diff --git a/sam/auth.go b/sam/auth.go
new file mode 100644
index 000000000..b42ee5741
--- /dev/null
+++ b/sam/auth.go
@@ -0,0 +1,35 @@
+package sam
+
+import (
+	"net/http"
+)
+
+var pass = func(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (*OrganisationHandlers) Authenticator() func(http.Handler) http.Handler {
+	return pass
+}
+
+func (*TeamHandlers) Authenticator() func(http.Handler) http.Handler {
+	return pass
+}
+
+func (*ChannelHandlers) Authenticator() func(http.Handler) http.Handler {
+	return pass
+}
+
+func (*MessageHandlers) Authenticator() func(http.Handler) http.Handler {
+	return pass
+}
+
+func (*UserHandlers) Authenticator() func(http.Handler) http.Handler {
+	return pass
+}
+
+func (*WebsocketHandlers) Authenticator() func(http.Handler) http.Handler {
+	return pass
+}
diff --git a/sam/channel.interfaces.go b/sam/channel.interfaces.go
index b5c229a79..10647110c 100644
--- a/sam/channel.interfaces.go
+++ b/sam/channel.interfaces.go
@@ -46,6 +46,9 @@ type ChannelHandlersAPI interface {
 	Edit(http.ResponseWriter, *http.Request)
 	Read(http.ResponseWriter, *http.Request)
 	Delete(http.ResponseWriter, *http.Request)
+
+	// Authenticate API requests
+	Authenticator() func(http.Handler) http.Handler
 }
 
 // Compile time check to see if we implement the interfaces
diff --git a/sam/message.interfaces.go b/sam/message.interfaces.go
index 68da5cacc..dd7a68f19 100644
--- a/sam/message.interfaces.go
+++ b/sam/message.interfaces.go
@@ -50,6 +50,9 @@ type MessageHandlersAPI interface {
 	Search(http.ResponseWriter, *http.Request)
 	Pin(http.ResponseWriter, *http.Request)
 	Flag(http.ResponseWriter, *http.Request)
+
+	// Authenticate API requests
+	Authenticator() func(http.Handler) http.Handler
 }
 
 // Compile time check to see if we implement the interfaces
diff --git a/sam/organisation.interfaces.go b/sam/organisation.interfaces.go
index 26be9a6cb..9eab9bf87 100644
--- a/sam/organisation.interfaces.go
+++ b/sam/organisation.interfaces.go
@@ -48,6 +48,9 @@ type OrganisationHandlersAPI interface {
 	Remove(http.ResponseWriter, *http.Request)
 	Read(http.ResponseWriter, *http.Request)
 	Archive(http.ResponseWriter, *http.Request)
+
+	// Authenticate API requests
+	Authenticator() func(http.Handler) http.Handler
 }
 
 // Compile time check to see if we implement the interfaces
diff --git a/sam/routes.go b/sam/routes.go
index a4dc4e348..ebb84bf84 100644
--- a/sam/routes.go
+++ b/sam/routes.go
@@ -29,46 +29,64 @@ func MountRoutes(r chi.Router) {
 	team := TeamHandlers{}.new()
 	user := UserHandlers{}.new()
 	websocket := WebsocketHandlers{}.new()
-	r.Route("/channel", func(r chi.Router) {
-		r.Get("/", channel.List)
-		r.Put("/", channel.Create)
-		r.Post("/edit", channel.Edit)
-		r.Get("/read", channel.Read)
-		r.Delete("/delete", channel.Delete)
+	r.Group(func(r chi.Router) {
+		r.Use(channel.Authenticator())
+		r.Route("/channel", func(r chi.Router) {
+			r.Get("/", channel.List)
+			r.Put("/", channel.Create)
+			r.Post("/edit", channel.Edit)
+			r.Get("/read", channel.Read)
+			r.Delete("/delete", channel.Delete)
+		})
 	})
-	r.Route("/message", func(r chi.Router) {
-		r.Post("/edit", message.Edit)
-		r.Put("/attach", message.Attach)
-		r.Delete("/remove", message.Remove)
-		r.Get("/read", message.Read)
-		r.Get("/search", message.Search)
-		r.Post("/pin", message.Pin)
-		r.Post("/flag", message.Flag)
+	r.Group(func(r chi.Router) {
+		r.Use(message.Authenticator())
+		r.Route("/message", func(r chi.Router) {
+			r.Post("/edit", message.Edit)
+			r.Put("/attach", message.Attach)
+			r.Delete("/remove", message.Remove)
+			r.Get("/read", message.Read)
+			r.Get("/search", message.Search)
+			r.Post("/pin", message.Pin)
+			r.Post("/flag", message.Flag)
+		})
 	})
-	r.Route("/organisation", func(r chi.Router) {
-		r.Get("/", organisation.List)
-		r.Put("/", organisation.Create)
-		r.Post("/{id}", organisation.Edit)
-		r.Delete("/{id}", organisation.Remove)
-		r.Get("/{id}", organisation.Read)
-		r.Post("/{id}/archive", organisation.Archive)
+	r.Group(func(r chi.Router) {
+		r.Use(organisation.Authenticator())
+		r.Route("/organisation", func(r chi.Router) {
+			r.Get("/", organisation.List)
+			r.Put("/", organisation.Create)
+			r.Post("/{id}", organisation.Edit)
+			r.Delete("/{id}", organisation.Remove)
+			r.Get("/{id}", organisation.Read)
+			r.Post("/{id}/archive", organisation.Archive)
+		})
 	})
-	r.Route("/team", func(r chi.Router) {
-		r.Get("/", team.List)
-		r.Put("/", team.Create)
-		r.Post("/{id}", team.Edit)
-		r.Get("/{id}", team.Read)
-		r.Delete("/{id}", team.Remove)
-		r.Post("/{id}/archive", team.Archive)
-		r.Post("/{id}/move", team.Move)
-		r.Post("/{id}/merge", team.Merge)
+	r.Group(func(r chi.Router) {
+		r.Use(team.Authenticator())
+		r.Route("/team", func(r chi.Router) {
+			r.Get("/", team.List)
+			r.Put("/", team.Create)
+			r.Post("/{id}", team.Edit)
+			r.Get("/{id}", team.Read)
+			r.Delete("/{id}", team.Remove)
+			r.Post("/{id}/archive", team.Archive)
+			r.Post("/{id}/move", team.Move)
+			r.Post("/{id}/merge", team.Merge)
+		})
 	})
-	r.Route("/user", func(r chi.Router) {
-		r.Post("/login", user.Login)
-		r.Get("/search", user.Search)
+	r.Group(func(r chi.Router) {
+		r.Use(user.Authenticator())
+		r.Route("/user", func(r chi.Router) {
+			r.Post("/login", user.Login)
+			r.Get("/search", user.Search)
+		})
 	})
-	r.Route("/websocket", func(r chi.Router) {
-		r.Get("/client", websocket.Client)
+	r.Group(func(r chi.Router) {
+		r.Use(websocket.Authenticator())
+		r.Route("/websocket", func(r chi.Router) {
+			r.Get("/client", websocket.Client)
+		})
 	})
 
