diff --git a/litrpc/proxy.pb.go b/litrpc/proxy.pb.go
index 9c8b71dd..26a9cf0a 100644
--- a/litrpc/proxy.pb.go
+++ b/litrpc/proxy.pb.go
@@ -20,6 +20,103 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+type BakeSuperMacaroonRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The root key ID suffix is the 4-byte suffix of the root key ID that will
+	// be used to create the macaroon.
+	RootKeyIdSuffix uint32 `protobuf:"varint,1,opt,name=root_key_id_suffix,json=rootKeyIdSuffix,proto3" json:"root_key_id_suffix,omitempty"`
+}
+
+func (x *BakeSuperMacaroonRequest) Reset() {
+	*x = BakeSuperMacaroonRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proxy_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BakeSuperMacaroonRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BakeSuperMacaroonRequest) ProtoMessage() {}
+
+func (x *BakeSuperMacaroonRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proxy_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BakeSuperMacaroonRequest.ProtoReflect.Descriptor instead.
+func (*BakeSuperMacaroonRequest) Descriptor() ([]byte, []int) {
+	return file_proxy_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *BakeSuperMacaroonRequest) GetRootKeyIdSuffix() uint32 {
+	if x != nil {
+		return x.RootKeyIdSuffix
+	}
+	return 0
+}
+
+type BakeSuperMacaroonResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The hex encoded macaroon.
+	Macaroon string `protobuf:"bytes,1,opt,name=macaroon,proto3" json:"macaroon,omitempty"`
+}
+
+func (x *BakeSuperMacaroonResponse) Reset() {
+	*x = BakeSuperMacaroonResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proxy_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BakeSuperMacaroonResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BakeSuperMacaroonResponse) ProtoMessage() {}
+
+func (x *BakeSuperMacaroonResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proxy_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BakeSuperMacaroonResponse.ProtoReflect.Descriptor instead.
+func (*BakeSuperMacaroonResponse) Descriptor() ([]byte, []int) {
+	return file_proxy_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *BakeSuperMacaroonResponse) GetMacaroon() string {
+	if x != nil {
+		return x.Macaroon
+	}
+	return ""
+}
+
 type StopDaemonRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -29,7 +126,7 @@ type StopDaemonRequest struct {
 func (x *StopDaemonRequest) Reset() {
 	*x = StopDaemonRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_proto_msgTypes[0]
+		mi := &file_proxy_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -42,7 +139,7 @@ func (x *StopDaemonRequest) String() string {
 func (*StopDaemonRequest) ProtoMessage() {}
 
 func (x *StopDaemonRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_proto_msgTypes[0]
+	mi := &file_proxy_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -55,7 +152,7 @@ func (x *StopDaemonRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopDaemonRequest.ProtoReflect.Descriptor instead.
 func (*StopDaemonRequest) Descriptor() ([]byte, []int) {
-	return file_proxy_proto_rawDescGZIP(), []int{0}
+	return file_proxy_proto_rawDescGZIP(), []int{2}
 }
 
 type StopDaemonResponse struct {
@@ -67,7 +164,7 @@ type StopDaemonResponse struct {
 func (x *StopDaemonResponse) Reset() {
 	*x = StopDaemonResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_proto_msgTypes[1]
+		mi := &file_proxy_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -80,7 +177,7 @@ func (x *StopDaemonResponse) String() string {
 func (*StopDaemonResponse) ProtoMessage() {}
 
 func (x *StopDaemonResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_proto_msgTypes[1]
+	mi := &file_proxy_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -93,7 +190,7 @@ func (x *StopDaemonResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopDaemonResponse.ProtoReflect.Descriptor instead.
 func (*StopDaemonResponse) Descriptor() ([]byte, []int) {
-	return file_proxy_proto_rawDescGZIP(), []int{1}
+	return file_proxy_proto_rawDescGZIP(), []int{3}
 }
 
 type GetInfoRequest struct {
@@ -105,7 +202,7 @@ type GetInfoRequest struct {
 func (x *GetInfoRequest) Reset() {
 	*x = GetInfoRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_proto_msgTypes[2]
+		mi := &file_proxy_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -118,7 +215,7 @@ func (x *GetInfoRequest) String() string {
 func (*GetInfoRequest) ProtoMessage() {}
 
