diff --git a/api/search-customers.php b/api/search-customers.php
index 5b60376..be49bc6 100644
--- a/api/search-customers.php
+++ b/api/search-customers.php
@@ -6,6 +6,11 @@
 header('Content-Type: application/json');
 
 require_once __DIR__ . '/../includes/functions.php';
+require_once __DIR__ . '/../includes/auth.php';
+
+if (!AdminAuth::isLoggedIn()) {
+    jsonResponse(['error' => 'Unauthorized'], 401);
+}
 
 $query = $_GET['q'] ?? '';