diff --git a/backend/app/Http/Middleware/Authenticate.php b/backend/app/Http/Middleware/Authenticate.php
new file mode 100644
index 0000000..fce1f24
--- /dev/null
+++ b/backend/app/Http/Middleware/Authenticate.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Auth\Middleware\Authenticate as Middleware;
+use Illuminate\Http\Request;
+
+class Authenticate extends Middleware
+{
+    /**
+     * API-only project — never redirect, always return null so Laravel
+     * responds with a 401 JSON response instead of looking for a "login" route.
+     */
+    protected function redirectTo(Request $request): ?string
+    {
+        return null;
+    }
+}
diff --git a/backend/bootstrap/app.php b/backend/bootstrap/app.php
index 30d5b54..97de047 100644
--- a/backend/bootstrap/app.php
+++ b/backend/bootstrap/app.php
@@ -14,9 +14,10 @@ return Application::configure(basePath: dirname(__DIR__))
     )
     ->withMiddleware(function (Middleware $middleware): void {
         $middleware->alias([
-            'store' => \App\Http\Middleware\StoreIsolation::class,
+            'auth'       => \App\Http\Middleware\Authenticate::class,
+            'store'      => \App\Http\Middleware\StoreIsolation::class,
             'permission' => \App\Http\Middleware\CheckPermission::class,
-            'oplog' => \App\Http\Middleware\OperationLog::class,
+            'oplog'      => \App\Http\Middleware\OperationLog::class,
         ]);
 
         // Removed statefulApi() — app uses Bearer token auth, not cookie SPA auth