diff --git a/docs/DDIAL.md b/docs/DDIAL.md
index a9a725c..18f9b28 100644
--- a/docs/DDIAL.md
+++ b/docs/DDIAL.md
@@ -157,16 +157,30 @@ its own upstream hub:
 | `CHATTER_DDIAL_HUB_LISTEN` | `port` or `addr:port` (`[v6addr]:port`) to accept station links on. Unset = off. |
 | `CHATTER_DDIAL_STATION` | Name shown in the welcome line and the `}}}` user list. |
 
-Operators manage keys from the Chatter room:
-
-- `/ddial key new <station-name>` prints a new nine-digit station key.
-  **It is shown once.** Give it to that station's operator; it is their
-  link password (`CHATTER_DDIAL_KEY` on another ssh-chatter).
+Operators manage requests and keys from the Chatter room:
+
+- `/ddial requests` lists pending inbound station requests with their ids,
+  names and source addresses.
+- `/ddial approve <request-id>` prints a new nine-digit station key and
+  removes the request. **The key is shown once.** Give it to that station's
+  operator; it is their link password (`CHATTER_DDIAL_KEY` on another
+  ssh-chatter).
+- `/ddial deny <request-id>` removes a request without issuing a key.
+- `/ddial key new <station-name>` still creates a key directly when no
+  inbound request is needed.
 - `/ddial key list` shows each key's id, name, creation date and last use.
 - `/ddial key revoke <id>` deletes a key and drops a station linked with it.
   Ids are never reused.
 - `/ddial hub` lists the linked stations.
 
+A station without a key sends `@request:<station-name>` at the password
+prompt (for example, `CHATTER_DDIAL_KEY='@request:RemoteOne'`). The hub
+records the request and closes that login attempt; the station can use the
+key after an operator approves it. Repeating a request from the same address
+and name keeps its original id. Pending requests are stored in
+`ddial_station_requests.dat` next to the member files and rewritten
+atomically whenever they change.
+
 Keys are stored as PBKDF2-SHA256 hashes in `ddial_station_keys.tsv` next to
 the member files (mode 0600).
 
