diff --git a/src/app/api/matcha/route.ts b/src/app/api/matcha/route.ts
index 7ed7542..12b7a7b 100644
--- a/src/app/api/matcha/route.ts
+++ b/src/app/api/matcha/route.ts
@@ -1,8 +1,17 @@
 import { NextResponse } from "next/server";
 import dbConnect from "@/lib/mongodb";
 import Matcha from "@/models/Matcha";
+import { getUserFromRequest } from "@/lib/auth";
 
 export async function POST(req: Request) {
+  const user = getUserFromRequest(req);
+  if (!user) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (user.role !== "admin") {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
   await dbConnect();
   const data = await req.json();
   const newMatcha = await Matcha.create(data);
diff --git a/src/app/api/suggest/route.ts b/src/app/api/suggest/route.ts
index 326da97..7f5db7b 100644
--- a/src/app/api/suggest/route.ts
+++ b/src/app/api/suggest/route.ts
@@ -1,8 +1,14 @@
 import { NextResponse } from "next/server";
 import mongoose from "mongoose";
 import { SuggestedMatcha } from "@/models/SuggestedMatcha";
+import { getUserFromRequest } from "@/lib/auth";
 
 export async function POST(req: Request) {
+  const user = getUserFromRequest(req);
+  if (!user) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
   const body = await req.json();
 
   try {
diff --git a/src/lib/auth.ts b/src/lib/auth.ts
new file mode 100644
index 0000000..f8f2280
--- /dev/null
+++ b/src/lib/auth.ts
@@ -0,0 +1,17 @@
+export interface AuthenticatedUser {
+  role: "admin" | "user";
+}
+
+export function getUserFromRequest(req: Request): AuthenticatedUser | null {
+  const authHeader = req.headers.get("authorization");
+  if (!authHeader?.startsWith("Bearer ")) return null;
+
+  const token = authHeader.slice(7);
+  if (token === process.env.ADMIN_TOKEN) {
+    return { role: "admin" };
+  }
+  if (token === process.env.USER_TOKEN) {
+    return { role: "user" };
+  }
+  return null;
+}