diff --git a/app/Providers/AuthServiceProvider.php b/app/Providers/AuthServiceProvider.php
index 7de25b357..285c61adb 100644
--- a/app/Providers/AuthServiceProvider.php
+++ b/app/Providers/AuthServiceProvider.php
@@ -27,7 +27,7 @@ class AuthServiceProvider extends ServiceProvider
         $this->registerPolicies();
 
         if(config('pixelfed.oauth_enabled')) {
-            Passport::routes(null, ['middleware' => [ \Barryvdh\Cors\HandleCors::class ]]);
+            Passport::routes(null, ['middleware' => ['twofactor','validemail',\Barryvdh\Cors\HandleCors::class]]);
             Passport::tokensExpireIn(now()->addDays(15));
             Passport::refreshTokensExpireIn(now()->addDays(30));
             Passport::enableImplicitGrant();