diff --git a/src/host/core/command_messages.c b/src/host/core/command_messages.c
index 1da0a69..33ee1df 100644
--- a/src/host/core/command_messages.c
+++ b/src/host/core/command_messages.c
@@ -1623,6 +1623,126 @@ static const session_command_message_t kSessionCommandMessages[] = {
             [SESSION_UI_LANGUAGE_PL] = "Wątek wiadomości #%s:",
         },
     },
+    {
+        "Only operators can manage DDial station links.",
+        {
+            [SESSION_UI_LANGUAGE_KO] = "DDial 스테이션 링크는 운영자만 관리할 수 있습니다.",
+            [SESSION_UI_LANGUAGE_JP] = "DDial ステーションリンクを管理できるのはオペレーターのみです。",
+            [SESSION_UI_LANGUAGE_ZH] = "只有管理员可以管理 DDial 站点链接。",
+            [SESSION_UI_LANGUAGE_RU] = "Управлять связями станций DDial могут только операторы.",
+            [SESSION_UI_LANGUAGE_DE] = "Nur Operatoren können DDial-Stationsverbindungen verwalten.",
+            [SESSION_UI_LANGUAGE_FR] = "Seuls les opérateurs peuvent gérer les liaisons de stations DDial.",
+            [SESSION_UI_LANGUAGE_PL] = "Tylko operatorzy mogą zarządzać połączeniami stacji DDial.",
+        },
+    },
+    {
+        "No pending station requests.",
+        {
+            [SESSION_UI_LANGUAGE_KO] = "대기 중인 스테이션 요청이 없습니다.",
+            [SESSION_UI_LANGUAGE_JP] = "保留中のステーション要求はありません。",
+            [SESSION_UI_LANGUAGE_ZH] = "没有待处理的站点请求。",
+            [SESSION_UI_LANGUAGE_RU] = "Нет ожидающих запросов станций.",
+            [SESSION_UI_LANGUAGE_DE] = "Keine ausstehenden Stationsanfragen.",
+            [SESSION_UI_LANGUAGE_FR] = "Aucune demande de station en attente.",
+            [SESSION_UI_LANGUAGE_PL] = "Brak oczekujących zgłoszeń stacji.",
+        },
+    },
+    {
+        "Pending station requests:",
+        {
+            [SESSION_UI_LANGUAGE_KO] = "대기 중인 스테이션 요청:",
+            [SESSION_UI_LANGUAGE_JP] = "保留中のステーション要求:",
+            [SESSION_UI_LANGUAGE_ZH] = "待处理的站点请求：",
+            [SESSION_UI_LANGUAGE_RU] = "Ожидающие запросы станций:",
+            [SESSION_UI_LANGUAGE_DE] = "Ausstehende Stationsanfragen:",
+            [SESSION_UI_LANGUAGE_FR] = "Demandes de stations en attente :",
+            [SESSION_UI_LANGUAGE_PL] = "Oczekujące zgłoszenia stacji:",
+        },
+    },
+    {
+        "Usage: /ddial approve <request-id>",
+        {
+            [SESSION_UI_LANGUAGE_KO] = "사용법: /ddial approve <요청ID>",
+            [SESSION_UI_LANGUAGE_JP] = "使い方: /ddial approve <要求ID>",
+            [SESSION_UI_LANGUAGE_ZH] = "用法：/ddial approve <请求ID>",
+            [SESSION_UI_LANGUAGE_RU] = "Использование: /ddial approve <id запроса>",
+            [SESSION_UI_LANGUAGE_DE] = "Verwendung: /ddial approve <Anfrage-ID>",
+            [SESSION_UI_LANGUAGE_FR] = "Utilisation : /ddial approve <id-demande>",
+            [SESSION_UI_LANGUAGE_PL] = "Użycie: /ddial approve <id-zgłoszenia>",
+        },
+    },
+    {
+        "Usage: /ddial deny <request-id>",
+        {
+            [SESSION_UI_LANGUAGE_KO] = "사용법: /ddial deny <요청ID>",
+            [SESSION_UI_LANGUAGE_JP] = "使い方: /ddial deny <要求ID>",
+            [SESSION_UI_LANGUAGE_ZH] = "用法：/ddial deny <请求ID>",
+            [SESSION_UI_LANGUAGE_RU] = "Использование: /ddial deny <id запроса>",
+            [SESSION_UI_LANGUAGE_DE] = "Verwendung: /ddial deny <Anfrage-ID>",
+            [SESSION_UI_LANGUAGE_FR] = "Utilisation : /ddial deny <id-demande>",
+            [SESSION_UI_LANGUAGE_PL] = "Użycie: /ddial deny <id-zgłoszenia>",
+        },
+    },
+    {
+        "No station request with that id.",
+        {
+            [SESSION_UI_LANGUAGE_KO] = "해당 ID의 스테이션 요청이 없습니다.",
+            [SESSION_UI_LANGUAGE_JP] = "その ID のステーション要求はありません。",
+            [SESSION_UI_LANGUAGE_ZH] = "没有该 ID 的站点请求。",
+            [SESSION_UI_LANGUAGE_RU] = "Запрос станции с таким id не найден.",
+            [SESSION_UI_LANGUAGE_DE] = "Keine Stationsanfrage mit dieser ID.",
+            [SESSION_UI_LANGUAGE_FR] = "Aucune demande de station avec cet identifiant.",
+            [SESSION_UI_LANGUAGE_PL] = "Brak zgłoszenia stacji o tym identyfikatorze.",
+        },
+    },
+    {
+        "Could not approve station request.",
+        {
+            [SESSION_UI_LANGUAGE_KO] = "스테이션 요청을 승인하지 못했습니다.",
+            [SESSION_UI_LANGUAGE_JP] = "ステーション要求を承認できませんでした。",
+            [SESSION_UI_LANGUAGE_ZH] = "无法批准站点请求。",
+            [SESSION_UI_LANGUAGE_RU] = "Не удалось одобрить запрос станции.",
+            [SESSION_UI_LANGUAGE_DE] = "Stationsanfrage konnte nicht genehmigt werden.",
+            [SESSION_UI_LANGUAGE_FR] = "Impossible d'approuver la demande de station.",
+            [SESSION_UI_LANGUAGE_PL] = "Nie udało się zatwierdzić zgłoszenia stacji.",
+        },
+    },
+    {
+        "Could not deny station request.",
+        {
+            [SESSION_UI_LANGUAGE_KO] = "스테이션 요청을 거절하지 못했습니다.",
+            [SESSION_UI_LANGUAGE_JP] = "ステーション要求を拒否できませんでした。",
+            [SESSION_UI_LANGUAGE_ZH] = "无法拒绝站点请求。",
+            [SESSION_UI_LANGUAGE_RU] = "Не удалось отклонить запрос станции.",
+            [SESSION_UI_LANGUAGE_DE] = "Stationsanfrage konnte nicht abgelehnt werden.",
+            [SESSION_UI_LANGUAGE_FR] = "Impossible de refuser la demande de station.",
+            [SESSION_UI_LANGUAGE_PL] = "Nie udało się odrzucić zgłoszenia stacji.",
+        },
+    },
+    {
+        "Station request #%u denied.",
+        {
+            [SESSION_UI_LANGUAGE_KO] = "스테이션 요청 #%u을(를) 거절했습니다.",
+            [SESSION_UI_LANGUAGE_JP] = "ステーション要求 #%u を拒否しました。",
+            [SESSION_UI_LANGUAGE_ZH] = "已拒绝站点请求 #%u。",
+            [SESSION_UI_LANGUAGE_RU] = "Запрос станции #%u отклонён.",
+            [SESSION_UI_LANGUAGE_DE] = "Stationsanfrage #%u abgelehnt.",
+            [SESSION_UI_LANGUAGE_FR] = "Demande de station #%u refusée.",
+            [SESSION_UI_LANGUAGE_PL] = "Odrzucono zgłoszenie stacji #%u.",
+        },
+    },
+    {
+        "Station request #%u approved. Station key #%u for '%s': %s (shown once; give it to that station's operator)",
+        {
+            [SESSION_UI_LANGUAGE_KO] = "스테이션 요청 #%u을(를) 승인했습니다. 스테이션 키 #%u ('%s'): %s (한 번만 표시되니 해당 스테이션 운영자에게 전달하세요)",
+            [SESSION_UI_LANGUAGE_JP] = "ステーション要求 #%u を承認しました。ステーションキー #%u ('%s'): %s (一度だけ表示されます。ステーションのオペレーターに渡してください)",
+            [SESSION_UI_LANGUAGE_ZH] = "已批准站点请求 #%u。站点密钥 #%u（'%s'）：%s（仅显示一次，请交给该站点管理员）",
+            [SESSION_UI_LANGUAGE_RU] = "Запрос станции #%u одобрен. Ключ станции #%u для «%s»: %s (показывается один раз; передайте его оператору станции)",
+            [SESSION_UI_LANGUAGE_DE] = "Stationsanfrage #%u genehmigt. Stationsschlüssel #%u für „%s“: %s (wird nur einmal angezeigt; an den Stationsoperator weitergeben)",
+            [SESSION_UI_LANGUAGE_FR] = "Demande de station #%u approuvée. Clé de station #%u pour « %s » : %s (affichée une seule fois ; transmettez-la à l'opérateur de cette station)",
+            [SESSION_UI_LANGUAGE_PL] = "Zatwierdzono zgłoszenie stacji #%u. Klucz stacji #%u dla „%s”: %s (widoczny tylko raz; przekaż go operatorowi tej stacji)",
+        },
+    },
 };
 
