diff --git a/gui/backend.go b/gui/backend.go
index faf682a40922d4285f7c3fc4f1be32218d86233d..875706d290f19ca97dffd8a517528ff33d56d695 100644
--- a/gui/backend.go
+++ b/gui/backend.go
@@ -66,6 +66,11 @@ func InitializeTestBitmaskContext() {
 	backend.EnableMockBackend()
 }
 
+//export EnableWebAPI
+func EnableWebAPI() {
+	backend.EnableWebAPI()
+}
+
 //export RefreshContext
 func RefreshContext() *C.char {
 	return (*C.char)(backend.RefreshContext())
diff --git a/gui/main.cpp b/gui/main.cpp
index 8033dba11b7778b897b52726605efc09505d17d2..6d01d49aa3ef10bf9cc72a1b044afb634e264955 100644
--- a/gui/main.cpp
+++ b/gui/main.cpp
@@ -65,6 +65,12 @@ int main(int argc, char **argv) {
                                     "together with gnome shell "
                                     "extension, or to control VPN by other means)."),
         },
+        {
+            {"w", "web-api"},
+            QApplication::translate(
+                "main",
+                "Enable web api (on port 8080)."),
+        },
         {
             {"i", "install-helpers"},
             QApplication::translate(
@@ -76,6 +82,7 @@ int main(int argc, char **argv) {
 
     bool hideSystray    = parser.isSet("no-systray");
     bool installHelpers = parser.isSet("install-helpers");
+    bool webAPI         = parser.isSet("web-api");
 
     if (hideSystray) {
         qDebug() << "Not showing systray icon because --no-systray option is set.";
@@ -132,6 +139,9 @@ int main(int argc, char **argv) {
     /* let the Go side initialize its internal state */
     InitializeBitmaskContext();
 
+    /* if requested, enable web api for controlling the VPN */
+    if (webAPI) { EnableWebAPI(); };
+
     /* kick off your shoes, put your feet up */
     return app.exec();
 }
diff --git a/pkg/backend/api.go b/pkg/backend/api.go
index 64dac9d6abd45223ebae4a6d7edc7f371959ce44..f63962cdb454e7bcece71dba87073590bfbe71f4 100644
--- a/pkg/backend/api.go
+++ b/pkg/backend/api.go
@@ -76,6 +76,10 @@ func EnableMockBackend() {
 	go enableMockBackend()
 }
 
+func EnableWebAPI() {
+	go enableWebAPI()
+}
+
 /* these two are a bit redundant since we already add them to ctx. however, we
    want to have them available before everything else, to be able to parse cli
    arguments. In the long run, we probably want to move all vendoring to qt, so
diff --git a/pkg/backend/webapi.go b/pkg/backend/webapi.go
new file mode 100644
index 0000000000000000000000000000000000000000..e3918c50f6e625e7a62a9434a8fb6eeecb6b3fc0
--- /dev/null
+++ b/pkg/backend/webapi.go
@@ -0,0 +1,35 @@
+package backend
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+)
+
+func webOn(w http.ResponseWriter, r *http.Request) {
+	log.Println("Web UI: on")
+	SwitchOn()
+}
+
+func webOff(w http.ResponseWriter, r *http.Request) {
+	log.Println("Web UI: off")
+	SwitchOff()
+}
+
+func webStatus(w http.ResponseWriter, r *http.Request) {
+	log.Println("Web UI: status")
+	fmt.Fprintf(w, ctx.Status.String())
+}
+
+func webQuit(w http.ResponseWriter, r *http.Request) {
+	log.Println("Web UI: quit")
+	Quit()
+}
+
+func enableWebAPI() {
+	http.HandleFunc("/vpn/start", webOn)
+	http.HandleFunc("/vpn/stop", webOff)
+	http.HandleFunc("/vpn/status", webStatus)
+	http.HandleFunc("/vpn/quit", webQuit)
+	http.ListenAndServe(":8080", nil)
+}