diff --git a/.gitignore b/.gitignore
index c8856fe..0fb90a1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,6 +9,7 @@
 *.sublime-workspace
 *.ropeproject
 .env
+.private*
 .pytest.ini
 *#*#
 *.#*
diff --git a/demo/config.py b/demo/config.py
index be6d49c..4bfcfdf 100644
--- a/demo/config.py
+++ b/demo/config.py
@@ -42,3 +42,7 @@ oidc_params = dict(
     cookie_crypt=getenv('OIDC_COOKIE_CRYPT', None)
 )
 
+# access zitadel API
+zitadel_params = dict(
+    private_key_file=('ZITADEL_SERVICE_USER_PRIVATE_KEY_FILE', '.private-key.json')
+)
diff --git a/demo/env.in b/demo/env.in
new file mode 100644
index 0000000..ca81e80
--- /dev/null
+++ b/demo/env.in
@@ -0,0 +1,15 @@
+# s10: py-scopes/demo/.env
+# input (example) file - copy to .env and edit.
+
+SERVER_PORT=8800
+BASE_URL=https://demo.cy7.de
+
+DBNAME=demo
+DBUSER=demo
+DBPASSWORD=secret
+DBSCHEMA=demo
+
+OIDC_PROVIDER=
+OIDC_CLIENT_ID=
+OIDC_COOKIE_CRYPT=
+
diff --git a/scopes/org/__init__.py b/scopes/org/__init__.py
new file mode 100644
index 0000000..ebd0060
--- /dev/null
+++ b/scopes/org/__init__.py
@@ -0,0 +1 @@
+"""package scopes.org"""
diff --git a/scopes/organize/mail.py b/scopes/org/mail.py
similarity index 94%
rename from scopes/organize/mail.py
rename to scopes/org/mail.py
index 6871741..7d010bd 100644
--- a/scopes/organize/mail.py
+++ b/scopes/org/mail.py
@@ -1,4 +1,4 @@
-# scopes.organize.mail
+# scopes.org.mail
 
 from zope.interface import implementer
 from zope.sendmail.interfaces import IMailDelivery
diff --git a/scopes/organize/task.py b/scopes/org/task.py
similarity index 90%
rename from scopes/organize/task.py
rename to scopes/org/task.py
index c0a98cc..1e02ac1 100644
--- a/scopes/organize/task.py
+++ b/scopes/org/task.py
@@ -1,4 +1,4 @@
-# scopes.organize.task
+# scopes.org.task
 
 """Task (and corresponding container) implementation."""
 
diff --git a/scopes/org/user.py b/scopes/org/user.py
new file mode 100644
index 0000000..8179e47
--- /dev/null
+++ b/scopes/org/user.py
@@ -0,0 +1,8 @@
+# scopes.org.user
+
+"""Basic user (principal) definitions + access to auth service (zitadel)."""
+
+from scopes.web import client
+from scopes import util
+
+import config
diff --git a/scopes/organize/__init__.py b/scopes/organize/__init__.py
deleted file mode 100644
index 829e828..0000000
--- a/scopes/organize/__init__.py
+++ /dev/null
@@ -1 +0,0 @@
-"""package scopes.organize"""
diff --git a/scopes/tests/config.py b/scopes/tests/config.py
index 475536a..79ba5e9 100644
--- a/scopes/tests/config.py
+++ b/scopes/tests/config.py
@@ -55,3 +55,7 @@ oidc_params = dict(
     cookie_crypt=getenv('OIDC_COOKIE_CRYPT', None)
 )
 
+# access zitadel API
+zitadel_params = dict(
+    private_key_file=('ZITADEL_SERVICE_USER_PRIVATE_KEY_FILE', '.private-key.json')
+)
diff --git a/scopes/web/client.py b/scopes/web/client.py
new file mode 100644
index 0000000..dd12bf8
--- /dev/null
+++ b/scopes/web/client.py
@@ -0,0 +1,5 @@
+# scopes.web.client
+
+"""Web client functionality: access to web sites, APIs - including authentication."""
+
+import requests