 // Returns the message in the session's UI language, or the English text when
diff --git a/src/host/core/help_entries.c b/src/host/core/help_entries.c
index a3c2560..21eccb4 100644
--- a/src/host/core/help_entries.c
+++ b/src/host/core/help_entries.c
@@ -2273,6 +2273,38 @@ static const session_help_entry_t kSessionHelpOperator[] = {
         .label_arg_count = 0U,
         .label_args = {},
     },
+    {
+        .kind = SESSION_HELP_ENTRY_COMMAND,
+        .label = "ddial <requests|approve <request-id>|deny <request-id>>",
+        .description =
+            {
+                "Review inbound station requests. approve issues a key shown "
+                "once and removes the request; deny removes it without "
+                "issuing a key (operator only).",
+                "들어온 스테이션 요청을 검토합니다. approve는 한 번만 표시되는 "
+                "키를 발급하고 요청을 삭제하며, deny는 키 없이 요청을 삭제합니다 "
+                "(운영자 전용).",
+                "受信したステーション要求を確認します。approve は一度だけ表示"
+                "されるキーを発行して要求を削除し、deny はキーを発行せず要求を"
+                "削除します（オペレーター専用）。",
+                "查看收到的站点请求。approve 签发仅显示一次的密钥并删除请求；"
+                "deny 不签发密钥，直接删除请求（仅限管理员）。",
+                "Просмотр входящих запросов станций. approve выдаёт ключ, "
+                "показываемый один раз, и удаляет запрос; deny удаляет запрос "
+                "без выдачи ключа (только оператор).",
+                "Eingehende Stationsanfragen prüfen. approve erstellt einen nur "
+                "einmal angezeigten Schlüssel und löscht die Anfrage; deny "
+                "löscht sie ohne Schlüssel (nur Operatoren).",
+                "Examiner les demandes de stations entrantes. approve génère "
+                "une clé affichée une seule fois et supprime la demande ; deny "
+                "la supprime sans clé (opérateur uniquement).",
+                "Przeglądaj przychodzące zgłoszenia stacji. approve wydaje klucz "
+                "widoczny tylko raz i usuwa zgłoszenie; deny usuwa je bez "
+                "wydawania klucza (tylko operator).",
+            },
+        .label_arg_count = 0U,
+        .label_args = {},
+    },
     {
         .kind = SESSION_HELP_ENTRY_COMMAND,
         .label = "resetpw <nickname>",
diff --git a/src/host/ddial/hub.c b/src/host/ddial/hub.c
index 0a65b5f..e62bef0 100644
--- a/src/host/ddial/hub.c
+++ b/src/host/ddial/hub.c
@@ -10,7 +10,9 @@
  *   1. The station connects to CHATTER_DDIAL_HUB_LISTEN ([addr:]port).
  *   2. We print "Enter Password or [RETURN]: ".
  *   3. The station sends a station key: nine digits generated here with
- *      /ddial key new <label> and handed to that station's operator.
+ *      /ddial key new <label> or /ddial approve <request-id> and handed to
+ *      that station's operator. A station without a key can instead send
+ *      @request:<name>, which is persisted in ddial_station_requests.dat.
  *      Keys are stored as PBKDF2 hashes in ddial_station_keys.tsv; the
  *      plain key is shown only once, when it is created.
  *   4. On a valid key we answer "Welcome to <station> station link", the
@@ -58,6 +60,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <strings.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <time.h>
@@ -67,6 +70,8 @@
 /* Link lines handed to stations start here, well above dial-in lines. */
 #define DDIAL_HUB_FIRST_SLOT 60U
 #define DDIAL_HUB_MAX_KEYS 64U
+#define DDIAL_HUB_MAX_REQUESTS 64U
+#define DDIAL_HUB_REQUEST_REFRESH_SEC 60
 #define DDIAL_HUB_LOGIN_TIMEOUT_SEC 30
 #define DDIAL_HUB_POLL_MS 1000
 /* Brute-force guard: after this many bad keys from one address within the
@@ -85,6 +90,20 @@ typedef struct ddial_hub_key {
     int64_t last_used;
 } ddial_hub_key_t;
 
+typedef struct ddial_hub_request {
+    unsigned id;
+    char name[DDIAL_MAX_HANDLE_LEN];
+    char ip[SSH_CHATTER_IP_LEN];
+    int64_t created;
+    int64_t last_seen;
+} ddial_hub_request_t;
+
+typedef enum ddial_hub_request_result {
+    DDIAL_HUB_REQUEST_ERROR = -1,
+    DDIAL_HUB_REQUEST_NOT_FOUND = 0,
+    DDIAL_HUB_REQUEST_OK = 1,
+} ddial_hub_request_result_t;
+
 typedef struct ddial_hub_station {
     struct ddial_hub_station *next;
     host_t *host;
@@ -117,6 +136,11 @@ static size_t g_ddial_hub_key_count = 0U;
 static unsigned g_ddial_hub_next_key_id = 1U;
 static bool g_ddial_hub_keys_loaded = false;
 static char g_ddial_hub_key_path[PATH_MAX];
+static ddial_hub_request_t g_ddial_hub_requests[DDIAL_HUB_MAX_REQUESTS];
+static size_t g_ddial_hub_request_count = 0U;
+static unsigned g_ddial_hub_next_request_id = 1U;
+static bool g_ddial_hub_requests_loaded = false;
+static char g_ddial_hub_request_path[PATH_MAX];
 static ddial_hub_failure_t g_ddial_hub_failures[DDIAL_HUB_FAIL_TRACK];
 
 typedef struct ddial_hub_listener {
@@ -297,9 +321,9 @@ static bool ddial_hub_random_key(char out[DDIAL_STATION_KEY_LEN + 1U])
 
 /* Create a key for a station.  out_key receives the plain key, which is
  * not stored and cannot be shown again. */
-static bool host_ddial_hub_key_create(host_t *host, const char *label,
-                                      char out_key[DDIAL_STATION_KEY_LEN + 1U],
-                                      unsigned *out_id)
+static bool ddial_hub_key_create_locked(
+    host_t *host, const char *label,
+    char out_key[DDIAL_STATION_KEY_LEN + 1U], unsigned *out_id)
 {
     if (host == nullptr || out_key == nullptr) {
         return false;
@@ -311,16 +335,14 @@ static bool host_ddial_hub_key_create(host_t *host, const char *label,
         snprintf(clean_label, sizeof(clean_label), "%s", "station");
     }
     for (char *p = clean_label; *p != '\0'; ++p) {
-        if (*p == '\t') {
+        if (*p == '\t' || *p == '\r' || *p == '\n') {
             *p = ' ';
         }
     }
 
