diff --git a/.gitignore b/.gitignore
index ceb2a149..f780080b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,6 +14,7 @@
 *.out
 vendor
 db.db
+db_plugin.db
 shared-local-instance.db
 debug
 *__debug_bin
diff --git a/cmd/config-boltdb.yaml b/cmd/config-boltdb.yaml
index 938d154a..9aeb9b3c 100644
--- a/cmd/config-boltdb.yaml
+++ b/cmd/config-boltdb.yaml
@@ -11,7 +11,12 @@ storage:
     type: boltdb
     boltdb:
       path: ./db.db
-  userStorage: *storage_settings
+  userStorage:
+    type: plugin
+    plugin:
+      cmd: ./plugins/bin/bolt-user-storage
+      params: { "path": "./db_plugin.db" }
+      redirectStd: true
   tokenStorage: *storage_settings
   tokenBlacklist: *storage_settings
   verificationCodeStorage: *storage_settings
diff --git a/go.mod b/go.mod
index e6bceb6d..52c45a6a 100644
--- a/go.mod
+++ b/go.mod
@@ -16,6 +16,7 @@ require (
 	github.com/google/uuid v1.3.0
 	github.com/gorilla/mux v1.8.0
 	github.com/gorilla/sessions v1.2.1
+	github.com/hashicorp/go-hclog v0.14.1
 	github.com/hashicorp/go-plugin v1.4.5
 	github.com/hummerd/httpdump v0.9.1
 	github.com/joho/godotenv v1.4.0
@@ -70,7 +71,6 @@ require (
 	github.com/golang/snappy v0.0.1 // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/gorilla/securecookie v1.1.1 // indirect
-	github.com/hashicorp/go-hclog v0.14.1 // indirect
 	github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/klauspost/compress v1.13.6 // indirect
diff --git a/impersonation/plugin/provider.go b/impersonation/plugin/provider.go
index d9633da5..006f9aaa 100644
--- a/impersonation/plugin/provider.go
+++ b/impersonation/plugin/provider.go
@@ -5,6 +5,7 @@ import (
 	"os/exec"
 	"time"
 
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-plugin"
 	grpcShared "github.com/madappgang/identifo/v2/impersonation/grpc/shared"
 	"github.com/madappgang/identifo/v2/impersonation/plugin/shared"
@@ -12,7 +13,6 @@ import (
 )
 
 func NewImpersonationProvider(settings model.PluginSettings, timeout time.Duration) (model.ImpersonationProvider, error) {
-	var err error
 	params := []string{}
 	for k, v := range settings.Params {
 		params = append(params, "-"+k)
@@ -24,6 +24,10 @@ func NewImpersonationProvider(settings model.PluginSettings, timeout time.Durati
 		Plugins:          shared.PluginMap,
 		Cmd:              exec.Command(settings.Cmd, params...),
 		AllowedProtocols: []plugin.Protocol{plugin.ProtocolGRPC},
+		Logger: hclog.New(&hclog.LoggerOptions{
+			Level:      hclog.Debug,
+			JSONFormat: true,
+		}),
 	}
 
 	if settings.RedirectStd {
diff --git a/plugins/bolt-user-storage/main.go b/plugins/bolt-user-storage/main.go
index eff49faa..f2ac1adb 100644
--- a/plugins/bolt-user-storage/main.go
+++ b/plugins/bolt-user-storage/main.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"flag"
+	"log/slog"
 	"os"
 	"os/signal"
 	"syscall"
@@ -13,7 +14,20 @@ import (
 	"github.com/madappgang/identifo/v2/storage/plugin/shared"
 )
 
+type wproxy struct {
+}
+
+func (w wproxy) Write(p []byte) (n int, err error) {
+	return os.Stderr.Write(p)
+}
+
 func main() {
+	slog.SetDefault(slog.New(slog.NewJSONHandler(
+		wproxy{},
+		&slog.HandlerOptions{
+			Level: slog.LevelDebug,
+		})))
+
 	path := flag.String("path", "", "path to database")
 	flag.Parse()
 
@@ -34,7 +48,6 @@ func main() {
 		Plugins: map[string]plugin.Plugin{
 			"user-storage": &shared.UserStoragePlugin{Impl: s},
 		},
-
 		// A non-nil value here enables gRPC serving for this plugin...
 		GRPCServer: plugin.DefaultGRPCServer,
 	})
diff --git a/storage/plugin/user.go b/storage/plugin/user.go
index 33eab9a3..cb8a2549 100644
--- a/storage/plugin/user.go
+++ b/storage/plugin/user.go
@@ -4,6 +4,7 @@ import (
 	"os"
 	"os/exec"
 
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-plugin"
 	"github.com/madappgang/identifo/v2/model"
 	grpcShared "github.com/madappgang/identifo/v2/storage/grpc/shared"
@@ -12,7 +13,6 @@ import (
 
