diff --git a/backend/muzak/auth.py b/backend/muzak/auth.py
new file mode 100644
index 0000000..6a775f8
--- /dev/null
+++ b/backend/muzak/auth.py
@@ -0,0 +1,23 @@
+from rest_framework.authentication import BaseAuthentication
+from rest_framework.exceptions import AuthenticationFailed
+from mozilla_django_oidc.auth import OIDCAuthenticationBackend
+from django.contrib.auth.models import User
+
+class OIDCBearerTokenAuthentication(BaseAuthentication):
+    def authenticate(self, request):
+        auth = request.META.get('HTTP_AUTHORIZATION', '')
+        if not auth.startswith('Bearer '):
+            return None
+        token = auth.split(' ')[1]
+
+        backend = OIDCAuthenticationBackend()
+
+        try:
+            claims = backend.verify_token(token)
+        except Exception as e:
+            raise AuthenticationFailed(f'Invalid token: {e}')
+
+        user = backend.filter_users_by_claims(claims).first()
+        if not user:
+            raise AuthenticationFailed(f'Unknown user: {claims}')
+        return (user, None)
diff --git a/backend/muzak/settings.py b/backend/muzak/settings.py
index 2dbf665..638143e 100644
--- a/backend/muzak/settings.py
+++ b/backend/muzak/settings.py
@@ -88,6 +88,7 @@ AUTHENTICATION_BACKENDS = (
 
 REST_FRAMEWORK = {
     'DEFAULT_AUTHENTICATION_CLASSES': [
+        'muzak.auth.OIDCBearerTokenAuthentication',
         'mozilla_django_oidc.contrib.drf.OIDCAuthentication',
         'rest_framework.authentication.SessionAuthentication',
     ],
@@ -101,6 +102,8 @@ OIDC_RP_CLIENT_SECRET = os.getenv('OIDC_RP_CLIENT_SECRET')
 OIDC_OP_AUTHORIZATION_ENDPOINT = os.getenv('OIDC_OP_AUTHORIZATION_ENDPOINT')
 OIDC_OP_TOKEN_ENDPOINT = os.getenv('OIDC_OP_TOKEN_ENDPOINT')
 OIDC_OP_USER_ENDPOINT = os.getenv('OIDC_OP_USER_ENDPOINT')
+OIDC_RP_SIGN_ALGO = os.getenv('OIDC_RP_SIGN_ALGO')
+OIDC_OP_JWKS_ENDPOINT = os.getenv('OIDC_OP_JWKS_ENDPOINT')
 LOGIN_REDIRECT_URL = "/"
 LOGOUT_REDIRECT_URL = "/"
 LOGIN_URL = "/"