-    pthread_mutex_lock(&g_ddial_hub_key_lock);
     ddial_hub_keys_load_locked(host);
     if (g_ddial_hub_key_count >= DDIAL_HUB_MAX_KEYS ||
         !ddial_hub_random_key(out_key)) {
-        pthread_mutex_unlock(&g_ddial_hub_key_lock);
         return false;
     }
     ddial_hub_key_t key;
@@ -335,14 +357,309 @@ static bool host_ddial_hub_key_create(host_t *host, const char *label,
     if (!saved) {
         --g_ddial_hub_key_count;
         --g_ddial_hub_next_key_id;
+    } else if (out_id != nullptr) {
+        *out_id = key.id;
     }
+    return saved;
+}
+
+static bool host_ddial_hub_key_create(host_t *host, const char *label,
+                                      char out_key[DDIAL_STATION_KEY_LEN + 1U],
+                                      unsigned *out_id)
+{
+    pthread_mutex_lock(&g_ddial_hub_key_lock);
+    bool created =
+        ddial_hub_key_create_locked(host, label, out_key, out_id);
     pthread_mutex_unlock(&g_ddial_hub_key_lock);
-    if (saved && out_id != nullptr) {
-        *out_id = key.id;
+    return created;
+}
+
+/* ---- station link requests ---------------------------------------------- */
+
+static void ddial_hub_requests_load_locked(host_t *host)
+{
+    if (g_ddial_hub_requests_loaded || host == nullptr) {
+        return;
+    }
+    g_ddial_hub_requests_loaded = true;
+
+    const char *root =
+        host->user_data_root[0] != '\0' ? host->user_data_root : ".";
+    const char *override = getenv("CHATTER_DDIAL_MEMBERS_DIR");
+    if (override != nullptr && override[0] != '\0') {
+        root = override;
+    }
+    snprintf(g_ddial_hub_request_path, sizeof(g_ddial_hub_request_path),
+             "%s/ddial_station_requests.dat", root);
+
+    FILE *fp = fopen(g_ddial_hub_request_path, "r");
+    if (fp == nullptr) {
+        return;
+    }
+    char line[512];
+    while (fgets(line, sizeof(line), fp) != nullptr &&
+           g_ddial_hub_request_count < DDIAL_HUB_MAX_REQUESTS) {
+        line[strcspn(line, "\r\n")] = '\0';
+        unsigned next_id = 0U;
+        if (sscanf(line, "# next_id %u", &next_id) == 1) {
+            if (next_id > g_ddial_hub_next_request_id) {
+                g_ddial_hub_next_request_id = next_id;
+            }
+            continue;
+        }
+        char *fields[5] = {nullptr};
+        char *save = nullptr;
+        size_t count = 0U;
+        for (char *tok = strtok_r(line, "\t", &save);
+             tok != nullptr && count < 5U;
+             tok = strtok_r(nullptr, "\t", &save)) {
+            fields[count++] = tok;
+        }
+        if (count < 5U) {
+            continue;
+        }
+        ddial_hub_request_t request;
+        memset(&request, 0, sizeof(request));
+        request.id = (unsigned)strtoul(fields[0], nullptr, 10);
+        if (request.id == 0U ||
+            ddial_sanitize_handle(fields[1], strlen(fields[1]), request.name,
+                                  sizeof(request.name)) == 0U ||
+            fields[2][0] == '\0') {
+            continue;
+        }
+        snprintf(request.ip, sizeof(request.ip), "%s", fields[2]);
+        request.created = strtoll(fields[3], nullptr, 10);
+        request.last_seen = strtoll(fields[4], nullptr, 10);
+        g_ddial_hub_requests[g_ddial_hub_request_count++] = request;
+        if (request.id >= g_ddial_hub_next_request_id) {
+            g_ddial_hub_next_request_id = request.id + 1U;
+        }
+    }
+    fclose(fp);
+}
+
+static bool ddial_hub_requests_save_locked(void)
+{
+    if (g_ddial_hub_request_path[0] == '\0') {
+        return false;
+    }
+    char temp_path[PATH_MAX];
+    int written = snprintf(temp_path, sizeof(temp_path), "%s.tmp",
+                           g_ddial_hub_request_path);
+    if (written < 0 || (size_t)written >= sizeof(temp_path)) {
+        return false;
+    }
+    int fd = open(temp_path, O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW,
+                  S_IRUSR | S_IWUSR);
+    if (fd < 0) {
+        return false;
+    }
+    FILE *fp = fdopen(fd, "w");
+    if (fp == nullptr) {
+        close(fd);
+        unlink(temp_path);
+        return false;
+    }
+    bool ok = fprintf(fp, "# next_id %u\n", g_ddial_hub_next_request_id) > 0;
+    for (size_t i = 0U; i < g_ddial_hub_request_count && ok; ++i) {
+        const ddial_hub_request_t *request = &g_ddial_hub_requests[i];
+        ok = fprintf(fp, "%u\t%s\t%s\t%lld\t%lld\n", request->id, request->name,
+                     request->ip, (long long)request->created,
+                     (long long)request->last_seen) > 0;
+    }
+    if (fflush(fp) != 0 || fsync(fileno(fp)) != 0) {
+        ok = false;
+    }
+    if (fclose(fp) != 0) {
+        ok = false;
     }
+    if (!ok || rename(temp_path, g_ddial_hub_request_path) != 0) {
+        unlink(temp_path);
+        return false;
+    }
+    return true;
+}
+
+static bool host_ddial_hub_request_register(host_t *host, const char *name,
+                                            const char *ip, unsigned *out_id)
+{
+    if (host == nullptr || name == nullptr) {
+        return false;
+    }
+    char clean_name[DDIAL_MAX_HANDLE_LEN];
+    snprintf(clean_name, sizeof(clean_name), "%s", name);
+    for (char *p = clean_name; *p != '\0'; ++p) {
+        if (*p == '\t' || *p == '\r' || *p == '\n') {
+            *p = ' ';
+        }
+    }
+    trim_whitespace_inplace(clean_name);
+    char sanitized[DDIAL_MAX_HANDLE_LEN];
+    if (ddial_sanitize_handle(clean_name, strlen(clean_name), sanitized,
+                              sizeof(sanitized)) == 0U) {
+        return false;
+    }
+
+    pthread_mutex_lock(&g_ddial_hub_key_lock);
+    ddial_hub_requests_load_locked(host);
+    int64_t now = (int64_t)time(nullptr);
+    for (size_t i = 0U; i < g_ddial_hub_request_count; ++i) {
+        ddial_hub_request_t *request = &g_ddial_hub_requests[i];
+        if (strcmp(request->ip, ip != nullptr ? ip : "") == 0 &&
+            ddial_handles_equal(request->name, sanitized)) {
+            if (out_id != nullptr) {
+                *out_id = request->id;
+            }
+            bool saved = true;
+            if (now - request->last_seen >= DDIAL_HUB_REQUEST_REFRESH_SEC) {
+                int64_t previous = request->last_seen;
+                request->last_seen = now;
+                saved = ddial_hub_requests_save_locked();
+                if (!saved) {
+                    request->last_seen = previous;
+                }
+            }
+            pthread_mutex_unlock(&g_ddial_hub_key_lock);
+            return saved;
+        }
+    }
+    if (g_ddial_hub_request_count >= DDIAL_HUB_MAX_REQUESTS) {
+        pthread_mutex_unlock(&g_ddial_hub_key_lock);
+        return false;
+    }
+
+    ddial_hub_request_t request;
+    memset(&request, 0, sizeof(request));
+    request.id = g_ddial_hub_next_request_id++;
+    snprintf(request.name, sizeof(request.name), "%s", sanitized);
+    snprintf(request.ip, sizeof(request.ip), "%s", ip != nullptr ? ip : "");
+    request.created = now;
+    request.last_seen = now;
+    g_ddial_hub_requests[g_ddial_hub_request_count++] = request;
+    bool saved = ddial_hub_requests_save_locked();
+    if (!saved) {
+        --g_ddial_hub_request_count;
+        --g_ddial_hub_next_request_id;
+    } else if (out_id != nullptr) {
+        *out_id = request.id;
+    }
+    pthread_mutex_unlock(&g_ddial_hub_key_lock);
     return saved;
 }
 
