diff --git a/src/fastapi_oidc_op/store/sqlite/migrations/001_initial.sql b/src/fastapi_oidc_op/store/sqlite/migrations/001_initial.sql
new file mode 100644
index 0000000..7b2012e
--- /dev/null
+++ b/src/fastapi_oidc_op/store/sqlite/migrations/001_initial.sql
@@ -0,0 +1,48 @@
+CREATE TABLE users (
+    userid TEXT PRIMARY KEY,
+    username TEXT NOT NULL UNIQUE,
+    preferred_username TEXT,
+    given_name TEXT,
+    family_name TEXT,
+    nickname TEXT,
+    email TEXT,
+    email_verified INTEGER NOT NULL DEFAULT 0,
+    phone_number TEXT,
+    phone_number_verified INTEGER NOT NULL DEFAULT 0,
+    picture TEXT,
+    locale TEXT,
+    active INTEGER NOT NULL DEFAULT 1,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+);
+
+CREATE TABLE user_groups (
+    userid TEXT NOT NULL REFERENCES users(userid) ON DELETE CASCADE,
+    group_name TEXT NOT NULL,
+    PRIMARY KEY (userid, group_name)
+);
+
+CREATE TABLE webauthn_credentials (
+    user_id TEXT NOT NULL REFERENCES users(userid) ON DELETE CASCADE,
+    credential_id BLOB NOT NULL,
+    public_key BLOB NOT NULL,
+    sign_count INTEGER NOT NULL DEFAULT 0,
+    device_name TEXT NOT NULL DEFAULT '',
+    created_at TEXT NOT NULL,
+    PRIMARY KEY (user_id, credential_id)
+);
+
+CREATE TABLE password_credentials (
+    user_id TEXT PRIMARY KEY REFERENCES users(userid) ON DELETE CASCADE,
+    password_hash TEXT NOT NULL,
+    created_at TEXT NOT NULL
+);
+
+CREATE TABLE magic_links (
+    token TEXT PRIMARY KEY,
+    username TEXT NOT NULL,
+    expires_at TEXT NOT NULL,
+    used INTEGER NOT NULL DEFAULT 0,
+    created_by TEXT,
+    note TEXT
+);