**TL;DR:** auth.protect() never fires for your API routes because the middleware never runs there. curl with no cookie gets real data. The middleware looks correct, but it never executes for /api paths. Confirm the cause 1.

## The fix

1. Read the exported `config.matcher` in your middleware file. If the patterns exclude api routes, the middleware skips them entirely.

2. Reproduce with curl against a protected API route with no session cookie. If you get data instead of a 401 or redirect, the middleware is not running there.

3. Include the API pattern in the matcher alongside the page pattern. The page pattern skips Next.js internals and static files; the second entry makes sure the middleware always runs for API routes:

4. Add defense in depth: call `auth()` inside the route handler too and return 401 when there is no userId. Middleware is one layer; the handler check is the second.

## When to use this

- This covers exactly what the title says: API routes wide open to unauthenticated callers.
- You are setting this up for the first time, or auditing an existing setup.
- You want the key gotchas in one place before you start.

## When not to use this

- You are doing a different workflow with API; these steps are specific to the title above.
- You need the full reference docs; this is the short path, not the manual.

## Compatibility

- Not pinned to a specific version; follows current API behavior.