diff --git a/OATHAuth.hooks.php b/OATHAuth.hooks.php
index 87182242..365c5891 100644
--- a/OATHAuth.hooks.php
+++ b/OATHAuth.hooks.php
@@ -22,7 +22,14 @@ class OATHAuthHooks {
 
 		if ( $service == null ) {
 			$factory = MediaWikiServices::getInstance()->getDBLoadBalancerFactory();
-			$service = new OATHUserRepository( $factory->getMainLB( $wgOATHAuthDatabase ) );
+			$service = new OATHUserRepository(
+				$factory->getMainLB( $wgOATHAuthDatabase ),
+				new HashBagOStuff(
+					[
+						'maxKeys' => 5,
+					]
+				)
+			);
 		}
 
 		return $service;
diff --git a/OATHUser.php b/OATHUser.php
index 10a63127..8290e103 100644
--- a/OATHUser.php
+++ b/OATHUser.php
@@ -13,6 +13,7 @@ class OATHUser {
 	private $key;
 
 	/**
+	 * Constructor. Can't be called directly. Use OATHUserRepository::findByUser instead.
 	 * @param User $user
 	 * @param OATHAuthKey $key
 	 */
diff --git a/OATHUserRepository.php b/OATHUserRepository.php
index 81851871..6f68d129 100644
--- a/OATHUserRepository.php
+++ b/OATHUserRepository.php
@@ -4,12 +4,17 @@ class OATHUserRepository {
 	/** @var LoadBalancer */
 	protected $lb;
 
+	/** @var BagOStuff */
+	protected $cache;
+
 	/**
 	 * OATHUserRepository constructor.
 	 * @param LoadBalancer $lb
+	 * @param BagOStuff $cache
 	 */
-	public function __construct( LoadBalancer $lb ) {
+	public function __construct( LoadBalancer $lb, BagOStuff $cache ) {
 		$this->lb = $lb;
+		$this->cache = $cache;
 	}
 
 	/**
@@ -17,16 +22,24 @@ class OATHUserRepository {
 	 * @return OATHUser
 	 */
 	public function findByUser( User $user ) {
-		$oathUser = new OATHUser( $user, null );
+		$oathUser = $this->cache->get( $user->getName() );
+		if ( !$oathUser ) {
+			$oathUser = new OATHUser( $user, null );
 
-		$uid = CentralIdLookup::factory()->centralIdFromLocalUser( $user );
-		$res = $this->getDB( DB_SLAVE )
-			->selectRow( 'oathauth_users', '*', [ 'id' => $uid ], __METHOD__ );
-		if ( $res ) {
-			$key = new OATHAuthKey( $res->secret, explode( ',', $res->scratch_tokens ) );
-			$oathUser->setKey( $key );
+			$uid = CentralIdLookup::factory()->centralIdFromLocalUser( $user );
+			$res = $this->getDB( DB_SLAVE )->selectRow(
+				'oathauth_users',
+				'*',
+				[ 'id' => $uid ],
+				__METHOD__
+			);
+			if ( $res ) {
+				$key = new OATHAuthKey( $res->secret, explode( ',', $res->scratch_tokens ) );
+				$oathUser->setKey( $key );
+			}
+
+			$this->cache->set( $user->getName(), $oathUser );
 		}
-
 		return $oathUser;
 	}
 
@@ -44,6 +57,7 @@ class OATHUserRepository {
 			],
 			__METHOD__
 		);
+		$this->cache->set( $user->getUser()->getName(), $user );
 	}
 
 	/**
@@ -55,6 +69,7 @@ class OATHUserRepository {
 			[ 'id' => CentralIdLookup::factory()->centralIdFromLocalUser( $user->getUser() ) ],
 			__METHOD__
 		);
+		$this->cache->delete( $user->getUser()->getName() );
 	}
 
 	/**