diff --git a/src/exchange/Makefile.am b/src/exchange/Makefile.am
index 3009c84c2..c20378c22 100644
--- a/src/exchange/Makefile.am
+++ b/src/exchange/Makefile.am
@@ -82,6 +82,7 @@ taler_exchange_httpd_SOURCES = \
   taler-exchange-httpd_db.c taler-exchange-httpd_db.h \
   taler-exchange-httpd_deposit.c taler-exchange-httpd_deposit.h \
   taler-exchange-httpd_deposits_get.c taler-exchange-httpd_deposits_get.h \
+  taler-exchange-httpd_extensions.c taler-exchange-httpd_extensions.h \
   taler-exchange-httpd_keys.c taler-exchange-httpd_keys.h \
   taler-exchange-httpd_kyc-check.c taler-exchange-httpd_kyc-check.h \
   taler-exchange-httpd_kyc-proof.c taler-exchange-httpd_kyc-proof.h \
@@ -91,6 +92,7 @@ taler_exchange_httpd_SOURCES = \
   taler-exchange-httpd_management_auditors.c \
   taler-exchange-httpd_management_auditors_AP_disable.c \
   taler-exchange-httpd_management_denominations_HDP_revoke.c \
+  taler-exchange-httpd_management_extensions.c \
   taler-exchange-httpd_management_post_keys.c \
   taler-exchange-httpd_management_signkey_EP_revoke.c \
   taler-exchange-httpd_management_wire_enable.c \
@@ -109,9 +111,6 @@ taler_exchange_httpd_SOURCES = \
   taler-exchange-httpd_wire.c taler-exchange-httpd_wire.h \
   taler-exchange-httpd_withdraw.c taler-exchange-httpd_withdraw.h
 
-#  taler-exchange-httpd_management_post_keys.c
-
-
 taler_exchange_httpd_LDADD = \
   $(LIBGCRYPT_LIBS) \
   $(top_builddir)/src/bank-lib/libtalerbank.la \
diff --git a/src/exchange/taler-exchange-httpd.c b/src/exchange/taler-exchange-httpd.c
index 0ba608ff4..581eaf005 100644
--- a/src/exchange/taler-exchange-httpd.c
+++ b/src/exchange/taler-exchange-httpd.c
@@ -1860,6 +1860,13 @@ run (void *cls,
     GNUNET_SCHEDULER_shutdown ();
     return;
   }
+  if (GNUNET_OK !=
+      TEH_extensions_init ())
+  {
+    global_ret = EXIT_FAILURE;
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
   if (GNUNET_OK !=
       TEH_keys_init ())
   {
diff --git a/src/exchange/taler-exchange-httpd_extensions.c b/src/exchange/taler-exchange-httpd_extensions.c
new file mode 100644
index 000000000..64f20fda3
--- /dev/null
+++ b/src/exchange/taler-exchange-httpd_extensions.c
@@ -0,0 +1,107 @@
+/*
+  This file is part of TALER
+  Copyright (C) 2021 Taler Systems SA
+
+  TALER is free software; you can redistribute it and/or modify it under the
+  terms of the GNU Affero General Public License as published by the Free Software
+  Foundation; either version 3, or (at your option) any later version.
+
+  TALER is distributed in the hope that it will be useful, but WITHOUT ANY
+  WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+  A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
+  You should have received a copy of the GNU Affero General Public License along with
+  TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+*/
+/**
+ * @file taler-exchange-httpd_extensions.c
+ * @brief Handle extensions (age-restriction, peer2peer)
+ * @author Özgür Kesim
+ */
+#include "platform.h"
+#include <gnunet/gnunet_json_lib.h>
+#include "taler_dbevents.h"
+#include "taler-exchange-httpd_responses.h"
+#include "taler-exchange-httpd_extensions.h"
+#include "taler_json_lib.h"
+#include "taler_mhd_lib.h"
+#include <jansson.h>
+
+
+/**
+ * Handler listening for extensions updates by other exchange
+ * services.
+ */
+static struct GNUNET_DB_EventHandler *extensions_eh;
+
+
+/**
+ * Function called whenever another exchange process has updated
+ * the extensions data in the database.
