diff --git a/src/App.ts b/src/App.ts
index 54fc2c2..4b05f30 100644
--- a/src/App.ts
+++ b/src/App.ts
@@ -101,8 +101,6 @@ export default class App extends Application {
         // Session
         this.use(redisComponent);
         this.use(new SessionComponent(redisComponent));
-
-        // Auth
         this.use(new AuthComponent(new class extends AuthGuard<MagicLink | AuthToken> {
             public async getProofForSession(session: Express.Session): Promise<any | null> {
                 return await MagicLink.bySessionID(session.id, [MagicLinkActionType.LOGIN, MagicLinkActionType.REGISTER]);
diff --git a/src/controllers/AuthTokenController.ts b/src/controllers/AuthTokenController.ts
index 625d027..297b3bb 100644
--- a/src/controllers/AuthTokenController.ts
+++ b/src/controllers/AuthTokenController.ts
@@ -11,7 +11,7 @@ export default class AuthTokenController extends Controller {
     }
 
     protected async postGenAuthToken(req: Request, res: Response): Promise<void> {
-        const authToken = new AuthToken({
+        const authToken = AuthToken.create({
             user_id: req.models.user!.id,
             ttl: req.body.ttl ? parseInt(req.body.ttl) : 365 * 24 * 3600,
         });
diff --git a/src/controllers/URLRedirectController.ts b/src/controllers/URLRedirectController.ts
index 1b37f81..5586248 100644
--- a/src/controllers/URLRedirectController.ts
+++ b/src/controllers/URLRedirectController.ts
@@ -42,7 +42,7 @@ export default class URLRedirectController extends Controller {
         if (req.body.type !== 'url') return next();
 
         slug = slug || req.params.slug || req.body.slug || await generateSlug(10);
-        const urlRedirect = new URLRedirect({
+        const urlRedirect = URLRedirect.create({
             user_id: req.models.user!.id,
             slug: slug,
             target_url: req.body.target_url,
diff --git a/src/models/AuthToken.ts b/src/models/AuthToken.ts
index 4563470..97f010b 100644
--- a/src/models/AuthToken.ts
+++ b/src/models/AuthToken.ts
@@ -11,20 +11,19 @@ export default class AuthToken extends Model implements AuthProof<User> {
     protected used_at?: Date = undefined;
     protected readonly ttl?: number = undefined;
 
-    constructor(props: any) {
-        super(props);
-
-        if (!this.secret) {
-            this.secret = cryptoRandomDictionary(64, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_');
-        }
-    }
-
     protected init() {
         this.setValidation('user_id').defined().exists(User, 'id');
         this.setValidation('secret').defined().between(32, 64);
         this.setValidation('ttl').defined().min(1).max(5 * 365 * 24 * 3600 /* 5 years */);
     }
 
+    protected async autoFill(): Promise<void> {
+        await super.autoFill();
+
+        // @ts-ignore
+        if (!this.secret) this['secret'] = cryptoRandomDictionary(64, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_');
+    }
+
     public use() {
         this.used_at = new Date();
     }
diff --git a/src/models/URLRedirect.ts b/src/models/URLRedirect.ts
index 00e68f4..2b754ed 100644
--- a/src/models/URLRedirect.ts
+++ b/src/models/URLRedirect.ts
@@ -24,10 +24,6 @@ export default class URLRedirect extends Model {
     public readonly target_url?: string = undefined;
     public created_at?: Date = undefined;
 
-    constructor(data: any) {
-        super(data);
-    }
-
     protected init(): void {
         this.setValidation('user_id').defined().exists(User, 'id');
         this.setValidation('slug').defined().minLength(1).maxLength(259).unique(URLRedirect, 'slug').unique(FileModel, 'slug');