+static size_t host_ddial_hub_request_list(host_t *host, char *out, size_t cap)
+{
+    if (out == nullptr || cap == 0U) {
+        return 0U;
+    }
+    out[0] = '\0';
+    size_t used = 0U;
+    pthread_mutex_lock(&g_ddial_hub_key_lock);
+    ddial_hub_requests_load_locked(host);
+    size_t count = g_ddial_hub_request_count;
+    for (size_t i = 0U; i < count && used + 1U < cap; ++i) {
+        const ddial_hub_request_t *request = &g_ddial_hub_requests[i];
+        int n = snprintf(out + used, cap - used, "%s#%u %s [%s]",
+                         used > 0U ? "\n" : "", request->id, request->name,
+                         request->ip);
+        if (n < 0 || (size_t)n >= cap - used) {
+            break;
+        }
+        used += (size_t)n;
+    }
+    pthread_mutex_unlock(&g_ddial_hub_key_lock);
+    return count;
+}
+
+static size_t ddial_hub_request_find_locked(unsigned id)
+{
+    for (size_t i = 0U; i < g_ddial_hub_request_count; ++i) {
+        if (g_ddial_hub_requests[i].id == id) {
+            return i;
+        }
+    }
+    return g_ddial_hub_request_count;
+}
+
+static void ddial_hub_request_restore_locked(size_t idx,
+                                             const ddial_hub_request_t *request)
+{
+    memmove(&g_ddial_hub_requests[idx + 1U], &g_ddial_hub_requests[idx],
+            (g_ddial_hub_request_count - idx) *
+                sizeof(g_ddial_hub_requests[0]));
+    g_ddial_hub_requests[idx] = *request;
+    ++g_ddial_hub_request_count;
+}
+
+static ddial_hub_request_result_t
+host_ddial_hub_request_deny(host_t *host, unsigned id)
+{
+    if (host == nullptr) {
+        return DDIAL_HUB_REQUEST_ERROR;
+    }
+    pthread_mutex_lock(&g_ddial_hub_key_lock);
+    ddial_hub_requests_load_locked(host);
+    size_t idx = ddial_hub_request_find_locked(id);
+    if (idx == g_ddial_hub_request_count) {
+        pthread_mutex_unlock(&g_ddial_hub_key_lock);
+        return DDIAL_HUB_REQUEST_NOT_FOUND;
+    }
+    ddial_hub_request_t request = g_ddial_hub_requests[idx];
+    memmove(&g_ddial_hub_requests[idx], &g_ddial_hub_requests[idx + 1U],
+            (g_ddial_hub_request_count - idx - 1U) *
+                sizeof(g_ddial_hub_requests[0]));
+    --g_ddial_hub_request_count;
+    bool saved = ddial_hub_requests_save_locked();
+    if (!saved) {
+        ddial_hub_request_restore_locked(idx, &request);
+    }
+    pthread_mutex_unlock(&g_ddial_hub_key_lock);
+    return saved ? DDIAL_HUB_REQUEST_OK : DDIAL_HUB_REQUEST_ERROR;
+}
+
+static ddial_hub_request_result_t host_ddial_hub_request_approve(
+    host_t *host, unsigned id, char out_name[DDIAL_MAX_HANDLE_LEN],
+    char out_key[DDIAL_STATION_KEY_LEN + 1U], unsigned *out_key_id)
+{
+    if (host == nullptr || out_name == nullptr || out_key == nullptr) {
+        return DDIAL_HUB_REQUEST_ERROR;
+    }
+    out_name[0] = '\0';
+    out_key[0] = '\0';
+
+    pthread_mutex_lock(&g_ddial_hub_key_lock);
+    ddial_hub_requests_load_locked(host);
+    size_t idx = ddial_hub_request_find_locked(id);
+    if (idx == g_ddial_hub_request_count) {
+        pthread_mutex_unlock(&g_ddial_hub_key_lock);
+        return DDIAL_HUB_REQUEST_NOT_FOUND;
+    }
+    ddial_hub_request_t request = g_ddial_hub_requests[idx];
+    if (!ddial_hub_key_create_locked(host, request.name, out_key, out_key_id)) {
+        pthread_mutex_unlock(&g_ddial_hub_key_lock);
+        return DDIAL_HUB_REQUEST_ERROR;
+    }
+
+    memmove(&g_ddial_hub_requests[idx], &g_ddial_hub_requests[idx + 1U],
+            (g_ddial_hub_request_count - idx - 1U) *
+                sizeof(g_ddial_hub_requests[0]));
+    --g_ddial_hub_request_count;
+    if (!ddial_hub_requests_save_locked()) {
+        ddial_hub_request_restore_locked(idx, &request);
+        --g_ddial_hub_key_count;
+        --g_ddial_hub_next_key_id;
+        if (!ddial_hub_keys_save_locked()) {
+            printf("[ddial-hub] failed to roll back approved station key\n");
+        }
+        memset(out_key, 0, DDIAL_STATION_KEY_LEN + 1U);
+        pthread_mutex_unlock(&g_ddial_hub_key_lock);
+        return DDIAL_HUB_REQUEST_ERROR;
+    }
+    snprintf(out_name, DDIAL_MAX_HANDLE_LEN, "%s", request.name);
+    pthread_mutex_unlock(&g_ddial_hub_key_lock);
+    return DDIAL_HUB_REQUEST_OK;
+}
+
 /* Id of the key matching candidate, or 0. Every key is checked so the time
  * taken does not reveal which one matched. */
 static unsigned ddial_hub_key_match(host_t *host, const char *candidate,
@@ -984,6 +1301,26 @@ static void *ddial_hub_station_thread(void *arg)
                 break;
             }
             trim_whitespace_inplace(key);
+            if (strncasecmp(key, "@request:", 9U) == 0) {
+                unsigned request_id = 0U;
+                bool recorded = host_ddial_hub_request_register(
+                    host, key + 9, st->ip, &request_id);
+                memset(key, 0, sizeof(key));
+                if (!recorded) {
+                    ddial_hub_write_text(
+                        st->fd, "\r\nCould not record station link request.\r\n");
+                    break;
+                }
+                char response[128];
+                snprintf(response, sizeof(response),
+                         "\r\nStation link request #%u recorded; wait for "
+                         "operator approval.\r\n",
+                         request_id);
+                ddial_hub_write_text(st->fd, response);
+                printf("[ddial-hub] station request #%u recorded from %s\n",
+                       request_id, st->ip);
+                break;
+            }
             char label[DDIAL_MAX_HANDLE_LEN] = "";
             unsigned key_id = ddial_hub_key_match(host, key, label,
                                                   sizeof(label));
diff --git a/src/host/runtime/user_commands.c b/src/host/runtime/user_commands.c
index fca3ec9..659aa01 100644
--- a/src/host/runtime/user_commands.c
+++ b/src/host/runtime/user_commands.c
@@ -1070,7 +1070,7 @@ static void session_handle_ddial(session_ctx_t *ctx, const char *arguments)
                  relay->port);
         session_send_system_line(ctx, status);
         session_send_system_line(
-            ctx, "Usage: /ddial <connect <host> <port> [handle] [password]|raw <c-string>|reconnect|disconnect|status|key|hub>");
+            ctx, "Usage: /ddial <connect <host> <port> [handle] [password]|raw <c-string>|reconnect|disconnect|status|key|hub|requests|approve <request-id>|deny <request-id>>");
         return;
     }
 
