diff --git a/app/rest/auth/auth_test.go b/app/rest/auth/auth_test.go
new file mode 100644
index 00000000..839e0bb3
--- /dev/null
+++ b/app/rest/auth/auth_test.go
@@ -0,0 +1,76 @@
+package auth
+
+import (
+	"encoding/base64"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAuthRequired(t *testing.T) {
+	store := mockStore{}
+	a := Authenticator{SessionStore: &store, DevPasswd: "123456"}
+	router := chi.NewRouter()
+	router.With(a.Auth(true)).Get("/auth", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(201)
+	})
+	server := httptest.NewServer(router)
+	defer server.Close()
+
+	client := &http.Client{Timeout: 1 * time.Second}
+	req, err := http.NewRequest("GET", server.URL+"/auth", nil)
+	req.Header.Add("Authorization", "Basic "+basicAuth("dev", "123456"))
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	assert.Equal(t, 201, resp.StatusCode, "valid auth user")
+
+	req, err = http.NewRequest("GET", server.URL+"/auth", nil)
+	resp, err = client.Do(req)
+	require.NoError(t, err)
+	assert.Equal(t, 401, resp.StatusCode, "no auth user")
+
+	req, err = http.NewRequest("GET", server.URL+"/auth", nil)
+	req.Header.Add("Authorization", "Basic "+basicAuth("dev", "ZZZZ123456"))
+	resp, err = client.Do(req)
+	require.NoError(t, err)
+	assert.Equal(t, 401, resp.StatusCode, "wrong auth creds")
+}
+
+func TestAuthNotRequired(t *testing.T) {
+	store := mockStore{}
+	a := Authenticator{SessionStore: &store, DevPasswd: "123456"}
+	router := chi.NewRouter()
+	router.With(a.Auth(false)).Get("/auth", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(201)
+	})
+	server := httptest.NewServer(router)
+	defer server.Close()
+
+	client := &http.Client{Timeout: 1 * time.Second}
+	req, err := http.NewRequest("GET", server.URL+"/auth", nil)
+	req.Header.Add("Authorization", "Basic "+basicAuth("dev", "123456"))
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	assert.Equal(t, 201, resp.StatusCode, "valid auth user")
+
+	req, err = http.NewRequest("GET", server.URL+"/auth", nil)
+	resp, err = client.Do(req)
+	require.NoError(t, err)
+	assert.Equal(t, 201, resp.StatusCode, "no auth user")
+
+	req, err = http.NewRequest("GET", server.URL+"/auth", nil)
+	req.Header.Add("Authorization", "Basic "+basicAuth("dev", "ZZZZ123456"))
+	resp, err = client.Do(req)
+	require.NoError(t, err)
+	assert.Equal(t, 201, resp.StatusCode, "wrong auth creds")
+}
+
+func basicAuth(username, password string) string {
+	auth := username + ":" + password
+	return base64.StdEncoding.EncodeToString([]byte(auth))
+}