth-swagger
-    , servant-streaming
     , servant-swagger
-    , servant-swagger-ui-core
     , string-conv
     , swagger2
     , text
@@ -83,7 +88,6 @@
       test
   build-depends:
       aeson
-    , amazonka
     , base >=4.7 && <5
     , base16-bytestring
     , bytestring
@@ -101,7 +105,6 @@
     , servant-auth
     , servant-auth-server
     , servant-auth-swagger
-    , servant-streaming
     , servant-swagger
     , servant-swagger-ui-core
     , string-conv
diff --git a/src/Cachix/Api.hs b/src/Cachix/Api.hs
--- a/src/Cachix/Api.hs
+++ b/src/Cachix/Api.hs
@@ -3,75 +3,120 @@
 {-# LANGUAGE TypeOperators #-}
 
 module Cachix.Api
-  ( api
-  , servantApi
+  ( servantApi
   , swaggerDoc
   , CachixAPI(..)
-  , BinaryCacheAPI(..)
   , CachixServantAPI
+  , CachixAuth
+  , InstallAPI(..)
+  , GitHubAPI(..)
+  , BinaryCacheAPI(..)
+  , BinaryCacheStreamingAPI(..)
+  , BinaryCachStreamingServantAPI
   , module Cachix.Api.Types
   , module Cachix.Types.ContentTypes
   ) where
 
 import Control.Lens
-
+import Control.Monad.Trans.Resource
+import Data.ByteString (ByteString)
+import Data.Conduit (ConduitT)
 import Data.Proxy (Proxy(..))
 import Data.Swagger hiding (Header)
 import Data.Text
 import GHC.Generics (Generic)
-import Network.AWS (AWS)
-import Servant.API
-import Servant.Auth
+import Servant.API hiding (BasicAuth)
 import Servant.API.Generic
-import Servant.Streaming
+import Servant.Auth
+import Servant.Auth.Swagger ()
 import Servant.Swagger
-import Servant.Swagger.UI.Core   (SwaggerSchemaUI)
 import Web.Cookie                (SetCookie)
 
-import Cachix.Types.BinaryCacheAuthenticated as BinaryCacheAuthenticated
-import Cachix.Types.NarInfoCreate
 import Cachix.Types.ContentTypes
 import Cachix.Types.Servant      (Get302, Post302, Head)
 import Cachix.Types.Session      (Session)
 import Cachix.Types.SwaggerOrphans ()
 import Cachix.Api.Types
 
+import qualified Cachix.Types.BinaryCacheCreate as BinaryCacheCreate
+import qualified Cachix.Types.BinaryCacheAuthenticated as BinaryCacheAuthenticated
+import qualified Cachix.Types.GitHubTeam as GitHubTeam
+import qualified Cachix.Types.NarInfoCreate as NarInfoCreate
+import qualified Cachix.Types.SigningKeyCreate as SigningKeyCreate
 
-type CachixAuth = Auth '[Cookie,JWT] Session
 
+type CachixAuth = Auth '[Cookie, JWT, BasicAuth] Session
+
 data BinaryCacheAPI route = BinaryCacheAPI
   { get :: route :-
+      CachixAuth :>
       Get '[JSON] BinaryCache
   , create :: route :-
       CachixAuth :>
-      ReqBody '[JSON] BinaryCacheCreate :>
+      ReqBody '[JSON] BinaryCacheCreate.BinaryCacheCreate :>
       Post '[JSON] NoContent
   -- https://cache.nixos.org/nix-cache-info
   , nixCacheInfo :: route :-
+      CachixAuth :>
       "nix-cache-info" :>
       Get '[XNixCacheInfo, JSON] NixCacheInfo
-  -- Hydra: src/lib/Hydra/View/NixNAR.pm
-  , nar :: route :-
-      "nar" :>
-      Capture "nar" NarC :>
-      StreamResponseGet '[XNixNar, JSON]
-  , createNar :: route :-
-      "nar" :>
-      StreamBodyMonad '[XNixNar, JSON] AWS :>
-      Post '[JSON] NoContent
   -- Hydra: src/lib/Hydra/View/NARInfo.pm
   , narinfo :: route :-
+      CachixAuth :>
       Capture "narinfo" NarInfoC :>
       Get '[XNixNarInfo, JSON] NarInfo
   , narinfoHead :: route :-
+      CachixAuth :>
       Capture "narinfo" NarInfoC :>
       Head
   , createNarinfo :: route :-
       Capture "narinfo" NarInfoC :>
-      ReqBody '[JSON] NarInfoCreate :>
+      ReqBody '[JSON] NarInfoCreate.NarInfoCreate :>
       Post '[JSON] NoContent
+  , createKey :: route :-
+      CachixAuth :>
+      "key" :>
+      ReqBody '[JSON] SigningKeyCreate.SigningKeyCreate :>
+      Post '[JSON] NoContent
   } deriving Generic
 
