diff --git a/internal/api/server.go b/internal/api/server.go
index 5c0e2b2..2342e7f 100644
--- a/internal/api/server.go
+++ b/internal/api/server.go
@@ -12,6 +12,7 @@ import (
 	"mime"
 	"net"
 	"net/http"
+	"net/http/pprof"
 	"net/url"
 	"os"
 	"os/exec"
@@ -148,6 +149,11 @@ func New(cfg *config.Config, sessions *auth.Sessions, mgr *term.Manager, col *me
 	m.HandleFunc("POST /api/password", s.auth(s.changePassword))
 	m.HandleFunc("GET /api/prefs/ui", s.auth(s.getUIPrefs))
 	m.HandleFunc("PUT /api/prefs/ui", s.auth(s.putUIPrefs))
+	// Go runtime profiles, behind the login, for chasing memory/CPU (bug 14).
+	m.Handle("/api/debug/pprof/", s.auth(func(w http.ResponseWriter, r *http.Request) {
+		r.URL.Path = strings.TrimPrefix(r.URL.Path, "/api")
+		pprof.Index(w, r)
+	}))
 	m.HandleFunc("GET /api/prefs/dashboard", s.auth(s.getDashPrefs))
 	m.HandleFunc("PUT /api/prefs/dashboard", s.auth(s.putDashPrefs))
 	m.HandleFunc("/api/", func(w http.ResponseWriter, _ *http.Request) { jsonErr(w, 404, "not found") })