 func (x *GetInfoRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_proto_msgTypes[2]
+	mi := &file_proxy_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -131,7 +228,7 @@ func (x *GetInfoRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetInfoRequest.ProtoReflect.Descriptor instead.
 func (*GetInfoRequest) Descriptor() ([]byte, []int) {
-	return file_proxy_proto_rawDescGZIP(), []int{2}
+	return file_proxy_proto_rawDescGZIP(), []int{4}
 }
 
 type GetInfoResponse struct {
@@ -146,7 +243,7 @@ type GetInfoResponse struct {
 func (x *GetInfoResponse) Reset() {
 	*x = GetInfoResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_proto_msgTypes[3]
+		mi := &file_proxy_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -159,7 +256,7 @@ func (x *GetInfoResponse) String() string {
 func (*GetInfoResponse) ProtoMessage() {}
 
 func (x *GetInfoResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_proto_msgTypes[3]
+	mi := &file_proxy_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -172,7 +269,7 @@ func (x *GetInfoResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetInfoResponse.ProtoReflect.Descriptor instead.
 func (*GetInfoResponse) Descriptor() ([]byte, []int) {
-	return file_proxy_proto_rawDescGZIP(), []int{3}
+	return file_proxy_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *GetInfoResponse) GetVersion() string {
@@ -186,26 +283,40 @@ var File_proxy_proto protoreflect.FileDescriptor
 
 var file_proxy_proto_rawDesc = []byte{
 	0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x06, 0x6c,
-	0x69, 0x74, 0x72, 0x70, 0x63, 0x22, 0x13, 0x0a, 0x11, 0x53, 0x74, 0x6f, 0x70, 0x44, 0x61, 0x65,
-	0x6d, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x14, 0x0a, 0x12, 0x53, 0x74,
-	0x6f, 0x70, 0x44, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x10, 0x0a, 0x0e, 0x47, 0x65, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x22, 0x2b, 0x0a, 0x0f, 0x47, 0x65, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x32,
-	0x88, 0x01, 0x0a, 0x05, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x12, 0x3a, 0x0a, 0x07, 0x47, 0x65, 0x74,
-	0x49, 0x6e, 0x66, 0x6f, 0x12, 0x16, 0x2e, 0x6c, 0x69, 0x74, 0x72, 0x70, 0x63, 0x2e, 0x47, 0x65,
-	0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x6c,
-	0x69, 0x74, 0x72, 0x70, 0x63, 0x2e, 0x47, 0x65, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x43, 0x0a, 0x0a, 0x53, 0x74, 0x6f, 0x70, 0x44, 0x61, 0x65,
-	0x6d, 0x6f, 0x6e, 0x12, 0x19, 0x2e, 0x6c, 0x69, 0x74, 0x72, 0x70, 0x63, 0x2e, 0x53, 0x74, 0x6f,
-	0x70, 0x44, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a,
-	0x2e, 0x6c, 0x69, 0x74, 0x72, 0x70, 0x63, 0x2e, 0x53, 0x74, 0x6f, 0x70, 0x44, 0x61, 0x65, 0x6d,
-	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x34, 0x5a, 0x32, 0x67, 0x69,
-	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6c, 0x69, 0x67, 0x68, 0x74, 0x6e, 0x69,
-	0x6e, 0x67, 0x6c, 0x61, 0x62, 0x73, 0x2f, 0x6c, 0x69, 0x67, 0x68, 0x74, 0x6e, 0x69, 0x6e, 0x67,
-	0x2d, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2f, 0x6c, 0x69, 0x74, 0x72, 0x70, 0x63,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x69, 0x74, 0x72, 0x70, 0x63, 0x22, 0x47, 0x0a, 0x18, 0x42, 0x61, 0x6b, 0x65, 0x53, 0x75, 0x70,
+	0x65, 0x72, 0x4d, 0x61, 0x63, 0x61, 0x72, 0x6f, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x2b, 0x0a, 0x12, 0x72, 0x6f, 0x6f, 0x74, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64,
+	0x5f, 0x73, 0x75, 0x66, 0x66, 0x69, 0x78, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0f, 0x72,
+	0x6f, 0x6f, 0x74, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x53, 0x75, 0x66, 0x66, 0x69, 0x78, 0x22, 0x37,
+	0x0a, 0x19, 0x42, 0x61, 0x6b, 0x65, 0x53, 0x75, 0x70, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x61, 0x72,
+	0x6f, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x6d,
+	0x61, 0x63, 0x61, 0x72, 0x6f, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6d,
+	0x61, 0x63, 0x61, 0x72, 0x6f, 0x6f, 0x6e, 0x22, 0x13, 0x0a, 0x11, 0x53, 0x74, 0x6f, 0x70, 0x44,
+	0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x14, 0x0a, 0x12,
+	0x53, 0x74, 0x6f, 0x70, 0x44, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x10, 0x0a, 0x0e, 0x47, 0x65, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x22, 0x2b, 0x0a, 0x0f, 0x47, 0x65, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x32, 0xe2, 0x01, 0x0a, 0x05, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x12, 0x3a, 0x0a, 0x07, 0x47,
+	0x65, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x16, 0x2e, 0x6c, 0x69, 0x74, 0x72, 0x70, 0x63, 0x2e,
+	0x47, 0x65, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17,
+	0x2e, 0x6c, 0x69, 0x74, 0x72, 0x70, 0x63, 0x2e, 0x47, 0x65, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x43, 0x0a, 0x0a, 0x53, 0x74, 0x6f, 0x70, 0x44,
+	0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x12, 0x19, 0x2e, 0x6c, 0x69, 0x74, 0x72, 0x70, 0x63, 0x2e, 0x53,
+	0x74, 0x6f, 0x70, 0x44, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x1a, 0x2e, 0x6c, 0x69, 0x74, 0x72, 0x70, 0x63, 0x2e, 0x53, 0x74, 0x6f, 0x70, 0x44, 0x61,
+	0x65, 0x6d, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x58, 0x0a, 0x11,
+	0x42, 0x61, 0x6b, 0x65, 0x53, 0x75, 0x70, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x61, 0x72, 0x6f, 0x6f,
+	0x6e, 0x12, 0x20, 0x2e, 0x6c, 0x69, 0x74, 0x72, 0x70, 0x63, 0x2e, 0x42, 0x61, 0x6b, 0x65, 0x53,
+	0x75, 0x70, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x61, 0x72, 0x6f, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x6c, 0x69, 0x74, 0x72, 0x70, 0x63, 0x2e, 0x42, 0x61, 0x6b,
+	0x65, 0x53, 0x75, 0x70, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x61, 0x72, 0x6f, 0x6f, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x34, 0x5a, 0x32, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6c, 0x69, 0x67, 0x68, 0x74, 0x6e, 0x69, 0x6e, 0x67, 0x6c, 0x61,
+	0x62, 0x73, 0x2f, 0x6c, 0x69, 0x67, 0x68, 0x74, 0x6e, 0x69, 0x6e, 0x67, 0x2d, 0x74, 0x65, 0x72,
+	0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2f, 0x6c, 0x69, 0x74, 0x72, 0x70, 0x63, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -220,20 +331,24 @@ func file_proxy_proto_rawDescGZIP() []byte {
 	return file_proxy_proto_rawDescData
 }
 
