diff --git a/src/api.js b/src/api.js
new file mode 100644
index 0000000..5736643
--- /dev/null
+++ b/src/api.js
@@ -0,0 +1,37 @@
+// Thin client for the OTIVM save API
+// Backend: GET /api/save/:token  — load state
+//          POST /api/save/:token — write state
+
+const BASE = '/api/save'
+
+// Generate a random 8-character hex token
+export function generateToken() {
+  return Array.from(crypto.getRandomValues(new Uint8Array(4)))
+    .map((b) => b.toString(16).padStart(2, '0'))
+    .join('')
+}
+
+// Load state from server — returns parsed state object or null
+export async function loadState(token) {
+  try {
+    const res = await fetch(`${BASE}/${token}`)
+    if (!res.ok) return null
+    return await res.json()
+  } catch {
+    return null
+  }
+}
+
+// Save state to server — returns true on success
+export async function saveState(token, state) {
+  try {
+    const res = await fetch(`${BASE}/${token}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(state),
+    })
+    return res.ok
+  } catch {
+    return false
+  }
+}