+-- | Streaming endpoints
+data BinaryCacheStreamingAPI route = BinaryCacheStreamingAPI
+  { -- Hydra: src/lib/Hydra/View/NixNAR.pm
+    nar :: route :-
+      CachixAuth :>
+      "nar" :>
+      Capture "nar" NarC :>
+      StreamGet NoFraming OctetStream (ConduitT () ByteString (ResourceT IO) ())
+  , createNar :: route :-
+      "nar" :>
+      StreamBody NoFraming XNixNar (ConduitT () ByteString (ResourceT IO) ()) :>
+      Post '[JSON] NoContent
+  } deriving Generic
+
+data InstallAPI route = InstallAPI
+  { installGetLatest :: route :-
+    Summary "Redirects to a tarball containing nix expression to build the latest version of cachix cli" :>
+    Get302 '[JSON] '[]
+  , installGetVersion :: route :-
+    Summary "Redirects to a tarball containing nix expression to build given version of cachix cli" :>
+    Capture "version" Text :>
+    Get302 '[JSON] '[]
+  } deriving Generic
+
+data GitHubAPI route = GitHubAPI
+  { githubOrganizations :: route :-
+    CachixAuth :>
+    "orgs" :>
+    Get '[JSON] [Text]
+  , githubTeams :: route :-
+    CachixAuth :>
+    "orgs" :>
+    Capture "org" Text :>
+    "teams" :>
+    Get '[JSON] [GitHubTeam.GitHubTeam]
+  } deriving Generic
+
 data CachixAPI route = CachixAPI
    { logout :: route :-
        "logout" :>
@@ -106,18 +151,21 @@
        "cache" :>
        Capture "name" Text :>
        ToServantApi BinaryCacheAPI
+   , install :: route :-
+       "install" :>
+       ToServantApi InstallAPI
+   , github :: route :-
+       "github" :>
+       ToServantApi GitHubAPI
    } deriving Generic
 
 type CachixServantAPI = "api" :> "v1" :> ToServantApi CachixAPI
 
+type BinaryCachStreamingServantAPI =
+  "api" :> "v1" :> "cache" :> Capture "name" Text :> ToServantApi BinaryCacheStreamingAPI
+
 servantApi :: Proxy CachixServantAPI
 servantApi = Proxy
-
-type API = CachixServantAPI
-   :<|> "api" :> SwaggerSchemaUI "v1" "swagger.json"
-
-api :: Proxy API
-api = Proxy
 
 swaggerDoc :: Swagger
 swaggerDoc = toSwagger servantApi
diff --git a/src/Cachix/Api/Error.hs b/src/Cachix/Api/Error.hs
new file mode 100644
--- /dev/null
+++ b/src/Cachix/Api/Error.hs
@@ -0,0 +1,23 @@
+module Cachix.Api.Error
+ ( escalate
+ , escalateAs
+ ) where
+
+import Control.Exception              (Exception)
+import Control.Monad.Catch            ( MonadThrow(throwM) )
+
+{- | Examples:
+    > escalate . maybeToEither err404
+
+  | Note that exceptions gets handled by warp and logged (user sees just "Internal server")
+-}
+escalateAs :: (Exception exc, MonadThrow m)
+          => (l -> exc)
+          -> Either l a
+          -> m a
+escalateAs f = either (throwM . f) pure
+
+escalate :: (Exception exc, MonadThrow m)
+        => Either exc a
+        -> m a
+escalate = escalateAs id
diff --git a/src/Cachix/Api/Types.hs b/src/Cachix/Api/Types.hs
--- a/src/Cachix/Api/Types.hs
+++ b/src/Cachix/Api/Types.hs
@@ -5,6 +5,7 @@
 import Data.Swagger         (ToSchema, ToParamSchema)
 import Data.Text            (Text, takeEnd, dropEnd)
 import GHC.Generics         (Generic)
+import Control.DeepSeq      (NFData)
 import Servant.API
 
