diff --git a/trifid-api/trifid_api_entities/src/entity/keystore_entry.rs b/trifid-api/trifid_api_entities/src/entity/keystore_entry.rs
new file mode 100644
index 0000000..2087437
--- /dev/null
+++ b/trifid-api/trifid_api_entities/src/entity/keystore_entry.rs
@@ -0,0 +1,41 @@
+//! `SeaORM` Entity. Generated by sea-orm-codegen 0.11.2
+
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "keystore_entry")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: String,
+    pub host: String,
+    pub counter: i32,
+    #[sea_orm(column_type = "Binary(BlobSize::Blob(None))")]
+    pub signing_key: Vec<u8>,
+    #[sea_orm(column_type = "Binary(BlobSize::Blob(None))")]
+    pub client_signing_key: Vec<u8>,
+    #[sea_orm(column_type = "Binary(BlobSize::Blob(None))")]
+    pub client_dh_key: Vec<u8>,
+    pub config: String,
+    #[sea_orm(column_type = "Binary(BlobSize::Blob(None))")]
+    pub certificate: Vec<u8>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(
+        belongs_to = "super::host::Entity",
+        from = "Column::Host",
+        to = "super::host::Column::Id",
+        on_update = "NoAction",
+        on_delete = "NoAction"
+    )]
+    Host,
+}
+
+impl Related<super::host::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::Host.def()
+    }
+}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/trifid-api/trifid_api_entities/src/entity/keystore_host.rs b/trifid-api/trifid_api_entities/src/entity/keystore_host.rs
new file mode 100644
index 0000000..bcac5b8
--- /dev/null
+++ b/trifid-api/trifid_api_entities/src/entity/keystore_host.rs
@@ -0,0 +1,16 @@
+//! `SeaORM` Entity. Generated by sea-orm-codegen 0.11.2
+
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "keystore_host")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: String,
+    pub counter: i32,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/trifid-api/trifid_api_migration/src/m20230815_225520_create_table_keystore_hosts.rs b/trifid-api/trifid_api_migration/src/m20230815_225520_create_table_keystore_hosts.rs
new file mode 100644
index 0000000..eceb6f6
--- /dev/null
+++ b/trifid-api/trifid_api_migration/src/m20230815_225520_create_table_keystore_hosts.rs
@@ -0,0 +1,39 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager.create_table(
+            Table::create()
+                .table(KeystoreHost::Table)
+                .col(
+                    ColumnDef::new(KeystoreHost::Id)
+                        .string()
+                        .not_null()
+                        .primary_key()
+                )
+                .col(
+                    ColumnDef::new(KeystoreHost::Counter)
+                        .integer()
+                        .not_null()
+                )
+                .to_owned()
+        ).await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(KeystoreHost::Table).to_owned())
+            .await
+    }
+}
+
+#[derive(Iden)]
+enum KeystoreHost {
+    Table,
+    Id,
+    Counter,
+}
diff --git a/trifid-api/trifid_api_migration/src/m20230815_230218_create_table_keystore_entries.rs b/trifid-api/trifid_api_migration/src/m20230815_230218_create_table_keystore_entries.rs
new file mode 100644
index 0000000..357ef03
--- /dev/null
+++ b/trifid-api/trifid_api_migration/src/m20230815_230218_create_table_keystore_entries.rs
@@ -0,0 +1,90 @@
+use sea_orm_migration::prelude::*;
+use crate::m20230427_170037_create_table_hosts::Host;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager.create_table(
+            Table::create()
+                .table(KeystoreEntry::Table)
+                .col(
+                    ColumnDef::new(KeystoreEntry::Id)
+                        .string()
+                        .not_null()
+                        .primary_key()
+                )
+                .col(
+                    ColumnDef::new(KeystoreEntry::Host)
+                        .string()
+                        .not_null()
+                )
+                .col(
+                    ColumnDef::new(KeystoreEntry::Counter)
+                        .integer()
+                        .not_null()
+                )
+                .col(
+                    ColumnDef::new(KeystoreEntry::SigningKey)
+                        .binary()
+                        .not_null()
+                )
+                .col(
+                    ColumnDef::new(KeystoreEntry::ClientSigningKey)
+                        .binary()
+                        .not_null()
+                )
+                .col(
+                    ColumnDef::new(KeystoreEntry::ClientDHKey)
+                        .binary()
+                        .not_null()
+                )
+                .col(
+                    ColumnDef::new(KeystoreEntry::Config)
+                        .string()
+                        .not_null()
+                )
+                .col(
+                    ColumnDef::new(KeystoreEntry::Certificate)
+                        .binary()
+                        .not_null()
+                )
+                .foreign_key(
+                    ForeignKey::create()
+                        .from(KeystoreEntry::Table, KeystoreEntry::Host)
+                        .to(Host::Table, Host::Id)
+                )
+                .index(
+                    Index::create()
+                        .name("idx-keystore-entry-host-counter-unique")
+                        .table(KeystoreEntry::Table)
+                        .col(KeystoreEntry::Host)
+                        .col(KeystoreEntry::Counter)
+                        .unique()
+                )
+                .to_owned()
+        ).await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(KeystoreEntry::Table).to_owned())
+            .await
+    }
+}
+
+/// Learn more at https://docs.rs/sea-query#iden
+#[derive(Iden)]
+enum KeystoreEntry {
+    Table,
+    Id,
+    Host,
+    Counter,
+    SigningKey,
+    ClientSigningKey,
+    ClientDHKey,
+    Config,
+    Certificate
+}