diff --git a/apps/api/internal/api/api.go b/apps/api/internal/api/api.go
index 5dcf3d28..a4f97014 100644
--- a/apps/api/internal/api/api.go
+++ b/apps/api/internal/api/api.go
@@ -119,9 +119,11 @@ func (api *API) setupRoutes(mw *mw.Middleware) {
 		// Event-specific routes
 		r.Route("/{eventId}", func(r chi.Router) {
 
+			r.Post("/interest", api.Handlers.EventInterest.AddEmailToEvent)
+
 			// General access
+			r.Use(mw.Auth.RequireAuth) // routes below this are protected
 			r.Get("/", api.Handlers.Event.GetEventByID)
-			r.Post("/interest", api.Handlers.EventInterest.AddEmailToEvent)
 			r.Get("/role", api.Handlers.Event.GetEventRole)
 
 			// Admin-only