-var file_proxy_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_proxy_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
 var file_proxy_proto_goTypes = []interface{}{
-	(*StopDaemonRequest)(nil),  // 0: litrpc.StopDaemonRequest
-	(*StopDaemonResponse)(nil), // 1: litrpc.StopDaemonResponse
-	(*GetInfoRequest)(nil),     // 2: litrpc.GetInfoRequest
-	(*GetInfoResponse)(nil),    // 3: litrpc.GetInfoResponse
+	(*BakeSuperMacaroonRequest)(nil),  // 0: litrpc.BakeSuperMacaroonRequest
+	(*BakeSuperMacaroonResponse)(nil), // 1: litrpc.BakeSuperMacaroonResponse
+	(*StopDaemonRequest)(nil),         // 2: litrpc.StopDaemonRequest
+	(*StopDaemonResponse)(nil),        // 3: litrpc.StopDaemonResponse
+	(*GetInfoRequest)(nil),            // 4: litrpc.GetInfoRequest
+	(*GetInfoResponse)(nil),           // 5: litrpc.GetInfoResponse
 }
 var file_proxy_proto_depIdxs = []int32{
-	2, // 0: litrpc.Proxy.GetInfo:input_type -> litrpc.GetInfoRequest
-	0, // 1: litrpc.Proxy.StopDaemon:input_type -> litrpc.StopDaemonRequest
-	3, // 2: litrpc.Proxy.GetInfo:output_type -> litrpc.GetInfoResponse
-	1, // 3: litrpc.Proxy.StopDaemon:output_type -> litrpc.StopDaemonResponse
-	2, // [2:4] is the sub-list for method output_type
-	0, // [0:2] is the sub-list for method input_type
+	4, // 0: litrpc.Proxy.GetInfo:input_type -> litrpc.GetInfoRequest
+	2, // 1: litrpc.Proxy.StopDaemon:input_type -> litrpc.StopDaemonRequest
+	0, // 2: litrpc.Proxy.BakeSuperMacaroon:input_type -> litrpc.BakeSuperMacaroonRequest
+	5, // 3: litrpc.Proxy.GetInfo:output_type -> litrpc.GetInfoResponse
+	3, // 4: litrpc.Proxy.StopDaemon:output_type -> litrpc.StopDaemonResponse
+	1, // 5: litrpc.Proxy.BakeSuperMacaroon:output_type -> litrpc.BakeSuperMacaroonResponse
+	3, // [3:6] is the sub-list for method output_type
+	0, // [0:3] is the sub-list for method input_type
 	0, // [0:0] is the sub-list for extension type_name
 	0, // [0:0] is the sub-list for extension extendee
 	0, // [0:0] is the sub-list for field type_name
@@ -246,7 +361,7 @@ func file_proxy_proto_init() {
 	}
 	if !protoimpl.UnsafeEnabled {
 		file_proxy_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StopDaemonRequest); i {
+			switch v := v.(*BakeSuperMacaroonRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -258,7 +373,7 @@ func file_proxy_proto_init() {
 			}
 		}
 		file_proxy_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StopDaemonResponse); i {
+			switch v := v.(*BakeSuperMacaroonResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -270,7 +385,7 @@ func file_proxy_proto_init() {
 			}
 		}
 		file_proxy_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetInfoRequest); i {
+			switch v := v.(*StopDaemonRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -282,6 +397,30 @@ func file_proxy_proto_init() {
 			}
 		}
 		file_proxy_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StopDaemonResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_proxy_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetInfoRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_proxy_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*GetInfoResponse); i {
 			case 0:
 				return &v.state
@@ -300,7 +439,7 @@ func file_proxy_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_proxy_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   4,
+			NumMessages:   6,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/litrpc/proxy.pb.gw.go b/litrpc/proxy.pb.gw.go
index 881e8d8d..45e22b22 100644
--- a/litrpc/proxy.pb.gw.go
+++ b/litrpc/proxy.pb.gw.go
@@ -83,6 +83,40 @@ func local_request_Proxy_StopDaemon_0(ctx context.Context, marshaler runtime.Mar
 