 
@@ -48,13 +49,10 @@
 data BinaryCache = BinaryCache
   { name :: Text
   , uri :: Text
+  , isPublic :: Bool
   , publicSigningKeys :: [Text]
   , githubUsername :: Text
-  } deriving (Show, Generic, FromJSON, ToJSON, ToSchema)
-
-newtype BinaryCacheCreate = BinaryCacheCreate
-  { publicSigningKey :: Text
-  } deriving (Show, Generic, FromJSON, ToJSON, ToSchema)
+  } deriving (Show, Generic, FromJSON, ToJSON, ToSchema, NFData)
 
 newtype BinaryCacheError = BinaryCacheError
   { error :: Text
@@ -85,7 +83,13 @@
   toUrlPiece (NarInfoC n) = n <> ".narinfo"
 
 data User = User
-  { fullname :: Text
+  { fullname :: Maybe Text
   , username :: Text
   , email :: Maybe Text
+  , hasOrgsAcccess :: Bool
+  , activeSubscription :: SubscriptionType
+  , subscriptionAccountId :: Maybe Text
   } deriving (Generic, FromJSON, ToJSON, ToSchema)
+
+data SubscriptionType = Community | Starter | Basic | Pro
+  deriving (Generic, FromJSON, ToJSON, ToSchema, Show, Read)
diff --git a/src/Cachix/Types/BinaryCacheAuthenticated.hs b/src/Cachix/Types/BinaryCacheAuthenticated.hs
--- a/src/Cachix/Types/BinaryCacheAuthenticated.hs
+++ b/src/Cachix/Types/BinaryCacheAuthenticated.hs
@@ -15,5 +15,6 @@
   { name :: Text
   , uri :: Text
   , publicSigningKeys :: [Text]
+  , isPublic :: Bool
   , totalFileSize :: Integer
   } deriving (Show, Generic, FromJSON, ToJSON, ToSchema)
diff --git a/src/Cachix/Types/BinaryCacheCreate.hs b/src/Cachix/Types/BinaryCacheCreate.hs
new file mode 100644
--- /dev/null
+++ b/src/Cachix/Types/BinaryCacheCreate.hs
@@ -0,0 +1,18 @@
+module Cachix.Types.BinaryCacheCreate
+  ( BinaryCacheCreate(..)
+  ) where
+
+import           Data.Aeson                     ( FromJSON
+                                                , ToJSON
+                                                )
+import           Data.Swagger
+import           Data.Text                      ( Text )
+import           GHC.Generics                   ( Generic )
+
+
+data BinaryCacheCreate = BinaryCacheCreate
+  { publicSigningKey :: Maybe Text
+  , isPublic :: Bool
+  , githubOrganization :: Maybe Text
+  , githubTeamId :: Maybe Int
+  } deriving (Show, Generic, FromJSON, ToJSON, ToSchema)
diff --git a/src/Cachix/Types/ContentTypes.hs b/src/Cachix/Types/ContentTypes.hs
--- a/src/Cachix/Types/ContentTypes.hs
+++ b/src/Cachix/Types/ContentTypes.hs
@@ -5,7 +5,9 @@
   XNixCacheInfo
 ) where
 
-import           Data.Typeable      (Typeable)
+import           Data.ByteString      (ByteString)
+import           Data.ByteString.Lazy (fromStrict, toStrict)
+import           Data.Typeable        (Typeable)
 import qualified Network.HTTP.Media as M
 import           Servant.API
 