+ *
+ * @param cls NULL
+ * @param extra unused
+ * @param extra_size number of bytes in @a extra unused
+ */
+static void
+extension_update_event_cb (void *cls,
+                            const void *extra,
+                            size_t extra_size)
+{
+  (void) cls;
+  (void) extra;
+  (void) extra_size;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Received /management/extensions update event\n");
+  /* TODO !? */
+}
+
+
+enum GNUNET_GenericReturnValue
+TEH_extensions_init ()
+{
+  /* TODO */
+  struct GNUNET_DB_EventHeaderP es = {
+    .size = htons (sizeof (es)),
+    .type = htons (TALER_DBEVENT_EXCHANGE_EXTENSIONS_UPDATED),
+  };
+
+  extensions_eh = TEH_plugin->event_listen (TEH_plugin->cls,
+                                            GNUNET_TIME_UNIT_FOREVER_REL,
+                                            &es,
+                                            &extension_update_event_cb,
+                                            NULL);
+  if (NULL == extensions_eh)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+void
+TEH_extensions_done ()
+{
+  /* TODO!? */
+}
+
+
+void
+TEH_extensions_update_state (void)
+{
+  /* TODO */
+#if 0
+  struct GNUNET_DB_EventHeaderP es = {
+    .size = htons (sizeof (es)),
+    .type = htons (TALER_DBEVENT_EXCHANGE_WIRE_UPDATED),
+  };
+
+  TEH_plugin->event_notify (TEH_plugin->cls,
+                            &es,
+                            NULL,
+                            0);
+#endif
+}
+
+
+/* end of taler-exchange-httpd_extensions.c */
diff --git a/src/exchange/taler-exchange-httpd_extensions.h b/src/exchange/taler-exchange-httpd_extensions.h
new file mode 100644
index 000000000..513598ff1
--- /dev/null
+++ b/src/exchange/taler-exchange-httpd_extensions.h
@@ -0,0 +1,46 @@
+/*
+  This file is part of TALER
+  Copyright (C) 2021 Taler Systems SA
+
+  TALER is free software; you can redistribute it and/or modify it under the
+  terms of the GNU Affero General Public License as published by the Free Software
+  Foundation; either version 3, or (at your option) any later version.
+
+  TALER is distributed in the hope that it will be useful, but WITHOUT ANY
+  WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+  A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
+
+  You should have received a copy of the GNU Affero General Public License along with
+  TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+*/
+/**
+ * @file taler-exchange-httpd_extensions.h
+ * @brief Manage extensions
+ * @author Özgür Kesim
+ */
+#ifndef TALER_EXCHANGE_HTTPD_EXTENSIONS_H
+#define TALER_EXCHANGE_HTTPD_EXTENSIONS_H
+
+#include <gnunet/gnunet_util_lib.h>
+#include <microhttpd.h>
+#include "taler-exchange-httpd.h"
+
+
+/**
+ * Initialize extensions
+ *
+ * @return #GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+TEH_extensions_init (void);
+
+
+/**
+ * Something changed in the database. Rebuild the extension state metadata.
+ * This function should be called if the exchange learns about a new signature
+ * from our master key.
+ */
+void
+TEH_extensions_update_state (void);
+
+#endif
diff --git a/src/exchange/taler-exchange-httpd_management.h b/src/exchange/taler-exchange-httpd_management.h
index d46aad9e4..f0d922e64 100644
--- a/src/exchange/taler-exchange-httpd_management.h
+++ b/src/exchange/taler-exchange-httpd_management.h
@@ -135,4 +135,25 @@ TEH_handler_management_post_wire_fees (
   const json_t *root);
 
 
+/**
+ * Handle a POST "/management/extensions" request.
+ *
+ * @param connection the MHD connection to handle
+ * @param root uploaded JSON data
+ * @return MHD result code
+ */
+MHD_RESULT
+TEH_handler_management_post_extensions (
+  struct MHD_Connection *connection,
+  const json_t *root);
+
+
+/**
+ * Initialize extension configuration handling.
+ *
+ * @return #GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+TEH_extensions_init (void);
+
 #endif
diff --git a/src/exchange/taler-exchange-httpd_management_extensions.c b/src/exchange/taler-exchange-httpd_management_extensions.c
new file mode 100644
index 000000000..0f1bce62e
--- /dev/null
+++ b/src/exchange/taler-exchange-httpd_management_extensions.c
@@ -0,0 +1,421 @@
+/*
+  This file is part of TALER
+  Copyright (C) 2021 Taler Systems SA
+
+  TALER is free software; you can redistribute it and/or modify it under the
+  terms of the GNU Affero General Public License as published by the Free Software
+  Foundation; either version 3, or (at your option) any later version.