 }
 
+func request_Proxy_BakeSuperMacaroon_0(ctx context.Context, marshaler runtime.Marshaler, client ProxyClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq BakeSuperMacaroonRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.BakeSuperMacaroon(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_Proxy_BakeSuperMacaroon_0(ctx context.Context, marshaler runtime.Marshaler, server ProxyServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq BakeSuperMacaroonRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.BakeSuperMacaroon(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
 // RegisterProxyHandlerServer registers the http handlers for service Proxy to "mux".
 // UnaryRPC     :call ProxyServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
@@ -135,6 +169,29 @@ func RegisterProxyHandlerServer(ctx context.Context, mux *runtime.ServeMux, serv
 
 	})
 
+	mux.Handle("POST", pattern_Proxy_BakeSuperMacaroon_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/litrpc.Proxy/BakeSuperMacaroon", runtime.WithHTTPPathPattern("/v1/proxy/supermacaroon"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_Proxy_BakeSuperMacaroon_0(rctx, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_Proxy_BakeSuperMacaroon_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
 	return nil
 }
 
@@ -216,6 +273,26 @@ func RegisterProxyHandlerClient(ctx context.Context, mux *runtime.ServeMux, clie
 
 	})
 
+	mux.Handle("POST", pattern_Proxy_BakeSuperMacaroon_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req, "/litrpc.Proxy/BakeSuperMacaroon", runtime.WithHTTPPathPattern("/v1/proxy/supermacaroon"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_Proxy_BakeSuperMacaroon_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_Proxy_BakeSuperMacaroon_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
 	return nil
 }
 
