diff --git a/app/app.go b/app/app.go
index 61391de..6c0c451 100644
--- a/app/app.go
+++ b/app/app.go
@@ -49,8 +49,8 @@ func New(db *db.DB) *App {
 	auth.Handle("/register", md.ExcludeAuth(md.ValidateForm[RegisterForm](http.HandlerFunc(a.register))))
 	auth.Handle("/logout", md.RequireAuth(a.DB)(http.HandlerFunc(a.logout)))
 
-	auth.HandleFunc("/hackatime", a.HackatimeLogin)
-	auth.HandleFunc("/hackatime/callback", a.HackatimeCallback)
+	auth.Handle("/hackatime", md.RequireAuth(a.DB)(http.HandlerFunc(a.HackatimeLogin)))
+	auth.Handle("/hackatime/callback", md.RequireAuth(a.DB)(http.HandlerFunc(a.HackatimeCallback)))
 
 	// config
 	config := r.PathPrefix("/config").Subrouter()
@@ -88,13 +88,10 @@ func New(db *db.DB) *App {
 	repo.HandleFunc("/log/{branch}", withMode("log", a.RepoHandler))
 
 	repoConfig := repo.PathPrefix("/config").Subrouter()
+	repoConfig.Use(md.RequireAuth(a.DB))
 
 	repoConfig.HandleFunc("/", a.RepoConfigHandler)
 	repoConfig.Handle("/hackatime_project", md.ValidateForm[repoUpdateHackatimeForm](http.HandlerFunc(a.RepoConfigHackatimeProject)))
 
-	repoConfig.Use(md.RequireAuth(a.DB))
-
 	return &a
 }
-
-var repo string