diff --git a/conf/yunohost/yunohost-portal-api.service b/conf/yunohost/yunohost-portal-api.service
new file mode 100644
index 000000000..0ba6e8b3d
--- /dev/null
+++ b/conf/yunohost/yunohost-portal-api.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=YunoHost Portal API
+After=network.target
+
+[Service]
+User=ynh-portal
+Type=simple
+ExecStart=/usr/bin/yunohost-portal-api
+Restart=always
+RestartSec=5
+TimeoutStopSec=30
+
+[Install]
+WantedBy=multi-user.target
diff --git a/debian/postinst b/debian/postinst
index e93845e88..c62926a30 100644
--- a/debian/postinst
+++ b/debian/postinst
@@ -29,6 +29,8 @@ do_configure() {
         yunohost diagnosis run --force
     fi
 
+    systemctl restart yunohost-portal-api
+
     # Trick to let yunohost handle the restart of the API,
     # to prevent the webadmin from cutting the branch it's sitting on
     if systemctl is-enabled yunohost-api --quiet
diff --git a/hooks/conf_regen/01-yunohost b/hooks/conf_regen/01-yunohost
index 14840e2f1..597595231 100755
--- a/hooks/conf_regen/01-yunohost
+++ b/hooks/conf_regen/01-yunohost
@@ -56,7 +56,10 @@ do_init_regen() {
     chown root:root /var/cache/yunohost
     chmod 700 /var/cache/yunohost
 
+    getent passwd ynh-portal &>/dev/null || useradd --no-create-home --shell /usr/sbin/nologin --system --user-group ynh-portal
+
     cp yunohost-api.service /etc/systemd/system/yunohost-api.service
+    cp yunohost-portal-api.service /etc/systemd/system/yunohost-portal-api.service
     cp yunohost-firewall.service /etc/systemd/system/yunohost-firewall.service
     cp yunoprompt.service /etc/systemd/system/yunoprompt.service
 
@@ -64,6 +67,10 @@ do_init_regen() {
 
     systemctl enable yunohost-api.service
     systemctl start yunohost-api.service
+
+    systemctl enable yunohost-portal-api.service
+    systemctl start yunohost-portal-api.service
+
     # Yunohost-firewall is enabled only during postinstall, not init, not 100% sure why
 
     cp dpkg-origins /etc/dpkg/origins/yunohost
@@ -152,6 +159,7 @@ HandleLidSwitchExternalPower=ignore
 EOF
 
     cp yunohost-api.service ${pending_dir}/etc/systemd/system/yunohost-api.service
+    cp yunohost-portal-api.service ${pending_dir}/etc/systemd/system/yunohost-portal-api.service
     cp yunohost-firewall.service ${pending_dir}/etc/systemd/system/yunohost-firewall.service
     cp yunoprompt.service ${pending_dir}/etc/systemd/system/yunoprompt.service
 
@@ -169,6 +177,13 @@ EOF
 do_post_regen() {
     regen_conf_files=$1
 
+    getent passwd ynh-portal &>/dev/null || useradd --no-create-home --shell /usr/sbin/nologin --system --user-group ynh-portal
+    if [ ! -e /etc/yunohost/.ssowat_cookie_secret ]; then
+        dd if=/dev/urandom bs=1 count=1000 2>/dev/null | tr --complement --delete 'A-Za-z0-9' | head -c 64 > /etc/yunohost/.ssowat_cookie_secret
+    fi
+    chown ynh-portal:root /etc/yunohost/.ssowat_cookie_secret
+    chmod 400 /etc/yunohost/.ssowat_cookie_secret
+
     ######################
     # Enfore permissions #
     ######################
@@ -225,10 +240,12 @@ do_post_regen() {
         systemctl daemon-reload
         systemctl restart ntp
     }
+
     [[ ! "$regen_conf_files" =~ "nftables.service.d/ynh-override.conf" ]] || systemctl daemon-reload
     [[ ! "$regen_conf_files" =~ "login.conf.d/ynh-override.conf" ]] || systemctl daemon-reload
     [[ ! "$regen_conf_files" =~ "yunohost-firewall.service" ]] || systemctl daemon-reload
     [[ ! "$regen_conf_files" =~ "yunohost-api.service" ]] || systemctl daemon-reload
+    [[ ! "$regen_conf_files" =~ "yunohost-portal-api.service" ]] || systemctl daemon-reload
 
     if [[ "$regen_conf_files" =~ "yunoprompt.service" ]]; then
         systemctl daemon-reload
@@ -241,6 +258,9 @@ do_post_regen() {
         systemctl $action proc-hidepid --quiet --now
     fi
 
+    systemctl enable yunohost-portal-api.service --quiet
+    systemctl is-active yunohost-portal-api --quiet || systemctl start yunohost-portal-api.service
+
     # Change dpkg vendor
     # see https://wiki.debian.org/Derivatives/Guidelines#Vendor
     if readlink -f /etc/dpkg/origins/default | grep -q debian;