diff --git a/src/Controller/RAPIController.php b/src/Controller/RAPIController.php
index 746153ba..3d2777d0 100644
--- a/src/Controller/RAPIController.php
+++ b/src/Controller/RAPIController.php
@@ -165,89 +165,27 @@ class RAPIController extends Controller
         return $res->getReturnResponse();
     }
 
-    public function login(Request $req, EncoderFactoryInterface $ef, RedisClientProvider $redis, RiderCache $rcache)
+    public function login(Request $req, RiderAPIHandlerInterface $rapi_handler)
     {
-        $required_params = [
-            'user',
-            'pass',
-        ];
-        $em = $this->getDoctrine()->getManager();
-        $res = $this->checkParamsAndKey($req, $em, $required_params);
-        if ($res->isError())
-            return $res->getReturnResponse();
+        $res = new APIResult();
 
-        // check if session has a rider already
-        if ($this->session->hasRider())
+        $data = $rapi_handler->login($req);
+
+        if (isset($data['error']))
         {
+            $message = $data['error'];
+
             $res->setError(true)
-                ->setErrorMessage('Another rider is already logged in. Please logout first.');
-            return $res->getReturnResponse();
+                ->setErrorMessage($message);
         }
-            
-        // look for rider with username
-        $rider = $em->getRepository(Rider::class)->findOneBy(['username' => $req->request->get('user')]);
-        if ($rider == null)
-        {
-            $res->setError(true)
-                ->setErrorMessage('Invalid username or password.');
-            return $res->getReturnResponse();
-        }
-
-        // check if rider password is correct
-        $encoder = $ef->getEncoder(new User());
-        if (!$encoder->isPasswordValid($rider->getPassword(), $req->request->get('pass'), ''))
-        {
-            $res->setError(true)
-                ->setErrorMessage('Invalid username or password.');
-            return $res->getReturnResponse();
-        } 
-
-        // assign rider to session
-        $this->session->setRider($rider);
-
-        $rider->setAvailable(true);
-
-        $rider_id = $rider->getID();
-        // cache rider location (default to hub)
-        // TODO: figure out longitude / latitude default
-        $rcache->addActiveRider($rider_id, 0, 0);
-
-        // TODO: log rider logging in
-
-        $em->flush();
-
-        // update redis rider.id.<session id> with the rider id
-        $redis_client = $redis->getRedisClient();
-        $redis_key = 'rider.id.' . $this->session->getID();
-        $rider_id = $rider->getID();
-
-        $redis_client->set($redis_key, $rider_id); 
-
-        $hub = $rider->getHub();
-        if ($hub == null)
-            $hub_data = null;
         else
         {
-            $coord = $hub->getCoordinates();
-            $hub_data = [
-                'id' => $hub->getID(),
-                'name' => $hub->getName(),
-                'branch' => $hub->getBranch(),
-                'longitude' => $coord->getLongitude(),
-                'latitude' => $coord->getLatitude(),
-                'contact_nums' => $hub->getContactNumbers(),
-            ];
+            $res->setData($data);
         }
 
-        // data
-        $data = [
-            'hub' => $hub_data,
-            'rider_id' => $rider_id,
-        ];
-
-        $res->setData($data);
-
+        // response
         return $res->getReturnResponse();
+
     }
 
     public function logout(Request $req, RiderCache $rcache)
diff --git a/src/Service/RiderAPIHandler/CMBRiderAPIHandler.php b/src/Service/RiderAPIHandler/CMBRiderAPIHandler.php
index 8a964fc3..4c28a427 100644
--- a/src/Service/RiderAPIHandler/CMBRiderAPIHandler.php
+++ b/src/Service/RiderAPIHandler/CMBRiderAPIHandler.php
@@ -4,24 +4,39 @@ namespace App\Service\RiderAPIHandler;
 
 use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Security\Core\Encoder\EncoderFactoryInterface;
 
 use App\Ramcar\CMBServiceType;
 use App\Ramcar\CMBTradeInType;
 
 use App\Service\RiderAPIHandlerInterface;
 use App\Service\RedisClientProvider;
+use App\Service\RiderCache;
 
 use App\Entity\RiderSession;
+use App\Entity\Rider;
+use App\Entity\User;
 
 class CMBRiderAPIHandler implements RiderAPIHandlerInterface
 {
     protected $em; 
     protected $redis;
+    protected $ef;
+    protected $rcache;
+    protected $session;
 
-    public function __construct(EntityManagerInterface $em, RedisClientProvider $redis)
+    public function __construct(EntityManagerInterface $em, RedisClientProvider $redis,
+                                EncoderFactoryInterface $ef, RiderCache $rcache)
     {
         $this->em = $em;
         $this->redis = $redis;
+        $this->ef = $ef;
+        $this->rcache = $rcache;
+
+        // one device = one session, since we have control over the devices
+        // when a rider logs in, we just change the rider assigned to the device
+        // when a rider logs out, we remove the rider assigned to the device
+        $this->session = null;
     }
 
     public function register(Request $req)
@@ -90,6 +105,91 @@ class CMBRiderAPIHandler implements RiderAPIHandlerInterface
         return $data;
     }
 
