diff --git a/src/routes/(angemeldet)/upload/+page.svelte b/src/routes/(angemeldet)/upload/+page.svelte
index 360a95e..5e2ee31 100644
--- a/src/routes/(angemeldet)/upload/+page.svelte
+++ b/src/routes/(angemeldet)/upload/+page.svelte
@@ -16,9 +16,17 @@
 	let inProgress = false;
 	let vorgang = '';
 	const code_len = 8;
-	let zugangscode = Math.random()
+
+	function generate_token() {
+		return Math.random()
 		.toString(36)
 		.slice(2, 2 + code_len);
+	}
+	let zugangscode = ''
+	let zugangscode_old = ''
+	$: zugangscode_old = generate_token();
+	$: zugangscode = zugangscode_old
+
 	let case_existing = undefined;
 	$: case_existing = false;
 
@@ -152,23 +160,51 @@
 
 	// return true or false
 	async function case_exists(case_no) {
-		console.log('--- fired');
 		// ping `/(angemeldet)/view` with caseNumber in POST body
 		let url = '/view';
 		let data = new FormData();
 		data.append('caseNumber', case_no);
+
+		// fetch code in parallel
+		const code = get_code(case_no);
+
 		const response = await fetch(url, { method: 'POST', body: data });
 
-		const code = response.status;
+		const res_json = await response.json();
+		const status = res_json.status;
 
-		console.log(`+++ ${response.redirected}`);
+		// aktualisiere Zugangscode mit
+		if (status == 303) {
+			case_existing = true;
+
+			const res = await code;
+
+
+			if (res != -1) {
+				// Code vorhanden
+				zugangscode = res;
+			}
 
-		if (code == 303) {
 			return true;
 		}
 
+		case_existing = false;
+		zugangscode = zugangscode_old;
+
 		return false;
 	}
+
+	async function get_code(case_no) {
+		let url = `/api/list/${case_no}/code`
+		const response = await fetch(url);
+
+		if (response.status == 200) {
+			return response.text();
+		} else {
+			return -1
+		}
+	}
+
 </script>
 
 <div class="mx-auto max-w-2xl">
@@ -219,8 +255,8 @@
 
 					<div>
 						<label for="name" class="block text-sm font-medium leading-6 text-gray-900"
-							><span class="flex"
-								>{#if formErrors?.name}
+						><span class="flex"
+							>{#if formErrors?.name}
 									<span class="inline-block mr-1"><Exclamation /></span>
 								{/if} Name</span
 							></label
@@ -261,9 +297,18 @@
 									type="text"
 									name="zugangscode"
 									id="zugangscode"
+									on:input="{ (ev) => { zugangscode_old = ev.target.value }}"
 									class="block flex-1 border-0 bg-transparent py-1.5 pl-1 text-gray-900 placeholder:text-gray-400 focus:ring-0 sm:text-sm sm:leading-6"
 								/>
+
 							</div>
+							<button
+							class="rounded-md bg-blue-500 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-indigo-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-indigo-600"
+							on:click="{() => {
+							zugangscode = generate_token(); }}"
+							type="button">
+								Generiere Zugangscode
+							</button>
 						</div>
 						{#if formErrors?.code}
 							<p class="block text-sm leading-6 text-red-900 mt-2">{formErrors.code}</p>
diff --git a/src/routes/api/list/[[vorgang]]/code/+server.js b/src/routes/api/list/[[vorgang]]/code/+server.js
new file mode 100644
index 0000000..3b3745d
--- /dev/null
+++ b/src/routes/api/list/[[vorgang]]/code/+server.js
@@ -0,0 +1,28 @@
+import { json } from '@sveltejs/kit';
+import { client } from '$lib/minio';
+import { Readable } from 'stream';
+import { Buffer } from 'buffer';
+
+/** @type {import('./$types').RequestHandler} */
+export async function GET({ params }) {
+	const prefix = params.vorgang ? `${params.vorgang}` : '';
+
+	const code_name = '__perm__';
+	const obj_path = `${prefix}/${code_name}`;
+
+	let result = null;
+
+	try {
+		result = await client.getObject('tatort', obj_path);
+	} catch (error) {
+		if (error.name == 'S3Error') {
+			result = null;
+		}
+	}
+
+	if (result != null) {
+		return new Response(result, { status: 200 });
+	} else {
+		return new Response(null, { status: 404 });
+	}
+}