 	var printRoutes func(chi.Routes, string, string)
diff --git a/sam/team.interfaces.go b/sam/team.interfaces.go
index a187eaf97..746590d2c 100644
--- a/sam/team.interfaces.go
+++ b/sam/team.interfaces.go
@@ -52,6 +52,9 @@ type TeamHandlersAPI interface {
 	Archive(http.ResponseWriter, *http.Request)
 	Move(http.ResponseWriter, *http.Request)
 	Merge(http.ResponseWriter, *http.Request)
+
+	// Authenticate API requests
+	Authenticator() func(http.Handler) http.Handler
 }
 
 // Compile time check to see if we implement the interfaces
diff --git a/sam/templates/http_interfaces.tpl b/sam/templates/http_interfaces.tpl
index f23cd14f1..dd0fd91a5 100644
--- a/sam/templates/http_interfaces.tpl
+++ b/sam/templates/http_interfaces.tpl
@@ -29,6 +29,9 @@ type {name}HandlersAPI interface {
 {foreach $calls as $call}
 	{call.name|capitalize}(http.ResponseWriter, *http.Request)
 {/foreach}
+
+	// Authenticate API requests
+	Authenticator() func(http.Handler) http.Handler
 }
 
 // Compile time check to see if we implement the interfaces
diff --git a/sam/templates/http_routes.tpl b/sam/templates/http_routes.tpl
index 7690d5e88..de3447ae6 100644
--- a/sam/templates/http_routes.tpl
+++ b/sam/templates/http_routes.tpl
@@ -14,10 +14,13 @@ func MountRoutes(r chi.Router) {
 	{api.interface|strtolower} := {api.interface|capitalize}Handlers{}.new()
 {/foreach}
 {foreach $apis as $api}
-	r.Route("{api.path}", func(r chi.Router) {
+	r.Group(func (r chi.Router) {
+			r.Use({api.interface|strtolower}.Authenticator())
+		r.Route("{api.path}", func(r chi.Router) {
 {foreach $api.apis as $call}
-		r.{eval echo capitalize(strtolower($call.method))}("{call.path}", {api.interface|strtolower}.{call.name|capitalize})
+			r.{eval echo capitalize(strtolower($call.method))}("{call.path}", {api.interface|strtolower}.{call.name|capitalize})
 {/foreach}
+		})
 	})
 {/foreach}
 
diff --git a/sam/user.interfaces.go b/sam/user.interfaces.go
index 827911a09..c1e0116da 100644
--- a/sam/user.interfaces.go
+++ b/sam/user.interfaces.go
@@ -40,6 +40,9 @@ type UserAPI interface {
 type UserHandlersAPI interface {
 	Login(http.ResponseWriter, *http.Request)
 	Search(http.ResponseWriter, *http.Request)
+
+	// Authenticate API requests
+	Authenticator() func(http.Handler) http.Handler
 }
 
 // Compile time check to see if we implement the interfaces
diff --git a/sam/websocket.interfaces.go b/sam/websocket.interfaces.go
index ff1d0eed8..6650bb8dd 100644
--- a/sam/websocket.interfaces.go
+++ b/sam/websocket.interfaces.go
@@ -38,6 +38,9 @@ type WebsocketAPI interface {
 // HTTP API interface
 type WebsocketHandlersAPI interface {
 	Client(http.ResponseWriter, *http.Request)
+
+	// Authenticate API requests
+	Authenticator() func(http.Handler) http.Handler
 }
 
 // Compile time check to see if we implement the interfaces