@@ -1088,11 +1088,15 @@ static void session_handle_ddial(session_ctx_t *ctx, const char *arguments)
         return;
     }
 
-    /* Station hub: keys that let other stations link to this one. */
-    if (strcasecmp(action, "key") == 0 || strcasecmp(action, "hub") == 0) {
+    /* Station hub: requests and keys for inbound station links. */
+    if (strcasecmp(action, "key") == 0 || strcasecmp(action, "hub") == 0 ||
+        strcasecmp(action, "requests") == 0 ||
+        strcasecmp(action, "approve") == 0 ||
+        strcasecmp(action, "deny") == 0) {
         if (!ctx->user.is_operator) {
-            session_send_system_line(ctx, "Only operators can manage DDial "
-                                          "station links.");
+            session_send_system_line(
+                ctx, session_command_localize(
+                         ctx, "Only operators can manage DDial station links."));
             return;
         }
         if (strcasecmp(action, "hub") == 0) {
@@ -1113,6 +1117,89 @@ static void session_handle_ddial(session_ctx_t *ctx, const char *arguments)
             }
             return;
         }
+        if (strcasecmp(action, "requests") == 0) {
+            char listing[SSH_CHATTER_MESSAGE_LIMIT * 2U];
+            size_t count = host_ddial_hub_request_list(ctx->owner, listing,
+                                                       sizeof(listing));
+            if (count == 0U) {
+                session_send_system_line(
+                    ctx, session_command_localize(
+                             ctx, "No pending station requests."));
+            } else {
+                session_send_system_line(
+                    ctx, session_command_localize(
+                             ctx, "Pending station requests:"));
+                session_send_system_line(ctx, listing);
+            }
+            return;
+        }
+        if (strcasecmp(action, "approve") == 0 ||
+            strcasecmp(action, "deny") == 0) {
+            const bool approving = strcasecmp(action, "approve") == 0;
+            char id_text[16];
+            (void)session_consume_token(rest, id_text, sizeof(id_text));
+            const char *digits = id_text[0] == '#' ? id_text + 1 : id_text;
+            char *end = nullptr;
+            unsigned long id = strtoul(digits, &end, 10);
+            if (digits[0] == '\0' || end == nullptr || *end != '\0' ||
+                id == 0UL || id > UINT_MAX) {
+                session_send_system_line(
+                    ctx, session_command_localize(
+                             ctx, approving
+                                      ? "Usage: /ddial approve <request-id>"
+                                      : "Usage: /ddial deny <request-id>"));
+                return;
+            }
+
+            if (approving) {
+                char name[DDIAL_MAX_HANDLE_LEN];
+                char key[DDIAL_STATION_KEY_LEN + 1U];
+                unsigned key_id = 0U;
+                ddial_hub_request_result_t result =
+                    host_ddial_hub_request_approve(ctx->owner, (unsigned)id,
+                                                   name, key, &key_id);
+                if (result == DDIAL_HUB_REQUEST_NOT_FOUND) {
+                    session_send_system_line(
+                        ctx, session_command_localize(
+                                 ctx, "No station request with that id."));
+                    return;
+                }
+                if (result != DDIAL_HUB_REQUEST_OK) {
+                    session_send_system_line(
+                        ctx, session_command_localize(
+                                 ctx, "Could not approve station request."));
+                    return;
+                }
+                char line[SSH_CHATTER_MESSAGE_LIMIT];
+                session_command_snprintf(
+                    ctx, line, sizeof(line),
+                    "Station request #%u approved. Station key #%u for '%s': "
+                    "%s (shown once; give it to that station's operator)",
+                    (unsigned)id, key_id, name, key);
+                session_send_system_line(ctx, line);
+                memset(key, 0, sizeof(key));
+                return;
+            }
+
+            ddial_hub_request_result_t result =
+                host_ddial_hub_request_deny(ctx->owner, (unsigned)id);
+            if (result == DDIAL_HUB_REQUEST_NOT_FOUND) {
+                session_send_system_line(
+                    ctx, session_command_localize(
+                             ctx, "No station request with that id."));
+            } else if (result != DDIAL_HUB_REQUEST_OK) {
+                session_send_system_line(
+                    ctx, session_command_localize(
+                             ctx, "Could not deny station request."));
+            } else {
+                char line[SSH_CHATTER_MESSAGE_LIMIT];
+                session_command_snprintf(ctx, line, sizeof(line),
+                                         "Station request #%u denied.",
+                                         (unsigned)id);
+                session_send_system_line(ctx, line);
+            }
+            return;
+        }
 
