diff --git a/api/tests/auth.rs b/api/tests/auth.rs
new file mode 100644
index 0000000..c563dbe
--- /dev/null
+++ b/api/tests/auth.rs
@@ -0,0 +1,12 @@
+use crate::common::{Client, get_server};
+
+mod common;
+
+#[tokio::test]
+async fn failes_without_login() {
+    let server = get_server().await;
+    let client = Client::new_no_user(&server);
+
+    let response = client.get_todos().await;
+    response.assert_status_unauthorized();
+}
diff --git a/api/tests/common.rs b/api/tests/common.rs
index 4379193..153561c 100644
--- a/api/tests/common.rs
+++ b/api/tests/common.rs
@@ -17,7 +17,7 @@ use types::{
 use uuid::Uuid;
 
 pub struct Client<'a> {
-    uuid: Uuid,
+    uuid: Option<Uuid>,
     server: &'a TestServer,
 }
 
@@ -25,50 +25,72 @@ impl<'a> Client<'a> {
     pub fn new(server: &'a TestServer) -> Client<'a> {
         let uuid = Uuid::new_v4();
 
-        Client { uuid, server }
+        Client {
+            uuid: Some(uuid),
+            server,
+        }
     }
 
-    pub fn uuid(&self) -> Uuid {
+    pub fn new_no_user(server: &'a TestServer) -> Client<'a> {
+        let uuid = Uuid::new_v4();
+
+        Client { uuid: None, server }
+    }
+
+    pub fn uuid(&self) -> Option<Uuid> {
         self.uuid.clone()
     }
 }
 
 impl<'a> Client<'a> {
     async fn get(&self, path: &str) -> TestResponse {
-        self.server
-            .get(&format!("/api/{path}"))
-            .add_header("x-user-id", self.uuid.to_string())
-            .await
+        let mut request = self.server.get(&format!("/api/{path}"));
+
+        if let Some(uuid) = self.uuid {
+            request = request.add_header("x-user-id", uuid.to_string());
+        };
+
+        request.await
     }
 
     async fn post(&self, path: &str) -> TestResponse {
-        self.server
-            .post(&format!("/api/{path}"))
-            .add_header("x-user-id", self.uuid.to_string())
-            .await
+        let mut request = self.server.post(&format!("/api/{path}"));
+
+        if let Some(uuid) = self.uuid {
+            request = request.add_header("x-user-id", uuid.to_string());
+        };
+
+        request.await
     }
 
     async fn post_json(&self, path: &str, body: serde_json::Value) -> TestResponse {
-        self.server
-            .post(&format!("/api/{path}"))
-            .json(&body)
-            .add_header("x-user-id", self.uuid.to_string())
-            .await
+        let mut request = self.server.post(&format!("/api/{path}")).json(&body);
+
+        if let Some(uuid) = self.uuid {
+            request = request.add_header("x-user-id", uuid.to_string());
+        };
+
+        request.await
     }
 
     async fn put_json(&self, path: &str, body: serde_json::Value) -> TestResponse {
-        self.server
-            .put(&format!("/api/{path}"))
-            .json(&body)
-            .add_header("x-user-id", self.uuid.to_string())
-            .await
+        let mut request = self.server.put(&format!("/api/{path}")).json(&body);
+
+        if let Some(uuid) = self.uuid {
+            request = request.add_header("x-user-id", uuid.to_string());
+        };
+
+        request.await
     }
 
     async fn delete(&self, path: &str) -> TestResponse {
-        self.server
-            .delete(&format!("/api/{path}"))
-            .add_header("x-user-id", self.uuid.to_string())
-            .await
+        let mut request = self.server.delete(&format!("/api/{path}"));
+
+        if let Some(uuid) = self.uuid {
+            request = request.add_header("x-user-id", uuid.to_string());
+        };
+
+        request.await
     }
 
     fn json<T: DeserializeOwned>(response: &TestResponse) -> T {
diff --git a/api/tests/sse.rs b/api/tests/sse.rs
index 657aea6..bf9025f 100644
--- a/api/tests/sse.rs
+++ b/api/tests/sse.rs
@@ -73,7 +73,7 @@ async fn sends_events_on_add_todo() {
     let server = get_server().await;
     let client = Client::new(&server);
 
