diff --git a/crm/auth.go b/crm/auth.go
new file mode 100644
index 000000000..44a449df7
--- /dev/null
+++ b/crm/auth.go
@@ -0,0 +1,19 @@
+package crm
+
+import (
+	"net/http"
+)
+
+var pass = func(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (*ModuleHandlers) Authenticator() func(http.Handler) http.Handler {
+	return pass
+}
+
+func (*TypesHandlers) Authenticator() func(http.Handler) http.Handler {
+	return pass
+}
diff --git a/crm/module.interfaces.go b/crm/module.interfaces.go
index dc966f21e..ed20a75dd 100644
--- a/crm/module.interfaces.go
+++ b/crm/module.interfaces.go
@@ -46,6 +46,9 @@ type ModuleHandlersAPI interface {
 	ContentList(http.ResponseWriter, *http.Request)
 	ContentEdit(http.ResponseWriter, *http.Request)
 	ContentDelete(http.ResponseWriter, *http.Request)
+
+	// Authenticate API requests
+	Authenticator() func(http.Handler) http.Handler
 }
 
 // Compile time check to see if we implement the interfaces
diff --git a/crm/routes.go b/crm/routes.go
index ee4e08a7c..e0197f1df 100644
--- a/crm/routes.go
+++ b/crm/routes.go
@@ -25,16 +25,22 @@ import (
 func MountRoutes(r chi.Router) {
 	module := ModuleHandlers{}.new()
 	types := TypesHandlers{}.new()
-	r.Route("/module", func(r chi.Router) {
-		r.Get("/list", module.List)
-		r.Post("/edit", module.Edit)
-		r.Get("/content/list", module.ContentList)
-		r.Post("/content/edit", module.ContentEdit)
-		r.Delete("/content/delete", module.ContentDelete)
+	r.Group(func(r chi.Router) {
+		r.Use(module.Authenticator())
+		r.Route("/module", func(r chi.Router) {
+			r.Get("/list", module.List)
+			r.Post("/edit", module.Edit)
+			r.Get("/content/list", module.ContentList)
+			r.Post("/content/edit", module.ContentEdit)
+			r.Delete("/content/delete", module.ContentDelete)
+		})
 	})
-	r.Route("/types", func(r chi.Router) {
-		r.Get("/list", types.List)
-		r.Get("/type/{id}", types.Type)
+	r.Group(func(r chi.Router) {
+		r.Use(types.Authenticator())
+		r.Route("/types", func(r chi.Router) {
+			r.Get("/list", types.List)
+			r.Get("/type/{id}", types.Type)
+		})
 	})
 
 	var printRoutes func(chi.Routes, string, string)
diff --git a/crm/templates/http_interfaces.tpl b/crm/templates/http_interfaces.tpl
index f23cd14f1..dd0fd91a5 100644
--- a/crm/templates/http_interfaces.tpl
+++ b/crm/templates/http_interfaces.tpl
@@ -29,6 +29,9 @@ type {name}HandlersAPI interface {
 {foreach $calls as $call}
 	{call.name|capitalize}(http.ResponseWriter, *http.Request)
 {/foreach}
+
+	// Authenticate API requests
+	Authenticator() func(http.Handler) http.Handler
 }
 
 // Compile time check to see if we implement the interfaces
diff --git a/crm/templates/http_routes.tpl b/crm/templates/http_routes.tpl
index 7690d5e88..de3447ae6 100644
--- a/crm/templates/http_routes.tpl
+++ b/crm/templates/http_routes.tpl
@@ -14,10 +14,13 @@ func MountRoutes(r chi.Router) {
 	{api.interface|strtolower} := {api.interface|capitalize}Handlers{}.new()
 {/foreach}
 {foreach $apis as $api}
-	r.Route("{api.path}", func(r chi.Router) {
+	r.Group(func (r chi.Router) {
+			r.Use({api.interface|strtolower}.Authenticator())
+		r.Route("{api.path}", func(r chi.Router) {
 {foreach $api.apis as $call}
-		r.{eval echo capitalize(strtolower($call.method))}("{call.path}", {api.interface|strtolower}.{call.name|capitalize})
+			r.{eval echo capitalize(strtolower($call.method))}("{call.path}", {api.interface|strtolower}.{call.name|capitalize})
 {/foreach}
+		})
 	})
 {/foreach}
 
diff --git a/crm/types.interfaces.go b/crm/types.interfaces.go
index 2a226d870..b162d5bb5 100644
--- a/crm/types.interfaces.go
+++ b/crm/types.interfaces.go
@@ -40,6 +40,9 @@ type TypesAPI interface {
 type TypesHandlersAPI interface {
 	List(http.ResponseWriter, *http.Request)
 	Type(http.ResponseWriter, *http.Request)
+
+	// Authenticate API requests
+	Authenticator() func(http.Handler) http.Handler
 }
 
 // Compile time check to see if we implement the interfaces