@@ -29,3 +31,9 @@
 
 instance MimeUnrender XNixNarInfo NarInfo where
   mimeUnrender _ _ = Left "TODO"
+
+instance MimeRender XNixNar ByteString where
+  mimeRender _ = fromStrict
+
+instance MimeUnrender XNixNar ByteString where
+  mimeUnrender _ = Right . toStrict
diff --git a/src/Cachix/Types/GitHubTeam.hs b/src/Cachix/Types/GitHubTeam.hs
new file mode 100644
--- /dev/null
+++ b/src/Cachix/Types/GitHubTeam.hs
@@ -0,0 +1,16 @@
+module Cachix.Types.GitHubTeam
+  ( GitHubTeam(..)
+  ) where
+
+import           Data.Aeson                     ( FromJSON
+                                                , ToJSON
+                                                )
+import           Data.Swagger
+import           Data.Text                      ( Text )
+import           GHC.Generics                   ( Generic )
+
+
+data GitHubTeam = GitHubTeam
+  { id :: Int
+  , name :: Text
+  } deriving (Generic, FromJSON, ToJSON, ToSchema)
diff --git a/src/Cachix/Types/SigningKeyCreate.hs b/src/Cachix/Types/SigningKeyCreate.hs
new file mode 100644
--- /dev/null
+++ b/src/Cachix/Types/SigningKeyCreate.hs
@@ -0,0 +1,15 @@
+module Cachix.Types.SigningKeyCreate
+  ( SigningKeyCreate(..)
+  ) where
+
+import           Data.Aeson                     ( FromJSON
+                                                , ToJSON
+                                                )
+import           Data.Swagger
+import           Data.Text                      ( Text )
+import           GHC.Generics                   ( Generic )
+
+
+newtype SigningKeyCreate = SigningKeyCreate
+  { publicKey :: Text
+  } deriving (Show, Generic, FromJSON, ToJSON, ToSchema)
diff --git a/src/Cachix/Types/SwaggerOrphans.hs b/src/Cachix/Types/SwaggerOrphans.hs
--- a/src/Cachix/Types/SwaggerOrphans.hs
+++ b/src/Cachix/Types/SwaggerOrphans.hs
@@ -1,31 +1,23 @@
 {-# OPTIONS_GHC -fno-warn-orphans #-}
 {-# LANGUAGE DataKinds #-}
-{-# LANGUAGE CPP #-}
 {-# LANGUAGE TypeOperators #-}
 {-# LANGUAGE FlexibleInstances #-}
 {-# LANGUAGE MultiParamTypeClasses #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 module Cachix.Types.SwaggerOrphans
-  () where
+  where
 
-import Data.Proxy
-import Data.Swagger (ToParamSchema(..))
-import Servant.API
-import Servant.Swagger
-import Servant.Streaming
-import Servant.Auth.Swagger ()
-import Web.Cookie           (SetCookie)
+import Control.DeepSeq (NFData)
+import Data.Proxy   (Proxy(..))
+import Data.Conduit (ConduitT)
+import Data.Swagger (ToSchema(..))
+import Servant.API  (NoContent)
 
-#if MIN_VERSION_swagger2(2,3,1)
-#else
-instance ToParamSchema SetCookie where
-  toParamSchema _ = mempty
-#endif
 
--- https://github.com/plow-technologies/servant-streaming/blob/master/servant-streaming-docs/src/Servant/Streaming/Docs/Internal.hs
--- TODO: these should define the body/response content
-instance (HasSwagger api) => HasSwagger (StreamBodyMonad contentTypes m :> api) where
-  toSwagger _ = toSwagger (Proxy :: Proxy api)
+-- TODO: upstream to servant-conduit
+instance ToSchema i => ToSchema (ConduitT i o m r) where
+  declareNamedSchema _ = declareNamedSchema (Proxy :: Proxy i)
+  -- TODO: Proxy o
 
-instance HasSwagger (StreamResponseGet contentTypes) where
-  toSwagger _ = mempty -- TODO mkEndpointNoContent
+-- https://github.com/haskell-servant/servant/pull/1090
+instance NFData NoContent