diff --git a/routes/web.php b/routes/web.php
index 6537a6423..f3f31a9f2 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -116,7 +116,7 @@ Route::domain(config('pixelfed.domain.app'))->middleware(['validemail', 'twofact
             Route::post('accounts/{id}/unmute', 'Api\ApiV1Controller@accountUnmuteById')->middleware('auth:api');
             Route::get('notifications', 'Api\ApiV1Controller@accountNotifications')->middleware('auth:api');
             
-            Route::get('timelines/home', 'Api\ApiV1Controller@timelineHome');
+            Route::get('timelines/home', 'Api\ApiV1Controller@timelineHome')->middleware('auth:api');
 
             // Route::get('likes', 'ApiController@hydrateLikes');
             // Route::post('media', 'ApiController@uploadMedia')->middleware('auth:api');
@@ -124,7 +124,7 @@ Route::domain(config('pixelfed.domain.app'))->middleware(['validemail', 'twofact
             // Route::get('notifications', 'ApiController@notifications')->middleware('auth:api');
             // Route::get('timelines/public', 'PublicApiController@publicTimelineApi');
             // Route::post('status', 'Api\ApiV1Controller@createStatus')->middleware('auth:api');
-            Route::get('accounts/{id}', 'Api\ApiV1Controller@accountById');
+            Route::get('accounts/{id}', 'Api\ApiV1Controller@accountById')->middleware('auth:api');
         });
         Route::group(['prefix' => 'v2'], function() {
             Route::get('config', 'ApiController@siteConfiguration');