diff --git a/src/routes/(authed)/tools/adv-upload/+page.svelte b/src/routes/(authed)/tools/adv-upload/+page.svelte
index 613e46b..b4ce370 100644
--- a/src/routes/(authed)/tools/adv-upload/+page.svelte
+++ b/src/routes/(authed)/tools/adv-upload/+page.svelte
@@ -326,6 +326,11 @@
 		}
 	}
 
+	async function authHeaders(): Promise<Record<string, string>> {
+		const token = await $auth?.getIdToken?.();
+		return token ? { Authorization: `Bearer ${token}` } : {};
+	}
+
 	async function uploadFiles() {
 		const currentUser = $auth;
 		if (!currentUser) {
@@ -377,6 +382,7 @@
 
 				const response = await fetch(UPLOAD_PROXY_ENDPOINT, {
 					method: 'POST',
+					headers: await authHeaders(),
 					body: formData
 				});
 
@@ -475,7 +481,11 @@
 		fd.append('email', email);
 		fd.append('file', new File([text], MANIFEST_FILENAME, { type: 'text/plain' }));
 
-		const res = await fetch(MANIFEST_PROXY_ENDPOINT, { method: 'POST', body: fd });
+		const res = await fetch(MANIFEST_PROXY_ENDPOINT, {
+			method: "POST",
+			headers: await authHeaders(),
+			body: fd
+		});
 		if (!res.ok) {
 			const e = await res.json().catch(() => ({ detail: res.statusText }));
 			throw new Error(e.detail || 'Manifest upload failed');
@@ -561,7 +571,11 @@
 				new File([manifestText], MANIFEST_FILENAME, { type: 'text/plain' })
 			);
 
-			const res = await fetch(MANIFEST_PROXY_ENDPOINT, { method: 'POST', body: fd });
+			const res = await fetch(MANIFEST_PROXY_ENDPOINT, {
+			method: "POST",
+			headers: await authHeaders(),
+			body: fd
+		});
 			if (!res.ok) {
 				const e = await res.json().catch(() => ({ detail: res.statusText }));
 				throw new Error(e.detail || 'Manifest upload failed');
diff --git a/src/routes/(authed)/tools/image-upload/+page.svelte b/src/routes/(authed)/tools/image-upload/+page.svelte
index 073d815..be44b1d 100644
--- a/src/routes/(authed)/tools/image-upload/+page.svelte
+++ b/src/routes/(authed)/tools/image-upload/+page.svelte
@@ -121,6 +121,12 @@
 		files = [];
 	}
 
+
+	async function authHeaders(): Promise<Record<string, string>> {
+		const token = await $auth?.getIdToken?.();
+		return token ? { Authorization: `Bearer ${token}` } : {};
+	}
+
 	async function uploadFiles() {
 		const currentUser = $auth;
 		if (!currentUser) {
@@ -159,6 +165,7 @@
 
 				const response = await fetch(UPLOAD_PROXY_ENDPOINT, {
 					method: 'POST',
+					headers: await authHeaders(),
 					body: formData
 				});