diff --git a/playlist/views/api/track.py b/playlist/views/api/track.py
index a29d9fb..d1be233 100644
--- a/playlist/views/api/track.py
+++ b/playlist/views/api/track.py
@@ -1,15 +1,21 @@
 from rest_framework.views import APIView
 from rest_framework.response import Response
+from rest_framework.authentication import SessionAuthentication
+from rest_framework.permissions import IsAuthenticated
 from playlist.models import Track
 from playlist.serializers import TrackSerializer
 
 class TrackListView(APIView):
+    authentication_classes = [SessionAuthentication]
+    permission_classes = [IsAuthenticated]
     def get(self, request):
         tracks = Track.objects.all()
         serializer = TrackSerializer(tracks, many=True, context={'request': request})
         return Response(serializer.data)
 
 class TrackDetailView(APIView):
+    authentication_classes = [SessionAuthentication]
+    permission_classes = [IsAuthenticated]
     def get(self, request, id):
         track = Track.objects.get(pk=id)
         serializer = TrackSerializer(track, context={'request': request})
diff --git a/playlist/views/api/user.py b/playlist/views/api/user.py
index 0f8b2f9..dad065b 100644
--- a/playlist/views/api/user.py
+++ b/playlist/views/api/user.py
@@ -2,14 +2,20 @@ from rest_framework.views import APIView
 from rest_framework.response import Response
 from django.contrib.auth.models import User
 from playlist.serializers import UserSerializer
+from rest_framework.authentication import SessionAuthentication
+from rest_framework.permissions import IsAuthenticated
 
 class UserListView(APIView):
+    authentication_classes = [SessionAuthentication]
+    permission_classes = [IsAuthenticated]
     def get(self, request):
         users = User.objects.all()
         serializer = UserSerializer(users, many=True)
         return Response(serializer.data)
 
 class UserDetailView(APIView):
+    authentication_classes = [SessionAuthentication]
+    permission_classes = [IsAuthenticated]
     def get(self, request, id):
         user = User.objects.get(pk=id)
         serializer = UserSerializer(user)