diff --git a/pages/api/collections/[identifier]/cards.js b/pages/api/collections/[identifier]/cards.js
index 29fda27..a6373b3 100644
--- a/pages/api/collections/[identifier]/cards.js
+++ b/pages/api/collections/[identifier]/cards.js
@@ -99,6 +99,10 @@ export default async function handler(req, res) {
       res.status(200).json({ cards });
 
     } else if (req.method === 'POST') {
+      if (!user) {
+        return res.status(401).json({ error: 'Authentication required to modify this collection' });
+      }
+
       // Add card to collection - only allow if user has write access
       const canWrite = collection.user_id === user.userId || 
                       ['owner', 'editor'].includes(collection.user_role);
@@ -160,6 +164,10 @@ export default async function handler(req, res) {
       `;
 
     } else if (req.method === 'PUT') {
+      if (!user) {
+        return res.status(401).json({ error: 'Authentication required to modify this collection' });
+      }
+
       // Update card quantity in collection
       const canWrite = collection.user_id === user.userId || 
                       ['owner', 'editor'].includes(collection.user_role);
@@ -209,6 +217,10 @@ export default async function handler(req, res) {
       `;
 
     } else if (req.method === 'DELETE') {
+      if (!user) {
+        return res.status(401).json({ error: 'Authentication required to modify this collection' });
+      }
+
       // Remove card from collection
       const canWrite = collection.user_id === user.userId || 
                       ['owner', 'editor'].includes(collection.user_role);