+    public function login(Request $req)
+    {
+        $required_params = [
+            'user',
+            'pass',
+        ];
+        $data = $this->checkParamsAndKey($req, $required_params);
+        if (isset($data['error']))
+            return $data;
+
+        // check if session has a rider already
+        if ($this->session->hasRider())
+        {
+            $data = [
+                'error' => 'Another rider is already logged in. Please logout first.'
+            ];
+            return $data;
+        }
+
+        // look for rider with username
+        $rider = $this->em->getRepository(Rider::class)->findOneBy(['username' => $req->request->get('user')]);
+        if ($rider == null)
+        {
+            $data = [
+                'error' => 'Invalid username or password.'
+            ];
+            return $data;
+        }
+
+        // check if rider password is correct
+        $encoder = $this->ef->getEncoder(new User());
+        if (!$encoder->isPasswordValid($rider->getPassword(), $req->request->get('pass'), ''))
+        {
+            $data = [
+                'error' => 'Invalid username or password.'
+            ];
+            return $data;
+        }
+
+        // assign rider to session
+        $this->session->setRider($rider);
+
+        $rider->setAvailable(true);
+
+        $rider_id = $rider->getID();
+        // cache rider location (default to hub)
+        // TODO: figure out longitude / latitude default
+        $this->rcache->addActiveRider($rider_id, 0, 0);
+
+        // TODO: log rider logging in
+
+        $this->em->flush();
+
+        // update redis rider.id.<session id> with the rider id
+        $redis_client = $this->redis->getRedisClient();
+        $redis_key = 'rider.id.' . $this->session->getID();
+        $rider_id = $rider->getID();
+
+        $redis_client->set($redis_key, $rider_id);
+
+        $hub = $rider->getHub();
+        if ($hub == null)
+            $hub_data = null;
+        else
+        {
+            $coord = $hub->getCoordinates();
+            $hub_data = [
+                'id' => $hub->getID(),
+                'name' => $hub->getName(),
+                'branch' => $hub->getBranch(),
+                'longitude' => $coord->getLongitude(),
+                'latitude' => $coord->getLatitude(),
+                'contact_nums' => $hub->getContactNumbers(),
+            ];
+        }
+
+        // data
+        $data = [
+            'hub' => $hub_data,
+            'rider_id' => $rider_id,
+        ];
+
+        return $data;
+    }
+
     protected function checkMissingParameters(Request $req, $params = [])
     {
         $missing = [];
@@ -116,4 +216,55 @@ class CMBRiderAPIHandler implements RiderAPIHandlerInterface
         return $missing;
     }
 
+    protected function checkParamsAndKey(Request $req, $params)
+    {
+        $data = [];
+
+        // check for api_key in query string
+        $api_key = $req->query->get('api_key');
+        if (empty($api_key))
+        {
+            $data = [
+                'error' => 'Missing API key'
+            ];
+            return $data;
+        }
+
+        // check missing parameters
+        $missing = $this->checkMissingParameters($req, $params);
+        if (count($missing) > 0)
+        {
+            $miss_string = implode(', ', $missing);
+            $data = [
+                'error' => 'Missing parameter(s): ' . $miss_string
+            ];
+            return $data;
+        }
+
+        // check api key
+        $sess = $this->checkAPIKey($req->query->get('api_key'));
+        if ($sess == null)
+        {
+            $data = [
+                'error' => 'Invalid API Key'
+            ];
+            return $data;
+        }
+
+        // store session
+        $this->session = $sess;
+
+        return $data;
+    }
+
+    // TODO: type hint entity manager
+    protected function checkAPIKey($api_key)
+    {
+        // find the api key (session id)
+        $session = $this->em->getRepository(RiderSession::class)->find($api_key);
+        if ($session == null)
+            return null;
+
+        return $session;
+    }
 }
diff --git a/src/Service/RiderAPIHandler/ResqRiderAPIHandler.php b/src/Service/RiderAPIHandler/ResqRiderAPIHandler.php
index c1f81959..9470c50b 100644
--- a/src/Service/RiderAPIHandler/ResqRiderAPIHandler.php
+++ b/src/Service/RiderAPIHandler/ResqRiderAPIHandler.php
@@ -4,24 +4,39 @@ namespace App\Service\RiderAPIHandler;
 
 use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Security\Core\Encoder\EncoderFactoryInterface;
 
