diff --git a/services/mam-api/src/middleware/auth.js b/services/mam-api/src/middleware/auth.js
new file mode 100644
index 0000000..17cf85a
--- /dev/null
+++ b/services/mam-api/src/middleware/auth.js
@@ -0,0 +1,6 @@
+export const requireAuth = (req, res, next) => {
+  if (!req.session || !req.session.userId) {
+    return res.status(401).json({ error: 'Unauthorized' });
+  }
+  next();
+};