 // NewUserStorage creates and inits plugin user storage.
 func NewUserStorage(settings model.PluginSettings) (model.UserStorage, error) {
-	var err error
 	params := []string{}
 	for k, v := range settings.Params {
 		params = append(params, "-"+k)
@@ -24,6 +24,10 @@ func NewUserStorage(settings model.PluginSettings) (model.UserStorage, error) {
 		Plugins:          shared.PluginMap,
 		Cmd:              exec.Command(settings.Cmd, params...),
 		AllowedProtocols: []plugin.Protocol{plugin.ProtocolGRPC},
+		Logger: hclog.New(&hclog.LoggerOptions{
+			Level:      hclog.Debug,
+			JSONFormat: true,
+		}),
 	}
 
 	if settings.RedirectStd {
diff --git a/user_payload_provider/plugin/provider.go b/user_payload_provider/plugin/provider.go
index 29ac4d59..7591a9d4 100644
--- a/user_payload_provider/plugin/provider.go
+++ b/user_payload_provider/plugin/provider.go
@@ -5,6 +5,7 @@ import (
 	"os/exec"
 	"time"
 
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-plugin"
 	"github.com/madappgang/identifo/v2/model"
 	grpcShared "github.com/madappgang/identifo/v2/user_payload_provider/grpc/shared"
@@ -13,7 +14,6 @@ import (
 
 // NewTokenPayloadProvider creates and inits plugin for payload provider.
 func NewTokenPayloadProvider(settings model.PluginSettings, timeout time.Duration) (model.TokenPayloadProvider, error) {
-	var err error
 	params := []string{}
 	for k, v := range settings.Params {
 		params = append(params, "-"+k)
@@ -21,11 +21,14 @@ func NewTokenPayloadProvider(settings model.PluginSettings, timeout time.Duratio
 	}
 
 	cfg := &plugin.ClientConfig{
-		SyncStdout:       os.Stdout,
 		HandshakeConfig:  shared.Handshake,
 		Plugins:          shared.PluginMap,
 		Cmd:              exec.Command(settings.Cmd, params...),
 		AllowedProtocols: []plugin.Protocol{plugin.ProtocolGRPC},
+		Logger: hclog.New(&hclog.LoggerOptions{
+			Level:      hclog.Debug,
+			JSONFormat: true,
+		}),
 	}
 
 	if settings.RedirectStd {
diff --git a/web/api/hello.go b/web/api/hello.go
index 7181afac..cac77800 100644
--- a/web/api/hello.go
+++ b/web/api/hello.go
@@ -34,8 +34,6 @@ func (ar *Router) HandlePing(w http.ResponseWriter, r *http.Request) {
 
 	locale := r.Header.Get("Accept-Language")
 
-	ar.logger.Debug("trace pong handler")
-
 	pong := pongResponse{
 		Message: "Pong!",
 		Date:    time.Now(),
diff --git a/web/api/routes.go b/web/api/routes.go
index bbb36b11..3258cf4c 100644
--- a/web/api/routes.go
+++ b/web/api/routes.go
@@ -19,6 +19,12 @@ func (ar *Router) initRoutes(
 		panic("Empty API router")
 	}
 
+	pingHandler := negroni.New(
+		negroni.NewRecovery(),
+		negroni.WrapFunc(ar.HandlePing),
+	)
+	ar.router.Handle("/ping", pingHandler).Methods(http.MethodGet)
+
 	baseMiddleware := buildBaseMiddleware(
 		loggerSettings.DumpRequest,
 		loggerSettings.Format,
@@ -26,10 +32,6 @@ func (ar *Router) initRoutes(
 		loggerSettings.LogSensitiveData,
 		ar.cors,
 	)
-
-	ph := with(baseMiddleware, negroni.WrapFunc(ar.HandlePing))
-	ar.router.Handle("/ping", ph).Methods(http.MethodGet)
-
 	apiMiddlewares := ar.buildAPIMiddleware(baseMiddleware)
 
 	// federated oidc
diff --git a/web/api/routes_test.go b/web/api/routes_test.go
new file mode 100644
index 00000000..d2b641b7
--- /dev/null
+++ b/web/api/routes_test.go
@@ -0,0 +1,44 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/madappgang/identifo/v2/model"
+	"github.com/rs/cors"
+	"github.com/urfave/negroni"
+)
+
+func TestNN(t *testing.T) {
+	apiCorsSettings := model.DefaultCors
+	apiCors := cors.New(apiCorsSettings)
+
+	bm := buildBaseMiddleware(false, "json", model.LoggerParams{
+		HTTPDetailing: model.HTTPLogDump,
+		Level:         "debug",
+	}, true, apiCors)
+	h := with(bm, negroni.WrapFunc(func(w http.ResponseWriter, r *http.Request) {
+
+	}))
+
+	handlers := []negroni.Handler{negroni.HandlerFunc(func(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+		next(w, r)
+	})}
+	handlers = append(handlers, negroni.HandlerFunc(func(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+		next(w, r)
+	}))
+	apim := with(bm, handlers...)
+
+	req := httptest.NewRequest(http.MethodGet, "/ping", nil)
+	rw := httptest.NewRecorder()
+
+	h.ServeHTTP(rw, req)
+
+	req = httptest.NewRequest(http.MethodGet, "/some", nil)
+	rw = httptest.NewRecorder()
+
+	apim.ServeHTTP(rw, req)
+
+	t.Fail()
+}