@@ -223,10 +300,14 @@ var (
 	pattern_Proxy_GetInfo_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "proxy", "info"}, ""))
 
 	pattern_Proxy_StopDaemon_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "proxy", "stop"}, ""))
+
+	pattern_Proxy_BakeSuperMacaroon_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "proxy", "supermacaroon"}, ""))
 )
 
 var (
 	forward_Proxy_GetInfo_0 = runtime.ForwardResponseMessage
 
 	forward_Proxy_StopDaemon_0 = runtime.ForwardResponseMessage
+
+	forward_Proxy_BakeSuperMacaroon_0 = runtime.ForwardResponseMessage
 )
diff --git a/litrpc/proxy.pb.json.go b/litrpc/proxy.pb.json.go
index 2d1d1281..3c9c2b74 100644
--- a/litrpc/proxy.pb.json.go
+++ b/litrpc/proxy.pb.json.go
@@ -70,4 +70,29 @@ func RegisterProxyJSONCallbacks(registry map[string]func(ctx context.Context,
 		}
 		callback(string(respBytes), nil)
 	}
+
+	registry["litrpc.Proxy.BakeSuperMacaroon"] = func(ctx context.Context,
+		conn *grpc.ClientConn, reqJSON string, callback func(string, error)) {
+
+		req := &BakeSuperMacaroonRequest{}
+		err := marshaler.Unmarshal([]byte(reqJSON), req)
+		if err != nil {
+			callback("", err)
+			return
+		}
+
+		client := NewProxyClient(conn)
+		resp, err := client.BakeSuperMacaroon(ctx, req)
+		if err != nil {
+			callback("", err)
+			return
+		}
+
+		respBytes, err := marshaler.Marshal(resp)
+		if err != nil {
+			callback("", err)
+			return
+		}
+		callback(string(respBytes), nil)
+	}
 }
diff --git a/litrpc/proxy.proto b/litrpc/proxy.proto
index a764b825..503989a6 100644
--- a/litrpc/proxy.proto
+++ b/litrpc/proxy.proto
@@ -15,6 +15,26 @@ service Proxy {
     triggering a graceful shutdown of the daemon.
     */
     rpc StopDaemon (StopDaemonRequest) returns (StopDaemonResponse);
+
+    /* litcli: `bakesupermacaroon`
+    BakeSuperMacaroon bakes a new macaroon that includes permissions for
+    all the active daemons that LiT is connected to.
+    */
+    rpc BakeSuperMacaroon (BakeSuperMacaroonRequest)
+        returns (BakeSuperMacaroonResponse);
+}
+
+message BakeSuperMacaroonRequest {
+    /*
+    The root key ID suffix is the 4-byte suffix of the root key ID that will
+    be used to create the macaroon.
+    */
+    uint32 root_key_id_suffix = 1;
+}
+
+message BakeSuperMacaroonResponse {
+    // The hex encoded macaroon.
+    string macaroon = 1;
 }
 
 message StopDaemonRequest {
diff --git a/litrpc/proxy.swagger.json b/litrpc/proxy.swagger.json
index e896663c..4952d933 100644
--- a/litrpc/proxy.swagger.json
+++ b/litrpc/proxy.swagger.json
@@ -71,9 +71,61 @@
           "Proxy"
         ]
       }
+    },
+    "/v1/proxy/supermacaroon": {
+      "post": {
+        "summary": "litcli: `bakesupermacaroon`\nBakeSuperMacaroon bakes a new macaroon that includes permissions for\nall the active daemons that LiT is connected to.",
+        "operationId": "Proxy_BakeSuperMacaroon",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/litrpcBakeSuperMacaroonResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/litrpcBakeSuperMacaroonRequest"
+            }
+          }
+        ],
+        "tags": [
+          "Proxy"
+        ]
+      }
     }
   },
   "definitions": {
+    "litrpcBakeSuperMacaroonRequest": {
+      "type": "object",
+      "properties": {
+        "root_key_id_suffix": {
+          "type": "integer",
+          "format": "int64",
+          "description": "The root key ID suffix is the 4-byte suffix of the root key ID that will\nbe used to create the macaroon."
+        }
+      }
+    },
+    "litrpcBakeSuperMacaroonResponse": {
+      "type": "object",
+      "properties": {
+        "macaroon": {
+          "type": "string",
+          "description": "The hex encoded macaroon."
+        }
+      }
+    },
     "litrpcGetInfoResponse": {
       "type": "object",
       "properties": {
diff --git a/litrpc/proxy.yaml b/litrpc/proxy.yaml
index 7df90370..8b5ac76d 100644
--- a/litrpc/proxy.yaml
+++ b/litrpc/proxy.yaml
@@ -10,3 +10,6 @@ http:
       body: "*"
     - selector: litrpc.Proxy.GetInfo
       get: "/v1/proxy/info"
+    - selector: litrpc.Proxy.BakeSuperMacaroon
+      post: "/v1/proxy/supermacaroon"
+      body: "*"
diff --git a/litrpc/proxy_grpc.pb.go b/litrpc/proxy_grpc.pb.go
index 401a0525..ae77be1b 100644
--- a/litrpc/proxy_grpc.pb.go
+++ b/litrpc/proxy_grpc.pb.go
@@ -25,6 +25,10 @@ type ProxyClient interface {
 	// StopDaemon will send a shutdown request to the interrupt handler,
 	// triggering a graceful shutdown of the daemon.
 	StopDaemon(ctx context.Context, in *StopDaemonRequest, opts ...grpc.CallOption) (*StopDaemonResponse, error)
+	// litcli: `bakesupermacaroon`
+	// BakeSuperMacaroon bakes a new macaroon that includes permissions for
+	// all the active daemons that LiT is connected to.
+	BakeSuperMacaroon(ctx context.Context, in *BakeSuperMacaroonRequest, opts ...grpc.CallOption) (*BakeSuperMacaroonResponse, error)
 }
 