+
+  TALER is distributed in the hope that it will be useful, but WITHOUT ANY
+  WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+  A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
+
+  You should have received a copy of the GNU Affero General Public License along with
+  TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+*/
+/**
+ * @file taler-exchange-httpd_management_extensions.c
+ * @brief Handle request to POST /management/extensions
+ * @author Özgür Kesim
+ */
+#include "platform.h"
+#include <gnunet/gnunet_util_lib.h>
+#include <gnunet/gnunet_json_lib.h>
+#include <jansson.h>
+#include <microhttpd.h>
+#include <pthread.h>
+#include "taler_json_lib.h"
+#include "taler_mhd_lib.h"
+#include "taler_signatures.h"
+#include "taler-exchange-httpd_management.h"
+#include "taler-exchange-httpd_responses.h"
+
+
+
+#if 0
+/**
+ * Function implementing database transaction to add offline signing keys.
+ * Runs the transaction logic; IF it returns a non-error code, the transaction
+ * logic MUST NOT queue a MHD response.  IF it returns an hard error, the
+ * transaction logic MUST queue a MHD response and set @a mhd_ret.  IF it
+ * returns the soft error code, the function MAY be called again to retry and
+ * MUST not queue a MHD response.
+ *
+ * @param cls closure with a `struct AddKeysContext`
+ * @param connection MHD request which triggered the transaction
+ * @param[out] mhd_ret set to MHD response status for @a connection,
+ *             if transaction failed (!)
+ * @return transaction status
+ */
+static enum GNUNET_DB_QueryStatus
+add_keys (void *cls,
+          struct MHD_Connection *connection,
+          MHD_RESULT *mhd_ret)
+{
+  struct AddKeysContext *akc = cls;
+
+  /* activate all denomination keys */
+  for (unsigned int i = 0; i<akc->nd_sigs; i++)
+  {
+    struct DenomSig *d = &akc->d_sigs[i];
+    enum GNUNET_DB_QueryStatus qs;
+    bool is_active = false;
+    struct TALER_EXCHANGEDB_DenominationKeyMetaData meta;
+    struct TALER_DenominationPublicKey denom_pub;
+
+    /* For idempotency, check if the key is already active */
+    memset (&denom_pub,
+            0,
+            sizeof (denom_pub));
+    qs = TEH_plugin->lookup_denomination_key (
+      TEH_plugin->cls,
+      &d->h_denom_pub,
+      &meta);
+    if (qs < 0)
+    {
+      if (GNUNET_DB_STATUS_SOFT_ERROR == qs)
+        return qs;
+      GNUNET_break (0);
+      *mhd_ret = TALER_MHD_reply_with_error (connection,
+                                             MHD_HTTP_INTERNAL_SERVER_ERROR,
+                                             TALER_EC_GENERIC_DB_FETCH_FAILED,
+                                             "lookup denomination key");
+      return qs;
+    }
+    if (0 == qs)
+    {
+      enum GNUNET_GenericReturnValue rv;
+
+      rv = TEH_keys_load_fees (&d->h_denom_pub,
+                               &denom_pub,
+                               &meta);
+      switch (rv)
+      {
+      case GNUNET_SYSERR:
+        *mhd_ret = TALER_MHD_reply_with_error (
+          connection,
+          MHD_HTTP_INTERNAL_SERVER_ERROR,
+          TALER_EC_EXCHANGE_GENERIC_BAD_CONFIGURATION,
+          GNUNET_h2s (&d->h_denom_pub.hash));
+        return GNUNET_DB_STATUS_HARD_ERROR;
+      case GNUNET_NO:
+        *mhd_ret = TALER_MHD_reply_with_error (
+          connection,
+          MHD_HTTP_NOT_FOUND,
+          TALER_EC_EXCHANGE_GENERIC_DENOMINATION_KEY_UNKNOWN,
+          GNUNET_h2s (&d->h_denom_pub.hash));
+        return GNUNET_DB_STATUS_HARD_ERROR;
+      case GNUNET_OK:
+        break;
+      }
+    }
+    else
+    {
+      is_active = true;
+    }
+
+    /* check signature is valid */
+    if (GNUNET_OK !=
+        TALER_exchange_offline_denom_validity_verify (
+          &d->h_denom_pub,
+          meta.start,
+          meta.expire_withdraw,
+          meta.expire_deposit,
+          meta.expire_legal,