         char sub[16];
         const char *key_rest = session_consume_token(rest, sub, sizeof(sub));
@@ -1313,7 +1400,7 @@ static void session_handle_ddial(session_ctx_t *ctx, const char *arguments)
 
     session_send_system_line(ctx, "Unknown /ddial subcommand.");
     session_send_system_line(
-        ctx, "Usage: /ddial <connect <host> <port> [handle] [password]|raw <c-string>|reconnect|disconnect|status>");
+        ctx, "Usage: /ddial <connect <host> <port> [handle] [password]|raw <c-string>|reconnect|disconnect|status|key|hub|requests|approve <request-id>|deny <request-id>>");
 }
 
 void session_handle_ddial_slash(session_ctx_t *ctx, const char *line)
diff --git a/tests/unit/test_ddial_hub.c b/tests/unit/test_ddial_hub.c
index 3483672..10f8875 100644
--- a/tests/unit/test_ddial_hub.c
+++ b/tests/unit/test_ddial_hub.c
@@ -278,7 +278,8 @@ TEST(rebuild_is_idempotent)
     CHECK_EQ(reply_count_for(parent.message_id), 1);
 }
 
-static bool command_output(const char *command, char *output, size_t output_cap)
+static bool command_output_as(const char *command, bool is_operator,
+                              char *output, size_t output_cap)
 {
     if (command == NULL || output == NULL || output_cap == 0U) {
         return false;
@@ -294,6 +295,7 @@ static bool command_output(const char *command, char *output, size_t output_cap)
     ctx.transport_kind = SESSION_TRANSPORT_TELNET;
     ctx.telnet_fd = pipefd[1];
     ctx.owner = g_host;
+    ctx.user.is_operator = is_operator;
     ctx.terminal_width = 80;
     ctx.terminal_height = 24;
     session_dispatch_command(&ctx, command);
@@ -316,6 +318,11 @@ static bool command_output(const char *command, char *output, size_t output_cap)
     return true;
 }
 
+static bool command_output(const char *command, char *output, size_t output_cap)
+{
+    return command_output_as(command, false, output, output_cap);
+}
+
 TEST(thread_command_shows_mixed_nested_tree_from_message_or_reply)
 {
     chat_history_entry_t root =
@@ -519,6 +526,105 @@ TEST(station_key_create_match_revoke)
     CHECK(host_ddial_hub_key_revoke(g_host, next_id));
 }
 
