diff --git a/src/xrpc/mod.rs b/src/xrpc/mod.rs
index 0cdbeb9..200a21c 100644
--- a/src/xrpc/mod.rs
+++ b/src/xrpc/mod.rs
@@ -350,10 +350,14 @@ pub async fn xrpc_post(
     let mut params = parse_query_params(&raw_query);
     let claims = xrpc_claims.identity;
 
-    // Space credential Bearer requests bypass the client-key requirement;
-    // rate-limit by the credential's sub DID instead.
     let rate_key = resolve_client_key(&state, claims.as_ref(), &parts, &params)?;
 
+    if claims.is_none() && xrpc_claims.space_credential.is_none() {
+        return Err(AppError::Auth(
+            "XRPC procedures require DPoP authentication".into(),
+        ));
+    }
+
     let lexicon = state.lexicons.get(&method).await;
 
     // Determine token cost: per-NSID override → type default → 1