-use App\Ramcar\ServiceType;
-use App\Ramcar\TradeInType;
+use App\Ramcar\CMBServiceType;
+use App\Ramcar\CMBTradeInType;
 
 use App\Service\RiderAPIHandlerInterface;
 use App\Service\RedisClientProvider;
+use App\Service\RiderCache;
 
 use App\Entity\RiderSession;
+use App\Entity\Rider;
+use App\Entity\User;
 
 class ResqRiderAPIHandler implements RiderAPIHandlerInterface
 {
     protected $em; 
     protected $redis;
+    protected $ef;
+    protected $rcache;
+    protected $session;
 
-    public function __construct(EntityManagerInterface $em, RedisClientProvider $redis)
+    public function __construct(EntityManagerInterface $em, RedisClientProvider $redis,
+                                EncoderFactoryInterface $ef, RiderCache $rcache)
     {
         $this->em = $em;
         $this->redis = $redis;
+        $this->ef = $ef;
+        $this->rcache = $rcache;
+
+        // one device = one session, since we have control over the devices
+        // when a rider logs in, we just change the rider assigned to the device
+        // when a rider logs out, we remove the rider assigned to the device
+        $this->session = null;
     }
 
     public function register(Request $req)
@@ -90,6 +105,91 @@ class ResqRiderAPIHandler implements RiderAPIHandlerInterface
         return $data;
     }
 
+    public function login(Request $req)
+    {
+        $required_params = [
+            'user',
+            'pass',
+        ];
+        $data = $this->checkParamsAndKey($req, $required_params);
+        if (isset($data['error']))
+            return $data;
+
+        // check if session has a rider already
+        if ($this->session->hasRider())
+        {
+            $data = [
+                'error' => 'Another rider is already logged in. Please logout first.'
+            ];
+            return $data;
+        }
+
+        // look for rider with username
+        $rider = $this->em->getRepository(Rider::class)->findOneBy(['username' => $req->request->get('user')]);
+        if ($rider == null)
+        {
+            $data = [
+                'error' => 'Invalid username or password.'
+            ];
+            return $data;
+        }
+
+        // check if rider password is correct
+        $encoder = $this->ef->getEncoder(new User());
+        if (!$encoder->isPasswordValid($rider->getPassword(), $req->request->get('pass'), ''))
+        {
+            $data = [
+                'error' => 'Invalid username or password.'
+            ];
+            return $data;
+        }
+
+        // assign rider to session
+        $this->session->setRider($rider);
+
+        $rider->setAvailable(true);
+
+        $rider_id = $rider->getID();
+        // cache rider location (default to hub)
+        // TODO: figure out longitude / latitude default
+        $this->rcache->addActiveRider($rider_id, 0, 0);
+
+        // TODO: log rider logging in
+
+        $this->em->flush();
+
+        // update redis rider.id.<session id> with the rider id
+        $redis_client = $this->redis->getRedisClient();
+        $redis_key = 'rider.id.' . $this->session->getID();
+        $rider_id = $rider->getID();
+
+        $redis_client->set($redis_key, $rider_id);
+
+        $hub = $rider->getHub();
+        if ($hub == null)
+            $hub_data = null;
+        else
+        {
+            $coord = $hub->getCoordinates();
+            $hub_data = [
+                'id' => $hub->getID(),
+                'name' => $hub->getName(),
+                'branch' => $hub->getBranch(),
+                'longitude' => $coord->getLongitude(),
+                'latitude' => $coord->getLatitude(),
+                'contact_nums' => $hub->getContactNumbers(),
+            ];
+        }
+
+        // data
+        $data = [
+            'hub' => $hub_data,
+            'rider_id' => $rider_id,
+        ];
+
+        return $data;
+    }
+
     protected function checkMissingParameters(Request $req, $params = [])
     {
         $missing = [];
@@ -116,4 +216,55 @@ class ResqRiderAPIHandler implements RiderAPIHandlerInterface
         return $missing;
     }
 
+    protected function checkParamsAndKey(Request $req, $params)
+    {
+        $data = [];
+
+        // check for api_key in query string
+        $api_key = $req->query->get('api_key');
+        if (empty($api_key))
+        {
+            $data = [
+                'error' => 'Missing API key'
+            ];
+            return $data;
+        }
+
+        // check missing parameters
+        $missing = $this->checkMissingParameters($req, $params);
+        if (count($missing) > 0)
+        {
+            $miss_string = implode(', ', $missing);
+            $data = [
+                'error' => 'Missing parameter(s): ' . $miss_string
+            ];
+            return $data;
+        }
+
+        // check api key
+        $sess = $this->checkAPIKey($req->query->get('api_key'));
+        if ($sess == null)
+        {
+            $data = [
+                'error' => 'Invalid API Key'
+            ];
+            return $data;
+        }
+
+        // store session
+        $this->session = $sess;
+
+        return $data;
+    }
+
+    // TODO: type hint entity manager
+    protected function checkAPIKey($api_key)
+    {
+        // find the api key (session id)
+        $session = $this->em->getRepository(RiderSession::class)->find($api_key);
+        if ($session == null)
+            return null;
+
+        return $session;
+    }
 }