+          &meta.value,
+          &meta.fee_withdraw,
+          &meta.fee_deposit,
+          &meta.fee_refresh,
+          &meta.fee_refund,
+          &TEH_master_public_key,
+          &d->master_sig))
+    {
+      GNUNET_break_op (0);
+      *mhd_ret = TALER_MHD_reply_with_error (
+        connection,
+        MHD_HTTP_FORBIDDEN,
+        TALER_EC_EXCHANGE_MANAGEMENT_KEYS_DENOMKEY_ADD_SIGNATURE_INVALID,
+        GNUNET_h2s (&d->h_denom_pub.hash));
+      if (! is_active)
+        TALER_denom_pub_free (&denom_pub);
+      return GNUNET_DB_STATUS_HARD_ERROR;
+    }
+    if (is_active)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                  "Denomination key %s already active, skipping\n",
+                  GNUNET_h2s (&d->h_denom_pub.hash));
+      continue; /* skip, already known */
+    }
+    qs = TEH_plugin->add_denomination_key (
+      TEH_plugin->cls,
+      &d->h_denom_pub,
+      &denom_pub,
+      &meta,
+      &d->master_sig);
+    TALER_denom_pub_free (&denom_pub);
+    if (qs < 0)
+    {
+      if (GNUNET_DB_STATUS_SOFT_ERROR == qs)
+        return qs;
+      GNUNET_break (0);
+      *mhd_ret = TALER_MHD_reply_with_error (connection,
+                                             MHD_HTTP_INTERNAL_SERVER_ERROR,
+                                             TALER_EC_GENERIC_DB_STORE_FAILED,
+                                             "activate denomination key");
+      return qs;
+    }
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Added offline signature for denomination `%s'\n",
+                GNUNET_h2s (&d->h_denom_pub.hash));
+    GNUNET_assert (0 != qs);
+  }
+
+  for (unsigned int i = 0; i<akc->ns_sigs; i++)
+  {
+    struct SigningSig *s = &akc->s_sigs[i];
+    enum GNUNET_DB_QueryStatus qs;
+    bool is_active = false;
+    struct TALER_EXCHANGEDB_SignkeyMetaData meta;
+
+    qs = TEH_plugin->lookup_signing_key (
+      TEH_plugin->cls,
+      &s->exchange_pub,
+      &meta);
+    if (qs < 0)
+    {
+      if (GNUNET_DB_STATUS_SOFT_ERROR == qs)
+        return qs;
+      GNUNET_break (0);
+      *mhd_ret = TALER_MHD_reply_with_error (connection,
+                                             MHD_HTTP_INTERNAL_SERVER_ERROR,
+                                             TALER_EC_GENERIC_DB_FETCH_FAILED,
+                                             "lookup signing key");
+      return qs;
+    }
+    if (0 == qs)
+    {
+      if (GNUNET_OK !=
+          TEH_keys_get_timing (&s->exchange_pub,
+                               &meta))
+      {
+        /* For idempotency, check if the key is already active */
+        *mhd_ret = TALER_MHD_reply_with_error (
+          connection,
+          MHD_HTTP_NOT_FOUND,
+          TALER_EC_EXCHANGE_MANAGEMENT_KEYS_SIGNKEY_UNKNOWN,
+          TALER_B2S (&s->exchange_pub));
+        return GNUNET_DB_STATUS_HARD_ERROR;
+      }
+    }
+    else
+    {
+      is_active = true; /* if we pass, it's active! */
+    }
+
+    /* check signature is valid */
+    if (GNUNET_OK !=
+        TALER_exchange_offline_signkey_validity_verify (
+          &s->exchange_pub,
+          meta.start,
+          meta.expire_sign,
+          meta.expire_legal,
+          &TEH_master_public_key,
+          &s->master_sig))
+    {
+      GNUNET_break_op (0);
+      *mhd_ret = TALER_MHD_reply_with_error (
+        connection,
+        MHD_HTTP_FORBIDDEN,
+        TALER_EC_EXCHANGE_MANAGEMENT_KEYS_SIGNKEY_ADD_SIGNATURE_INVALID,
+        TALER_B2S (&s->exchange_pub));
+      return GNUNET_DB_STATUS_HARD_ERROR;
+    }
+    if (is_active)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                  "Signing key %s already active, skipping\n",
+                  TALER_B2S (&s->exchange_pub));
+      continue;   /* skip, already known */
+    }
+    qs = TEH_plugin->activate_signing_key (
+      TEH_plugin->cls,
+      &s->exchange_pub,
