diff --git a/internal/api/home.go b/internal/api/home.go
index 31654950..c3d2464e 100644
--- a/internal/api/home.go
+++ b/internal/api/home.go
@@ -4,7 +4,6 @@ import (
 	"net/http"
 
 	"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
-	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/recommendation"
 )
@@ -14,9 +13,8 @@ import (
 // DB failure — the SPA should render either empty states or full content,
 // not a half-broken page.
 func (h *handlers) handleGetHome(w http.ResponseWriter, r *http.Request) {
-	user, ok := auth.UserFromContext(r.Context())
+	user, ok := requireUser(w, r)
 	if !ok {
-		writeErr(w, apierror.ErrUnauthorized)
 		return
 	}
 	data, err := recommendation.HomeData(r.Context(), h.pool, user.ID)
diff --git a/internal/api/library.go b/internal/api/library.go
index 7ab669cd..3d94da35 100644
--- a/internal/api/library.go
+++ b/internal/api/library.go
@@ -4,7 +4,6 @@ import (
 	"errors"
 	"net/http"
 
-	"github.com/go-chi/chi/v5"
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgtype"
 
@@ -119,14 +118,12 @@ func (h *handlers) handleGetArtist(w http.ResponseWriter, r *http.Request) {
 // as a flat list. Used by ArtistCard's play affordance, which shuffles
 // client-side. 404 when the artist doesn't exist.
 func (h *handlers) handleGetArtistTracks(w http.ResponseWriter, r *http.Request) {
-	id, ok := parseUUID(chi.URLParam(r, "id"))
+	id, ok := requireURLUUID(w, r, "id")
 	if !ok {
-		writeErr(w, apierror.BadRequest("bad_request", "invalid artist id"))
 		return
 	}
-	user, ok := auth.UserFromContext(r.Context())
+	user, ok := requireUser(w, r)
 	if !ok {
-		writeErr(w, apierror.ErrUnauthorized)
 		return
 	}
 	q := dbq.New(h.pool)
diff --git a/internal/api/radio.go b/internal/api/radio.go
index 8419fe0e..5896324d 100644
--- a/internal/api/radio.go
+++ b/internal/api/radio.go
@@ -13,7 +13,6 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 
 	"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
-	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/recommendation"
 )
@@ -30,9 +29,8 @@ type RadioResponse struct {
 // scoring formula folds in contextual_match_score using the user's current
 // session vector (read from the most recent open play_event).
 func (h *handlers) handleRadio(w http.ResponseWriter, r *http.Request) {
-	user, ok := auth.UserFromContext(r.Context())
+	user, ok := requireUser(w, r)
 	if !ok {
-		writeErr(w, apierror.ErrUnauthorized)
 		return
 	}
 	raw := strings.TrimSpace(r.URL.Query().Get("seed_track"))
diff --git a/internal/api/suggestions.go b/internal/api/suggestions.go
index 1e511c13..ba005a24 100644
--- a/internal/api/suggestions.go
+++ b/internal/api/suggestions.go
@@ -7,7 +7,6 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 
 	"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
-	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/recommendation"
 )
 
@@ -35,9 +34,8 @@ type seedContributionView struct {
 //
 // Returns 200 with a JSON array (possibly empty). Read-only; no admin gate.
 func (h *handlers) handleListSuggestions(w http.ResponseWriter, r *http.Request) {
-	user, ok := auth.UserFromContext(r.Context())
+	user, ok := requireUser(w, r)
 	if !ok {
-		writeErr(w, apierror.ErrUnauthorized)
 		return
 	}
 	limit := 12