+TEST(station_request_workflow_persists_and_manages_requests)
+{
+    char output[16384];
+    CHECK(command_output("/ddial requests", output, sizeof(output)));
+    CHECK(strstr(output, "Only operators can manage DDial station links.") !=
+          NULL);
+
+    unsigned approve_id = 0U;
+    unsigned duplicate_id = 0U;
+    unsigned deny_id = 0U;
+    CHECK(host_ddial_hub_request_register(g_host, "ApprovalTarget",
+                                          "192.0.2.101", &approve_id));
+    CHECK(host_ddial_hub_request_register(g_host, "approvaltarget",
+                                          "192.0.2.101", &duplicate_id));
+    CHECK_EQ(duplicate_id, approve_id);
+    CHECK(host_ddial_hub_request_register(g_host, "DenyTarget", "192.0.2.102",
+                                          &deny_id));
+    CHECK(deny_id != approve_id);
+
+    CHECK(command_output_as("/ddial requests", true, output, sizeof(output)));
+    CHECK(strstr(output, "Pending station requests:") != NULL);
+    CHECK(strstr(output, "ApprovalTarget [192.0.2.101]") != NULL);
+    CHECK(strstr(output, "DenyTarget [192.0.2.102]") != NULL);
+
+    char path[PATH_MAX];
+    snprintf(path, sizeof(path), "%s/ddial_station_requests.dat", g_dir);
+    struct stat st;
+    CHECK_EQ(stat(path, &st), 0);
+    CHECK_EQ(st.st_mode & 0777, 0600);
+    FILE *fp = fopen(path, "r");
+    CHECK(fp != NULL);
+    char contents[4096] = {0};
+    size_t n = fread(contents, 1U, sizeof(contents) - 1U, fp);
+    fclose(fp);
+    contents[n] = '\0';
+    CHECK(strstr(contents, "ApprovalTarget") != NULL);
+    CHECK(strstr(contents, "DenyTarget") != NULL);
+
+    pthread_mutex_lock(&g_ddial_hub_key_lock);
+    memset(g_ddial_hub_requests, 0, sizeof(g_ddial_hub_requests));
+    g_ddial_hub_request_count = 0U;
+    g_ddial_hub_next_request_id = 1U;
+    g_ddial_hub_requests_loaded = false;
+    g_ddial_hub_request_path[0] = '\0';
+    pthread_mutex_unlock(&g_ddial_hub_key_lock);
+
+    char listing[4096];
+    CHECK_EQ(host_ddial_hub_request_list(g_host, listing, sizeof(listing)), 2U);
+    CHECK(strstr(listing, "ApprovalTarget") != NULL);
+    CHECK(strstr(listing, "DenyTarget") != NULL);
+
+    char command[64];
+    snprintf(command, sizeof(command), "/ddial approve %u", approve_id);
+    CHECK(command_output_as(command, true, output, sizeof(output)));
+    char *approved = strstr(output, "Station request #");
+    CHECK(approved != NULL);
+    unsigned parsed_request_id = 0U;
+    unsigned key_id = 0U;
+    char name[DDIAL_MAX_HANDLE_LEN] = {0};
+    char key[16] = {0};
+    CHECK_EQ(sscanf(approved,
+                    "Station request #%u approved. Station key #%u for "
+                    "'%31[^']': %15s",
+                    &parsed_request_id, &key_id, name, key),
+             4);
+    CHECK_EQ(parsed_request_id, approve_id);
+    CHECK_STR_EQ(name, "ApprovalTarget");
+    CHECK(ddial_station_key_is_wellformed(key));
+    CHECK_EQ(ddial_hub_key_match(g_host, key, NULL, 0U), key_id);
+
+    CHECK_EQ(host_ddial_hub_request_list(g_host, listing, sizeof(listing)), 1U);
+    CHECK(strstr(listing, "ApprovalTarget") == NULL);
+    CHECK(strstr(listing, "DenyTarget") != NULL);
+
+    snprintf(command, sizeof(command), "/ddial deny #%u", deny_id);
+    CHECK(command_output_as(command, true, output, sizeof(output)));
+    char expected[128];
+    snprintf(expected, sizeof(expected), "Station request #%u denied.", deny_id);
+    CHECK(strstr(output, expected) != NULL);
+    CHECK(command_output_as("/ddial requests", true, output, sizeof(output)));
+    CHECK(strstr(output, "No pending station requests.") != NULL);
+
+    CHECK(command_output_as("/ddial approve nope", true, output,
+                            sizeof(output)));
+    CHECK(strstr(output, "Usage: /ddial approve <request-id>") != NULL);
+    CHECK(command_output_as("/ddial deny 9999", true, output, sizeof(output)));
+    CHECK(strstr(output, "No station request with that id.") != NULL);
+
+    fp = fopen(path, "r");
+    CHECK(fp != NULL);
+    memset(contents, 0, sizeof(contents));
+    n = fread(contents, 1U, sizeof(contents) - 1U, fp);
+    fclose(fp);
+    contents[n] = '\0';
+    CHECK(strstr(contents, "ApprovalTarget") == NULL);
+    CHECK(strstr(contents, "DenyTarget") == NULL);
+    memset(key, 0, sizeof(key));
+}
+
 TEST(failed_logins_block_an_address)
 {
     const char *ip = "192.0.2.77";
@@ -612,6 +718,26 @@ TEST(station_links_with_key_and_relays_chat)
     setenv("CHATTER_DDIAL_STATION", "TestHub", 1);
     host_ddial_hub_start(g_host);
 
+    int request_fd = connect_loopback(port);
+    CHECK(request_fd >= 0);
+    char request_buf[1024] = {0};
+    CHECK(read_until(request_fd, "Enter Password", request_buf,
+                     sizeof(request_buf), 3000));
+    ddial_hub_write_text(request_fd, "@request:WireRequest\r\n");
+    request_buf[0] = '\0';
+    CHECK(read_until(request_fd, "Station link request #", request_buf,
+                     sizeof(request_buf), 3000));
+    close(request_fd);
+    char request_listing[1024];
+    CHECK_EQ(host_ddial_hub_request_list(g_host, request_listing,
+                                         sizeof(request_listing)),
+             1U);
+    CHECK(strstr(request_listing, "WireRequest [127.0.0.1]") != NULL);
+    unsigned request_id = 0U;
+    CHECK_EQ(sscanf(request_listing, "#%u", &request_id), 1);
+    CHECK_EQ(host_ddial_hub_request_deny(g_host, request_id),
+             DDIAL_HUB_REQUEST_OK);
+
     char key[DDIAL_STATION_KEY_LEN + 1U];
     unsigned id = 0U;
     CHECK(host_ddial_hub_key_create(g_host, "Linker", key, &id));
@@ -843,6 +969,10 @@ static void remove_dir_files(const char *dir)
     unlink(path);
     snprintf(path, sizeof(path), "%s/ddial_station_keys.tsv.tmp", dir);
     unlink(path);
+    snprintf(path, sizeof(path), "%s/ddial_station_requests.dat", dir);
+    unlink(path);
+    snprintf(path, sizeof(path), "%s/ddial_station_requests.dat.tmp", dir);
+    unlink(path);
     rmdir(dir);
 }
 
@@ -869,6 +999,7 @@ int main(void)
     RUN_TEST(thread_command_rejects_bad_targets_without_mutation);
     RUN_TEST(full_reply_table_drops_the_oldest);
     RUN_TEST(station_key_create_match_revoke);
+    RUN_TEST(station_request_workflow_persists_and_manages_requests);
     RUN_TEST(failed_logins_block_an_address);
     RUN_TEST(station_links_with_key_and_relays_chat);
     RUN_TEST(scrollback_entry_visibility_check);