+      &meta,
+      &s->master_sig);
+    if (qs < 0)
+    {
+      if (GNUNET_DB_STATUS_SOFT_ERROR == qs)
+        return qs;
+      GNUNET_break (0);
+      *mhd_ret = TALER_MHD_reply_with_error (connection,
+                                             MHD_HTTP_INTERNAL_SERVER_ERROR,
+                                             TALER_EC_GENERIC_DB_STORE_FAILED,
+                                             "activate signing key");
+      return qs;
+    }
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Added offline signature for signing key `%s'\n",
+                TALER_B2S (&s->exchange_pub));
+    GNUNET_assert (0 != qs);
+  }
+  return GNUNET_DB_STATUS_SUCCESS_ONE_RESULT; /* only 'success', so >=0, matters here */
+}
+
+#endif
+
+MHD_RESULT
+TEH_handler_management_post_extensions (
+  struct MHD_Connection *connection,
+  const json_t *root)
+{
+#if 0
+  json_t *denom_sigs;
+  json_t *signkey_sigs;
+  struct GNUNET_JSON_Specification spec[] = {
+    GNUNET_JSON_spec_json ("denom_sigs",
+                           &denom_sigs),
+    GNUNET_JSON_spec_json ("signkey_sigs",
+                           &signkey_sigs),
+    GNUNET_JSON_spec_end ()
+  };
+  bool ok;
+  MHD_RESULT ret;
+
+  {
+    enum GNUNET_GenericReturnValue res;
+
+    res = TALER_MHD_parse_json_data (connection,
+                                     root,
+                                     spec);
+    if (GNUNET_SYSERR == res)
+      return MHD_NO; /* hard failure */
+    if (GNUNET_NO == res)
+      return MHD_YES; /* failure */
+  }
+  if (! (json_is_array (denom_sigs) &&
+         json_is_array (signkey_sigs)) )
+  {
+    GNUNET_break_op (0);
+    GNUNET_JSON_parse_free (spec);
+    return TALER_MHD_reply_with_error (
+      connection,
+      MHD_HTTP_BAD_REQUEST,
+      TALER_EC_GENERIC_PARAMETER_MALFORMED,
+      "array expected for denom_sigs and signkey_sigs");
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Received /management/keys\n");
+  akc.nd_sigs = json_array_size (denom_sigs);
+  akc.d_sigs = GNUNET_new_array (akc.nd_sigs,
+                                 struct DenomSig);
+  ok = true;
+  for (unsigned int i = 0; i<akc.nd_sigs; i++)
+  {
+    struct DenomSig *d = &akc.d_sigs[i];
+    struct GNUNET_JSON_Specification ispec[] = {
+      GNUNET_JSON_spec_fixed_auto ("master_sig",
+                                   &d->master_sig),
+      GNUNET_JSON_spec_fixed_auto ("h_denom_pub",
+                                   &d->h_denom_pub),
+      GNUNET_JSON_spec_end ()
+    };
+    enum GNUNET_GenericReturnValue res;
+
+    res = TALER_MHD_parse_json_data (connection,
+                                     json_array_get (denom_sigs,
+                                                     i),
+                                     ispec);
+    if (GNUNET_SYSERR == res)
+    {
+      ret = MHD_NO; /* hard failure */
+      ok = false;
+      break;
+    }
+    if (GNUNET_NO == res)
+    {
+      ret = MHD_YES;
+      ok = false;
+      break;
+    }
+  }
+  if (! ok)
+  {
+    GNUNET_free (akc.d_sigs);
+    GNUNET_JSON_parse_free (spec);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failure to handle /management/keys\n");
+    return ret;
+  }
+  akc.ns_sigs = json_array_size (signkey_sigs);
+  akc.s_sigs = GNUNET_new_array (akc.ns_sigs,
+                                 struct SigningSig);
+  for (unsigned int i = 0; i<akc.ns_sigs; i++)
+  {
+    struct SigningSig *s = &akc.s_sigs[i];
+    struct GNUNET_JSON_Specification ispec[] = {
+      GNUNET_JSON_spec_fixed_auto ("master_sig",
+                                   &s->master_sig),
+      GNUNET_JSON_spec_fixed_auto ("exchange_pub",
+                                   &s->exchange_pub),
+      GNUNET_JSON_spec_end ()
+    };
+    enum GNUNET_GenericReturnValue res;
+
+    res = TALER_MHD_parse_json_data (connection,
