diff --git a/crates/tranquil-oauth-server/src/endpoints/delegation.rs b/crates/tranquil-oauth-server/src/endpoints/delegation.rs
index 9f4dbba..f7661b0 100644
--- a/crates/tranquil-oauth-server/src/endpoints/delegation.rs
+++ b/crates/tranquil-oauth-server/src/endpoints/delegation.rs
@@ -5,7 +5,7 @@ use axum::{
     response::{IntoResponse, Redirect, Response},
 };
 use serde::{Deserialize, Serialize};
-use tranquil_pds::auth::{Active, Auth};
+use tranquil_pds::auth::{Active, AuthAny};
 use tranquil_pds::delegation::DelegationActionType;
 use tranquil_pds::oauth::RequestData;
 use tranquil_pds::oauth::client::{build_client_metadata, delegation_oauth_urls};
@@ -406,10 +406,17 @@ pub async fn delegation_auth_token(
     State(state): State<AppState>,
     headers: HeaderMap,
     client_ip: ClientIp,
-    auth: Auth<Active>,
+    auth: AuthAny<Active>,
     Json(form): Json<DelegationTokenAuthSubmit>,
 ) -> Response {
-    let controller_did = &auth.did;
+    if let Err(error) = auth.require_lxm(
+        &"farm.tranquil.delegation.authorize"
+            .parse()
+            .expect("valid NSID"),
+    ) {
+        return error.into_response();
+    }
+    let controller_did = auth.did();
 
     let delegated_did = match parse_did(&form.delegated_did, "delegated") {
         Ok(d) => d,