 type proxyClient struct {
@@ -53,6 +57,15 @@ func (c *proxyClient) StopDaemon(ctx context.Context, in *StopDaemonRequest, opt
 	return out, nil
 }
 
+func (c *proxyClient) BakeSuperMacaroon(ctx context.Context, in *BakeSuperMacaroonRequest, opts ...grpc.CallOption) (*BakeSuperMacaroonResponse, error) {
+	out := new(BakeSuperMacaroonResponse)
+	err := c.cc.Invoke(ctx, "/litrpc.Proxy/BakeSuperMacaroon", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // ProxyServer is the server API for Proxy service.
 // All implementations must embed UnimplementedProxyServer
 // for forward compatibility
@@ -64,6 +77,10 @@ type ProxyServer interface {
 	// StopDaemon will send a shutdown request to the interrupt handler,
 	// triggering a graceful shutdown of the daemon.
 	StopDaemon(context.Context, *StopDaemonRequest) (*StopDaemonResponse, error)
+	// litcli: `bakesupermacaroon`
+	// BakeSuperMacaroon bakes a new macaroon that includes permissions for
+	// all the active daemons that LiT is connected to.
+	BakeSuperMacaroon(context.Context, *BakeSuperMacaroonRequest) (*BakeSuperMacaroonResponse, error)
 	mustEmbedUnimplementedProxyServer()
 }
 
@@ -77,6 +94,9 @@ func (UnimplementedProxyServer) GetInfo(context.Context, *GetInfoRequest) (*GetI
 func (UnimplementedProxyServer) StopDaemon(context.Context, *StopDaemonRequest) (*StopDaemonResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method StopDaemon not implemented")
 }
+func (UnimplementedProxyServer) BakeSuperMacaroon(context.Context, *BakeSuperMacaroonRequest) (*BakeSuperMacaroonResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method BakeSuperMacaroon not implemented")
+}
 func (UnimplementedProxyServer) mustEmbedUnimplementedProxyServer() {}
 
 // UnsafeProxyServer may be embedded to opt out of forward compatibility for this service.
@@ -126,6 +146,24 @@ func _Proxy_StopDaemon_Handler(srv interface{}, ctx context.Context, dec func(in
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Proxy_BakeSuperMacaroon_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(BakeSuperMacaroonRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ProxyServer).BakeSuperMacaroon(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/litrpc.Proxy/BakeSuperMacaroon",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ProxyServer).BakeSuperMacaroon(ctx, req.(*BakeSuperMacaroonRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // Proxy_ServiceDesc is the grpc.ServiceDesc for Proxy service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -141,6 +179,10 @@ var Proxy_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "StopDaemon",
 			Handler:    _Proxy_StopDaemon_Handler,
 		},
+		{
+			MethodName: "BakeSuperMacaroon",
+			Handler:    _Proxy_BakeSuperMacaroon_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "proxy.proto",