+                                     json_array_get (signkey_sigs,
+                                                     i),
+                                     ispec);
+    if (GNUNET_SYSERR == res)
+    {
+      ret = MHD_NO; /* hard failure */
+      ok = false;
+      break;
+    }
+    if (GNUNET_NO == res)
+    {
+      ret = MHD_YES;
+      ok = false;
+      break;
+    }
+  }
+  if (! ok)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failure to handle /management/keys\n");
+    GNUNET_free (akc.d_sigs);
+    GNUNET_free (akc.s_sigs);
+    GNUNET_JSON_parse_free (spec);
+    return ret;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Received %u denomination and %u signing key signatures\n",
+              akc.nd_sigs,
+              akc.ns_sigs);
+  {
+    enum GNUNET_GenericReturnValue res;
+
+    res = TEH_DB_run_transaction (connection,
+                                  "add keys",
+                                  TEH_MT_OTHER,
+                                  &ret,
+                                  &add_keys,
+                                  &akc);
+    GNUNET_free (akc.d_sigs);
+    GNUNET_free (akc.s_sigs);
+    GNUNET_JSON_parse_free (spec);
+    if (GNUNET_SYSERR == res)
+      return ret;
+  }
+  TEH_keys_update_states ();
+#endif
+
+  return TALER_MHD_reply_static (
+    connection,
+    MHD_HTTP_NO_CONTENT,
+    NULL,
+    NULL,
+    0);
+}
+
+/* end of taler-exchange-httpd_management_management_post_extensions.c */
diff --git a/src/exchangedb/exchange-0001.sql b/src/exchangedb/exchange-0001.sql
index 1725b70e0..b98c72cb7 100644
--- a/src/exchangedb/exchange-0001.sql
+++ b/src/exchangedb/exchange-0001.sql
@@ -266,6 +266,22 @@ COMMENT ON TABLE signkey_revocations
   IS 'Table storing which online signing keys have been revoked';
 
 
+CREATE TABLE IF NOT EXISTS extensions
+  (extension_id BIGSERIAL UNIQUE
+  ,name VARCHAR NOT NULL UNIQUE
+  ,config BYTEA NOT NULL
+  ,config_sig BYTEA NOT NULL
+  );
+COMMENT ON TABLE extensions
+  IS 'Configurations of the activated extensions';
+COMMENT ON COLUMN extensions.name
+  IS 'Name of the extension';
+COMMENT ON COLUMN extensions.config
+  IS 'Configuration of the extension as JSON-blob';
+COMMENT ON COLUMN extensions.config
+  IS 'Signature of the configuration of an extension, signed with the master key of the exchange';
+
+
 CREATE TABLE IF NOT EXISTS known_coins
   (known_coin_id BIGSERIAL UNIQUE
   ,coin_pub BYTEA NOT NULL PRIMARY KEY CHECK (LENGTH(coin_pub)=32)
diff --git a/src/include/taler_exchangedb_plugin.h b/src/include/taler_exchangedb_plugin.h
index ad840fc92..dfaf0765c 100644
--- a/src/include/taler_exchangedb_plugin.h
+++ b/src/include/taler_exchangedb_plugin.h
@@ -4040,6 +4040,9 @@ struct TALER_EXCHANGEDB_Plugin
   enum GNUNET_DB_QueryStatus
   (*delete_revolving_shards)(void *cls);
 
+  /**
+   * TODO-oec: add function for adding extension config
+   */
 
 };
 
diff --git a/src/lib/exchange_api_management_post_extensions.c b/src/lib/exchange_api_management_post_extensions.c
index dbdcf4b46..7f6349113 100644
--- a/src/lib/exchange_api_management_post_extensions.c
+++ b/src/lib/exchange_api_management_post_extensions.c
@@ -155,6 +155,7 @@ TALER_EXCHANGE_management_post_extensions (
   for (unsigned int i = 0; i<pkd->num_extensions; i++)
   {
     json_t *config;
+    const struct TALER_AgeMask *mask;
     const struct TALER_Extension *ext
       = &pkd->extensions[i];
 
@@ -162,7 +163,7 @@ TALER_EXCHANGE_management_post_extensions (
     {
     // TODO: case TALER_Extension_Peer2Peer
     case TALER_Extension_AgeRestriction:
-      struct TALER_AgeMask *mask = (struct TALER_AgeMask *) (&ext->config);
+      mask = (struct TALER_AgeMask *) (&ext->config);
       config = GNUNET_JSON_PACK (GNUNET_JSON_pack_data_auto ("mask",
                                                              &mask->mask));
       GNUNET_assert (NULL != config);