-    let mut stream = connect_sse(&server, client.uuid()).await;
+    let mut stream = connect_sse(&server, client.uuid().unwrap()).await;
 
     let todo_uuid = Uuid::new_v4();
     client
@@ -114,7 +114,7 @@ async fn sends_events_on_update_todo() {
         }))
         .await;
 
-    let mut stream = connect_sse(&server, client.uuid()).await;
+    let mut stream = connect_sse(&server, client.uuid().unwrap()).await;
 
     client
         .update_todo_json(json!({
@@ -152,7 +152,7 @@ async fn sends_todo_events_on_remove_todo() {
         }))
         .await;
 
-    let mut stream = connect_sse(&server, client.uuid()).await;
+    let mut stream = connect_sse(&server, client.uuid().unwrap()).await;
 
     client.delete_todo_json(todo_uuid).await;
 
@@ -180,7 +180,7 @@ async fn sends_deleted_events_on_remove_todo() {
         }))
         .await;
 
-    let mut stream = connect_sse(&server, client.uuid()).await;
+    let mut stream = connect_sse(&server, client.uuid().unwrap()).await;
 
     client.delete_todo_json(todo_uuid).await;
 
@@ -211,7 +211,7 @@ async fn sends_todo_events_on_reactivate_todo() {
         }))
         .await;
 
-    let mut stream = connect_sse(&server, client.uuid()).await;
+    let mut stream = connect_sse(&server, client.uuid().unwrap()).await;
 
     client.delete_todo_json(todo_uuid).await;
 
@@ -246,7 +246,7 @@ async fn sends_deleted_events_on_reactivate_todo() {
         }))
         .await;
 
-    let mut stream = connect_sse(&server, client.uuid()).await;
+    let mut stream = connect_sse(&server, client.uuid().unwrap()).await;
 
     client.delete_todo_json(todo_uuid).await;
 
@@ -287,7 +287,7 @@ async fn sends_events_on_check_todo() {
         }))
         .await;
 
-    let mut stream = connect_sse(&server, client.uuid()).await;
+    let mut stream = connect_sse(&server, client.uuid().unwrap()).await;
 
     client.check_todo(todo_uuid).await;
 
@@ -317,7 +317,7 @@ async fn sends_events_on_check_remove_todo() {
 
     client.check_todo(todo_uuid).await;
 
-    let mut stream = connect_sse(&server, client.uuid()).await;
+    let mut stream = connect_sse(&server, client.uuid().unwrap()).await;
 
     client.remove_check_todo(todo_uuid).await;
 
@@ -332,7 +332,7 @@ async fn sends_events_on_add_tag() {
     let server = get_server().await;
     let client = Client::new(&server);
 
-    let mut stream = connect_sse(&server, client.uuid()).await;
+    let mut stream = connect_sse(&server, client.uuid().unwrap()).await;
 
     let tag_uuid = Uuid::new_v4();
     client
@@ -371,7 +371,7 @@ async fn sends_events_on_update_tag() {
         ))
         .await;
 
-    let mut stream = connect_sse(&server, client.uuid()).await;
+    let mut stream = connect_sse(&server, client.uuid().unwrap()).await;
 
     client
         .update_tag_json(json!({
@@ -408,7 +408,7 @@ async fn sends_events_on_remove_tag() {
         ))
         .await;
 
-    let mut stream = connect_sse(&server, client.uuid()).await;
+    let mut stream = connect_sse(&server, client.uuid().unwrap()).await;
 
     client.delete_tag_json(tag_uuid).await;
 
@@ -424,7 +424,7 @@ async fn sends_events_on_add_category() {
     let server = get_server().await;
     let client = Client::new(&server);
 
-    let mut stream = connect_sse(&server, client.uuid()).await;
+    let mut stream = connect_sse(&server, client.uuid().unwrap()).await;
 
     let category_uuid = Uuid::new_v4();
     client
@@ -466,7 +466,7 @@ async fn sends_events_on_update_category() {
         ))
         .await;
 
-    let mut stream = connect_sse(&server, client.uuid()).await;
+    let mut stream = connect_sse(&server, client.uuid().unwrap()).await;
 
     client
         .update_category_json(json!({
@@ -505,7 +505,7 @@ async fn sends_events_on_remove_category() {
         ))
         .await;
 
-    let mut stream = connect_sse(&server, client.uuid()).await;
+    let mut stream = connect_sse(&server, client.uuid().unwrap()).await;
 
     client.delete_category_json(category_uuid).await;