diff --git a/backend/secuscan/saved_views.py b/backend/secuscan/saved_views.py
index 889ecc406..8f05e07d0 100644
--- a/backend/secuscan/saved_views.py
+++ b/backend/secuscan/saved_views.py
@@ -4,12 +4,17 @@
 import uuid
 from typing import Any, Dict, List, Optional
 
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, Depends, HTTPException
 from pydantic import BaseModel, Field, field_validator
 
+from .auth import require_api_key
 from .database import get_db
 
-saved_views_router = APIRouter(prefix="/api/v1/saved-views", tags=["saved-views"])
+saved_views_router = APIRouter(
+    prefix="/api/v1/saved-views",
+    tags=["saved-views"],
+    dependencies=[Depends(require_api_key)],
+)
 
 _VALID_SORT_MODES = {"severity", "newest", "oldest", "target"}
 _VALID_SEVERITIES = {"all", "critical", "high", "medium", "low", "info"}
diff --git a/frontend/src/api.ts b/frontend/src/api.ts
index 390f51d8c..29401db05 100644
--- a/frontend/src/api.ts
+++ b/frontend/src/api.ts
@@ -390,7 +390,7 @@ export async function logoutSession(): Promise<void> {
   _apiKey = null
 }
 
-function getApiKey(): string | null {
+export function getApiKey(): string | null {
   return _apiKey
 }
 
diff --git a/frontend/src/hooks/useSavedViews.ts b/frontend/src/hooks/useSavedViews.ts
index 1e2eddec1..f4e418614 100644
--- a/frontend/src/hooks/useSavedViews.ts
+++ b/frontend/src/hooks/useSavedViews.ts
@@ -1,5 +1,5 @@
 import { useCallback, useEffect, useRef, useState } from 'react'
-import { API_BASE } from '../api'
+import { API_BASE, getApiKey } from '../api'
 
 export interface FilterPreset {
   severity: string
@@ -126,8 +126,15 @@ async function apiFetch<T>(
   init?: RequestInit,
 ): Promise<T | null> {
   try {
+    const apiKey = getApiKey()
+    const authHeaders: Record<string, string> = apiKey ? { 'X-Api-Key': apiKey } : {}
     const res = await fetch(`${API_BASE}${path}`, {
       ...init,
+      headers: {
+        ...authHeaders,
+        ...(init?.headers as Record<string, string> | undefined),
+      },
+      credentials: 'include',
       signal: AbortSignal.timeout(8000),
     })
     if (!res.ok) return null