diff --git a/src/Simplex/Messaging/Agent/Client.hs b/src/Simplex/Messaging/Agent/Client.hs
index 329ebbb34..476ba4b56 100644
--- a/src/Simplex/Messaging/Agent/Client.hs
+++ b/src/Simplex/Messaging/Agent/Client.hs
@@ -52,7 +52,7 @@ module Simplex.Messaging.Agent.Client
     logServer,
     removeSubscription,
     hasActiveSubscription,
-    agentDbPath,
+    agentStore,
     AgentOperation (..),
     AgentOpState (..),
     AgentState (..),
@@ -227,8 +227,8 @@ newAgentClient InitialAgentServers {smp, ntf, netCfg} agentEnv = do
   lock <- newTMVar ()
   return AgentClient {active, rcvQ, subQ, msgQ, smpServers, smpClients, ntfServers, ntfClients, useNetworkConfig, subscrSrvrs, pendingSubscrSrvrs, subscrConns, activeSubscrConns, connMsgsQueued, smpQueueMsgQueues, smpQueueMsgDeliveries, ntfNetworkOp, rcvNetworkOp, msgDeliveryOp, sndNetworkOp, databaseOp, agentState, getMsgLocks, reconnections, asyncClients, clientId, agentEnv, lock}
 
-agentDbPath :: AgentClient -> FilePath
-agentDbPath AgentClient {agentEnv = Env {store = SQLiteStore {dbFilePath}}} = dbFilePath
+agentStore :: AgentClient -> SQLiteStore
+agentStore AgentClient {agentEnv = Env {store}} = store
 
 class ProtocolServerClient msg where
   getProtocolServerClient :: AgentMonad m => AgentClient -> ProtoServer msg -> m (ProtocolClient msg)
diff --git a/src/Simplex/Messaging/Agent/Store/SQLite.hs b/src/Simplex/Messaging/Agent/Store/SQLite.hs
index a3e1aa10a..d8af7226b 100644
--- a/src/Simplex/Messaging/Agent/Store/SQLite.hs
+++ b/src/Simplex/Messaging/Agent/Store/SQLite.hs
@@ -22,6 +22,7 @@ module Simplex.Messaging.Agent.Store.SQLite
   ( SQLiteStore (..),
     createSQLiteStore,
     connectSQLiteStore,
+    sqlString,
 
     -- * Queues and connections
     createRcvConn,
@@ -148,6 +149,7 @@ import UnliftIO.STM
 
 data SQLiteStore = SQLiteStore
   { dbFilePath :: FilePath,
+    dbKey :: String,
     dbConnection :: TMVar DB.Connection,
     dbNew :: Bool
   }
@@ -196,14 +198,13 @@ connectSQLiteStore :: FilePath -> String -> IO SQLiteStore
 connectSQLiteStore dbFilePath dbKey = do
   dbNew <- not <$> doesFileExist dbFilePath
   dbConnection <- newTMVarIO =<< connectDB dbFilePath dbKey
-  pure SQLiteStore {dbFilePath, dbConnection, dbNew}
+  pure SQLiteStore {dbFilePath, dbKey, dbConnection, dbNew}
 
 connectDB :: FilePath -> String -> IO DB.Connection
 connectDB path key = do
   db <- DB.open path
   let exec = SQLite3.exec $ DB.connectionHandle db
-  -- TODO escape key
-  unless (null key) . exec $ "PRAGMA key = '" <> T.pack key <> "';"
+  unless (null key) . exec $ "PRAGMA key = " <> sqlString key <> ";"
   exec . fromQuery $
     [sql|
       PRAGMA foreign_keys = ON;
@@ -214,6 +215,11 @@ connectDB path key = do
   -- _printPragmas db path
   pure db
 
+sqlString :: String -> Text
+sqlString s = quote <> T.replace quote "''" (T.pack s) <> quote
+  where
+    quote = "'"
+
 -- _printPragmas :: DB.Connection -> FilePath -> IO ()
 -- _printPragmas db path = do
 --   foreign_keys <- DB.query_ db "PRAGMA foreign_keys;" :: IO [[Int]]