diff --git a/apps/api/src/routes/payment-auth.test.js b/apps/api/src/routes/payment-auth.test.js
new file mode 100644
index 00000000000..45ec190b9fb
--- /dev/null
+++ b/apps/api/src/routes/payment-auth.test.js
@@ -0,0 +1,32 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { paymentRoutes } from "./paymentRoutes.js";
+
+test("paymentRoutes applies authMiddleware requiring JWT token", async () => {
+  let middlewareCalled = false;
+  let statusSet = 0;
+
+  const req = { headers: {} };
+  const res = {
+    status(code) {
+      statusSet = code;
+      return this;
+    },
+    json(data) {
+      return this;
+    },
+  };
+
+  const next = () => {
+    middlewareCalled = true;
+  };
+
+  // Find authMiddleware layer in stack
+  const authLayer = paymentRoutes.stack.find((layer) => layer.name === "authMiddleware" || layer.handle?.name === "authMiddleware");
+  assert.ok(authLayer, "paymentRoutes must include authMiddleware layer");
+
+  await authLayer.handle(req, res, next);
+
+  assert.equal(statusSet, 401, "Unauthenticated request to paymentRoutes must return HTTP 401 Unauthorized");
+  assert.equal(middlewareCalled, false, "next() must not be called without valid authorization header");
+});
diff --git a/apps/api/src/routes/paymentRoutes.js b/apps/api/src/routes/paymentRoutes.js
index e6cebed50b2..278cb2c2671 100644
--- a/apps/api/src/routes/paymentRoutes.js
+++ b/apps/api/src/routes/paymentRoutes.js
@@ -1,6 +1,8 @@
 import { Router } from "express";
 import { createPayment } from "../controllers/paymentController.js";
+import { authMiddleware } from "../middleware/auth.js";
 
 export const paymentRoutes = Router();
 
+paymentRoutes.use(authMiddleware);
 paymentRoutes.post("/", createPayment);