diff --git a/services/mam-api/src/routes/tokens.js b/services/mam-api/src/routes/tokens.js
index ba1bb35..75fe371 100644
--- a/services/mam-api/src/routes/tokens.js
+++ b/services/mam-api/src/routes/tokens.js
@@ -8,8 +8,10 @@
 import express from 'express';
 import crypto  from 'crypto';
 import pool    from '../db/pool.js';
+import { requireAuth } from '../middleware/auth.js';
 
 const router = express.Router();
+router.use(requireAuth);
 
 // Helper: get current user ID from session or req.user
 const userId = req => req.user?.id || req.session?.userId;