diff --git a/apps/api/src/routes/reviewRoutes.js b/apps/api/src/routes/reviewRoutes.js
index ec9556a6ebf..4ef8560166f 100644
--- a/apps/api/src/routes/reviewRoutes.js
+++ b/apps/api/src/routes/reviewRoutes.js
@@ -1,7 +1,8 @@
 import { Router } from "express";
+import { authMiddleware } from "../middleware/auth.js";
 import { getReviews, postReview } from "../controllers/reviewController.js";
 
 export const reviewRoutes = Router();
 
-reviewRoutes.get("/", getReviews);
-reviewRoutes.post("/", postReview);
+reviewRoutes.get("/", authMiddleware, getReviews);
+reviewRoutes.post("/", authMiddleware, postReview);
diff --git a/apps/api/src/routes/userRoutes.js b/apps/api/src/routes/userRoutes.js
index f1ef183b1bc..6e09998e6b6 100644
--- a/apps/api/src/routes/userRoutes.js
+++ b/apps/api/src/routes/userRoutes.js
@@ -1,7 +1,8 @@
 import { Router } from "express";
+import { authMiddleware } from "../middleware/auth.js";
 import { getUsers, postUser } from "../controllers/userController.js";
 
 export const userRoutes = Router();
 
-userRoutes.get("/", getUsers);
-userRoutes.post("/", postUser);
+userRoutes.get("/", authMiddleware, getUsers);
+userRoutes.post("/", authMiddleware, postUser);
diff --git a/apps/api/src/tests/reviewRoutes.test.js b/apps/api/src/tests/reviewRoutes.test.js
new file mode 100644
index 00000000000..a3c0fcb2258
--- /dev/null
+++ b/apps/api/src/tests/reviewRoutes.test.js
@@ -0,0 +1,47 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createApp } from "../app.js";
+import { signAccessToken } from "../utils/jwt.js";
+
+function withServer(run) {
+  const app = createApp();
+  const server = app.listen(0);
+  return new Promise((resolve, reject) => {
+    server.once("listening", async () => {
+      const { port } = server.address();
+      const base = `http://127.0.0.1:${port}`;
+      try {
+        await run(base);
+      } finally {
+        await new Promise((res2, rej2) => server.close((e) => (e ? rej2(e) : res2())));
+      }
+      resolve();
+    });
+    server.once("error", reject);
+  });
+}
+
+test("POST /api/reviews without token returns 401", async () => {
+  await withServer(async (base) => {
+    const response = await fetch(`${base}/api/reviews`, { method: "POST" });
+    assert.equal(response.status, 401);
+  });
+});
+
+test("GET /api/reviews without token returns 401", async () => {
+  await withServer(async (base) => {
+    const response = await fetch(`${base}/api/reviews`);
+    assert.equal(response.status, 401);
+  });
+});
+
+test("POST /api/reviews with valid token does not 401", async () => {
+  await withServer(async (base) => {
+    const token = signAccessToken({ id: "usr_test", role: "client" });
+    const response = await fetch(`${base}/api/reviews`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    assert.notEqual(response.status, 401);
+  });
+});
\ No newline at end of file
diff --git a/apps/api/src/tests/userRoutes.test.js b/apps/api/src/tests/userRoutes.test.js
new file mode 100644
index 00000000000..2183b62d3a7
--- /dev/null
+++ b/apps/api/src/tests/userRoutes.test.js
@@ -0,0 +1,47 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createApp } from "../app.js";
+import { signAccessToken } from "../utils/jwt.js";
+
+function withServer(run) {
+  const app = createApp();
+  const server = app.listen(0);
+  return new Promise((resolve, reject) => {
+    server.once("listening", async () => {
+      const { port } = server.address();
+      const base = `http://127.0.0.1:${port}`;
+      try {
+        await run(base);
+      } finally {
+        await new Promise((res2, rej2) => server.close((e) => (e ? rej2(e) : res2())));
+      }
+      resolve();
+    });
+    server.once("error", reject);
+  });
+}
+
+test("POST /api/users without token returns 401", async () => {
+  await withServer(async (base) => {
+    const response = await fetch(`${base}/api/users`, { method: "POST" });
+    assert.equal(response.status, 401);
+  });
+});
+
+test("GET /api/users without token returns 401", async () => {
+  await withServer(async (base) => {
+    const response = await fetch(`${base}/api/users`);
+    assert.equal(response.status, 401);
+  });
+});
+
+test("POST /api/users with valid token does not 401", async () => {
+  await withServer(async (base) => {
+    const token = signAccessToken({ id: "usr_test", role: "client" });
+    const response = await fetch(`${base}/api/users`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    assert.notEqual(response.status, 401);
+  });
+});
\ No newline at end of file