diff --git a/src/fontra/core/server.py b/src/fontra/core/server.py
index 792555840..77db33f02 100644
--- a/src/fontra/core/server.py
+++ b/src/fontra/core/server.py
@@ -208,6 +208,10 @@ async def serverInfoHandler(self, request: web.Request) -> web.Response:
         )
 
     async def webAPIHandler(self, request: web.Request) -> web.Response:
+        authToken = await self.projectManager.authorize(request)
+        if not authToken:
+            raise web.HTTPUnauthorized()
+
         functionName = request.match_info["function"]
         function = apiFunctions.get(functionName)
         if function is None: