diff --git a/src/interfaces/api/handlers/admin_handler.rs b/src/interfaces/api/handlers/admin_handler.rs
index d960b04e..a4d4c3d7 100644
--- a/src/interfaces/api/handlers/admin_handler.rs
+++ b/src/interfaces/api/handlers/admin_handler.rs
@@ -108,6 +108,7 @@ async fn admin_guard(state: &AppState, headers: &HeaderMap) -> Result<(Uuid, Str
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn get_oidc_settings(
@@ -138,6 +139,7 @@ pub async fn get_oidc_settings(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn save_oidc_settings(
@@ -198,6 +200,7 @@ async fn test_oidc_connection(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn get_storage_settings(
@@ -228,6 +231,7 @@ pub async fn get_storage_settings(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn save_storage_settings(
@@ -288,6 +292,7 @@ async fn test_storage_connection(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn get_migration_status(
@@ -309,6 +314,7 @@ pub async fn get_migration_status(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn start_migration(
@@ -386,6 +392,7 @@ pub async fn start_migration(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn pause_migration(
@@ -416,6 +423,7 @@ pub async fn pause_migration(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn resume_migration(
@@ -447,6 +455,7 @@ pub async fn resume_migration(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn complete_migration(
@@ -486,6 +495,7 @@ pub async fn complete_migration(
         (status = 403, description = "Admin required"),
         (status = 500, description = "Verification failed")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn verify_migration(
@@ -563,6 +573,7 @@ fn migration_state_to_dto(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn generate_encryption_key(
@@ -619,6 +630,7 @@ fn build_backend_from_config(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn get_general_settings(
@@ -660,6 +672,7 @@ pub async fn get_general_settings(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn get_dashboard_stats(
@@ -750,6 +763,7 @@ pub async fn get_dashboard_stats(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn list_users(
@@ -798,6 +812,7 @@ pub async fn list_users(
         (status = 403, description = "Admin required"),
         (status = 404, description = "User not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn get_user(
@@ -834,6 +849,7 @@ pub async fn get_user(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn delete_user(
@@ -883,6 +899,7 @@ pub async fn delete_user(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn update_user_role(
@@ -933,6 +950,7 @@ pub async fn update_user_role(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn update_user_active(
@@ -987,6 +1005,7 @@ pub async fn update_user_active(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn update_user_quota(
@@ -1032,6 +1051,7 @@ pub async fn update_user_quota(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn create_user(
@@ -1072,6 +1092,7 @@ pub async fn create_user(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn reset_user_password(
@@ -1121,6 +1142,7 @@ pub async fn reset_user_password(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn get_registration_setting(
@@ -1151,6 +1173,7 @@ pub async fn get_registration_setting(
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Admin required")
     ),
+    security(("bearerAuth" = [])),
     tag = "admin"
 )]
 pub async fn set_registration_setting(
diff --git a/src/interfaces/api/handlers/auth_handler.rs b/src/interfaces/api/handlers/auth_handler.rs
index d6e22995..afb37d66 100644
--- a/src/interfaces/api/handlers/auth_handler.rs
+++ b/src/interfaces/api/handlers/auth_handler.rs
@@ -19,7 +19,6 @@ use crate::interfaces::api::cookie_auth;
 use crate::interfaces::errors::AppError;
 use crate::interfaces::middleware::auth::CurrentUserId;
 use serde::Deserialize;
-use utoipa::ToSchema;
 
 /// Public auth routes — no authentication required.
 pub fn auth_public_routes() -> Router<Arc<AppState>> {
@@ -667,7 +666,9 @@ pub async fn get_system_status(
     ),
     tag = "auth"
 )]
-pub async fn oidc_providers(State(state): State<Arc<AppState>>) -> Result<impl IntoResponse, AppError> {
+pub async fn oidc_providers(
+    State(state): State<Arc<AppState>>,
+) -> Result<impl IntoResponse, AppError> {
     let auth_service = state
         .auth_service
         .as_ref()
@@ -708,7 +709,9 @@ pub async fn oidc_providers(State(state): State<Arc<AppState>>) -> Result<impl I
     ),
     tag = "auth"
 )]
-pub async fn oidc_authorize(State(state): State<Arc<AppState>>) -> Result<impl IntoResponse, AppError> {
+pub async fn oidc_authorize(
+    State(state): State<Arc<AppState>>,
+) -> Result<impl IntoResponse, AppError> {
     let auth_service = state
         .auth_service
         .as_ref()
diff --git a/src/interfaces/api/handlers/batch_handler.rs b/src/interfaces/api/handlers/batch_handler.rs
index 7ca55116..ff686653 100644
--- a/src/interfaces/api/handlers/batch_handler.rs
+++ b/src/interfaces/api/handlers/batch_handler.rs
@@ -145,6 +145,7 @@ where
         (status = 400, description = "Bad request"),
         (status = 401, description = "Unauthorized")
     ),
+    security(("bearerAuth" = [])),
     tag = "batch"
 )]
 pub async fn move_files_batch(
@@ -212,6 +213,7 @@ pub async fn move_files_batch(
         (status = 400, description = "Bad request"),
         (status = 401, description = "Unauthorized")
     ),
+    security(("bearerAuth" = [])),
     tag = "batch"
 )]
 pub async fn copy_files_batch(
@@ -279,6 +281,7 @@ pub async fn copy_files_batch(
         (status = 400, description = "Bad request"),
         (status = 401, description = "Unauthorized")
     ),
+    security(("bearerAuth" = [])),
     tag = "batch"
 )]
 pub async fn delete_files_batch(
@@ -354,6 +357,7 @@ pub async fn delete_files_batch(
         (status = 400, description = "Bad request"),
         (status = 401, description = "Unauthorized")
     ),
+    security(("bearerAuth" = [])),
     tag = "batch"
 )]
 pub async fn delete_folders_batch(
@@ -429,6 +433,7 @@ pub async fn delete_folders_batch(
         (status = 400, description = "Bad request"),
         (status = 401, description = "Unauthorized")
     ),
+    security(("bearerAuth" = [])),
     tag = "batch"
 )]
 pub async fn create_folders_batch(
@@ -503,6 +508,7 @@ pub async fn create_folders_batch(
         (status = 400, description = "Bad request"),
         (status = 401, description = "Unauthorized")
     ),
+    security(("bearerAuth" = [])),
     tag = "batch"
 )]
 pub async fn get_files_batch(
@@ -570,6 +576,7 @@ pub async fn get_files_batch(
         (status = 400, description = "Bad request"),
         (status = 401, description = "Unauthorized")
     ),
+    security(("bearerAuth" = [])),
     tag = "batch"
 )]
 pub async fn get_folders_batch(
@@ -677,6 +684,7 @@ impl From<BatchDownloadQuery> for BatchDownloadRequest {
         (status = 400, description = "Bad request"),
         (status = 401, description = "Unauthorized")
     ),
+    security(("bearerAuth" = [])),
     tag = "batch"
 )]
 pub async fn trash_batch(
@@ -800,6 +808,7 @@ pub async fn trash_batch(
         (status = 400, description = "Bad request"),
         (status = 401, description = "Unauthorized")
     ),
+    security(("bearerAuth" = [])),
     tag = "batch"
 )]
 pub async fn move_folders_batch(
@@ -884,6 +893,7 @@ impl From<CopyFolderTreeResult> for CopiedFolderDto {
         (status = 400, description = "Bad request"),
         (status = 401, description = "Unauthorized")
     ),
+    security(("bearerAuth" = [])),
     tag = "batch"
 )]
 pub async fn copy_folders_batch(
@@ -951,6 +961,7 @@ pub async fn copy_folders_batch(
         (status = 401, description = "Unauthorized"),
         (status = 500, description = "ZIP creation failed")
     ),
+    security(("bearerAuth" = [])),
     tag = "batch"
 )]
 pub async fn download_batch_querystring(
@@ -973,6 +984,7 @@ pub async fn download_batch_querystring(
         (status = 401, description = "Unauthorized"),
         (status = 500, description = "ZIP creation failed")
     ),
+    security(("bearerAuth" = [])),
     tag = "batch"
 )]
 pub async fn download_batch_post(
diff --git a/src/interfaces/api/handlers/contacts_handler.rs b/src/interfaces/api/handlers/contacts_handler.rs
index 479985d2..3e55092a 100644
--- a/src/interfaces/api/handlers/contacts_handler.rs
+++ b/src/interfaces/api/handlers/contacts_handler.rs
@@ -221,6 +221,7 @@ fn user_to_contact(user: UserDto) -> ContactDto {
         (status = 200, description = "List of address books"),
         (status = 500, description = "Internal server error"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn list_address_books(
@@ -289,6 +290,7 @@ pub async fn list_address_books(
         (status = 201, description = "Address book created", body = AddressBookResponse),
         (status = 400, description = "Invalid input"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn create_address_book(
@@ -336,6 +338,7 @@ pub async fn create_address_book(
         (status = 403, description = "Only the owner can update"),
         (status = 404, description = "Address book not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn update_address_book(
@@ -391,6 +394,7 @@ pub async fn update_address_book(
         (status = 403, description = "Only the owner can delete"),
         (status = 404, description = "Address book not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn delete_address_book(
@@ -431,6 +435,7 @@ pub async fn delete_address_book(
         (status = 403, description = "Access denied"),
         (status = 404, description = "Address book not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn list_contacts(
@@ -487,6 +492,7 @@ pub async fn list_contacts(
         (status = 403, description = "Access denied or read-only book"),
         (status = 404, description = "Address book not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn create_contact(
@@ -541,6 +547,7 @@ pub async fn create_contact(
         (status = 403, description = "Access denied"),
         (status = 404, description = "Contact not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn get_contact(
@@ -607,6 +614,7 @@ pub async fn get_contact(
         (status = 404, description = "Contact not found"),
         (status = 412, description = "ETag mismatch — contact was modified"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn update_contact(
@@ -687,6 +695,7 @@ pub async fn update_contact(
         (status = 404, description = "Contact not found"),
         (status = 412, description = "ETag mismatch"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn delete_contact(
@@ -747,6 +756,7 @@ pub async fn delete_contact(
         (status = 403, description = "Access denied"),
         (status = 404, description = "Address book not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn list_groups(
@@ -780,6 +790,7 @@ pub async fn list_groups(
         (status = 403, description = "Access denied or read-only book"),
         (status = 404, description = "Address book not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn create_group(
@@ -818,6 +829,7 @@ pub async fn create_group(
         (status = 403, description = "Access denied"),
         (status = 404, description = "Group not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn get_group(
@@ -858,6 +870,7 @@ pub async fn get_group(
         (status = 403, description = "Access denied or read-only book"),
         (status = 404, description = "Group not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn update_group(
@@ -895,6 +908,7 @@ pub async fn update_group(
         (status = 403, description = "Access denied or read-only book"),
         (status = 404, description = "Group not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn delete_group(
@@ -933,6 +947,7 @@ pub async fn delete_group(
         (status = 403, description = "Access denied"),
         (status = 404, description = "Group not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn list_contacts_in_group(
@@ -974,6 +989,7 @@ pub async fn list_contacts_in_group(
         (status = 403, description = "Access denied or read-only book"),
         (status = 404, description = "Group or contact not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn add_contact_to_group(
@@ -1016,6 +1032,7 @@ pub async fn add_contact_to_group(
         (status = 403, description = "Access denied or read-only book"),
         (status = 404, description = "Group or contact not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "contacts"
 )]
 pub async fn remove_contact_from_group(
diff --git a/src/interfaces/api/handlers/favorites_handler.rs b/src/interfaces/api/handlers/favorites_handler.rs
index b583c0fa..25ff376d 100644
--- a/src/interfaces/api/handlers/favorites_handler.rs
+++ b/src/interfaces/api/handlers/favorites_handler.rs
@@ -33,6 +33,7 @@ pub struct BatchFavoritesRequest {
     responses(
         (status = 200, description = "List of favorites", body = Vec<crate::application::dtos::favorites_dto::FavoriteItemDto>)
     ),
+    security(("bearerAuth" = [])),
     tag = "favorites"
 )]
 pub async fn get_favorites(
@@ -75,6 +76,7 @@ pub async fn get_favorites(
         (status = 201, description = "Item added to favorites"),
         (status = 400, description = "Invalid item type")
     ),
+    security(("bearerAuth" = [])),
     tag = "favorites"
 )]
 pub async fn add_favorite(
@@ -131,6 +133,7 @@ pub async fn add_favorite(
         (status = 200, description = "Item removed from favorites"),
         (status = 404, description = "Item not in favorites")
     ),
+    security(("bearerAuth" = [])),
     tag = "favorites"
 )]
 pub async fn remove_favorite(
@@ -184,6 +187,7 @@ pub async fn remove_favorite(
         (status = 200, description = "Batch add result", body = crate::application::dtos::favorites_dto::BatchFavoritesResult),
         (status = 400, description = "Invalid request")
     ),
+    security(("bearerAuth" = [])),
     tag = "favorites"
 )]
 pub async fn batch_add_favorites(
diff --git a/src/interfaces/api/handlers/file_handler.rs b/src/interfaces/api/handlers/file_handler.rs
index c664b55f..0a7866a9 100644
--- a/src/interfaces/api/handlers/file_handler.rs
+++ b/src/interfaces/api/handlers/file_handler.rs
@@ -1080,6 +1080,7 @@ pub(super) fn build_content_disposition(name: &str, mime: &str, force_inline: bo
         (status = 200, description = "List of files", body = Vec<FileDto>),
         (status = 304, description = "Not modified"),
     ),
+    security(("bearerAuth" = [])),
     tag = "files"
 )]
 pub async fn list_files_query(
@@ -1100,6 +1101,7 @@ pub async fn list_files_query(
         (status = 400, description = "Invalid request"),
         (status = 507, description = "Storage quota exceeded"),
     ),
+    security(("bearerAuth" = [])),
     tag = "files"
 )]
 pub async fn upload_file_with_thumbnails(
@@ -1125,6 +1127,7 @@ pub async fn upload_file_with_thumbnails(
         (status = 304, description = "Not modified"),
         (status = 404, description = "File not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "files"
 )]
 pub async fn download_file(
@@ -1150,6 +1153,7 @@ pub async fn download_file(
         (status = 304, description = "Not modified"),
         (status = 404, description = "File not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "files"
 )]
 pub async fn get_thumbnail(
@@ -1174,6 +1178,7 @@ pub async fn get_thumbnail(
         (status = 400, description = "Invalid image or size too large"),
         (status = 404, description = "File not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "files"
 )]
 pub async fn upload_thumbnail(
@@ -1193,6 +1198,7 @@ pub async fn upload_thumbnail(
         (status = 200, description = "File metadata (EXIF, dimensions, duration, etc.)"),
         (status = 404, description = "File not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "files"
 )]
 pub async fn get_file_metadata(
@@ -1211,6 +1217,7 @@ pub async fn get_file_metadata(
         (status = 204, description = "File deleted (moved to trash if enabled)"),
         (status = 404, description = "File not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "files"
 )]
 pub async fn delete_file(
@@ -1230,6 +1237,7 @@ pub async fn delete_file(
         (status = 200, description = "Renamed file", body = FileDto),
         (status = 404, description = "File not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "files"
 )]
 pub async fn rename_file(
@@ -1250,6 +1258,7 @@ pub async fn rename_file(
         (status = 200, description = "Moved file", body = FileDto),
         (status = 404, description = "File or destination not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "files"
 )]
 pub async fn move_file_simple(
diff --git a/src/interfaces/api/handlers/folder_handler.rs b/src/interfaces/api/handlers/folder_handler.rs
index 370722be..90f77bd5 100644
--- a/src/interfaces/api/handlers/folder_handler.rs
+++ b/src/interfaces/api/handlers/folder_handler.rs
@@ -420,6 +420,7 @@ impl FolderHandler {
         (status = 201, description = "Folder created", body = FolderDto),
         (status = 400, description = "Invalid request"),
     ),
+    security(("bearerAuth" = [])),
     tag = "folders"
 )]
 pub async fn create_folder(
@@ -438,6 +439,7 @@ pub async fn create_folder(
         (status = 200, description = "Folder", body = FolderDto),
         (status = 404, description = "Folder not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "folders"
 )]
 pub async fn get_folder(
@@ -454,6 +456,7 @@ pub async fn get_folder(
     responses(
         (status = 200, description = "List of root folders", body = Vec<FolderDto>),
     ),
+    security(("bearerAuth" = [])),
     tag = "folders"
 )]
 pub async fn list_root_folders(
@@ -471,6 +474,7 @@ pub async fn list_root_folders(
         (status = 200, description = "List of sub-folders", body = Vec<FolderDto>),
         (status = 404, description = "Folder not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "folders"
 )]
 pub async fn list_folder_contents(
@@ -488,6 +492,7 @@ pub async fn list_folder_contents(
     responses(
         (status = 200, description = "Paginated list of root folders"),
     ),
+    security(("bearerAuth" = [])),
     tag = "folders"
 )]
 pub async fn list_root_folders_paginated(
@@ -509,6 +514,7 @@ pub async fn list_root_folders_paginated(
         (status = 200, description = "Paginated list of sub-folders"),
         (status = 404, description = "Folder not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "folders"
 )]
 pub async fn list_folder_contents_paginated(
@@ -529,6 +535,7 @@ pub async fn list_folder_contents_paginated(
         (status = 304, description = "Not modified"),
         (status = 404, description = "Folder not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "folders"
 )]
 pub async fn list_folder_listing(
@@ -549,6 +556,7 @@ pub async fn list_folder_listing(
         (status = 200, description = "Renamed folder", body = FolderDto),
         (status = 404, description = "Folder not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "folders"
 )]
 pub async fn rename_folder(
@@ -569,6 +577,7 @@ pub async fn rename_folder(
         (status = 200, description = "Moved folder", body = FolderDto),
         (status = 404, description = "Folder or destination not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "folders"
 )]
 pub async fn move_folder(
@@ -588,6 +597,7 @@ pub async fn move_folder(
         (status = 204, description = "Folder deleted"),
         (status = 404, description = "Folder not found"),
     ),
+    security(("bearerAuth" = [])),
     tag = "folders"
 )]
 pub async fn delete_folder_with_trash(
@@ -607,6 +617,7 @@ pub async fn delete_folder_with_trash(
         (status = 404, description = "Folder not found"),
         (status = 501, description = "ZIP service not available"),
     ),
+    security(("bearerAuth" = [])),
     tag = "folders"
 )]
 pub async fn download_folder_zip(
diff --git a/src/interfaces/api/handlers/grant_handler.rs b/src/interfaces/api/handlers/grant_handler.rs
index eb813ccb..4db3fe4e 100644
--- a/src/interfaces/api/handlers/grant_handler.rs
+++ b/src/interfaces/api/handlers/grant_handler.rs
@@ -50,6 +50,7 @@ type AppStateRef = Arc<AppState>;
         (status = 400, description = "Invalid input (both/neither of permissions+role provided)"),
         (status = 404, description = "Resource not found OR caller lacks Share permission"),
     ),
+    security(("bearerAuth" = [])),
     tag = "grants"
 )]
 pub async fn create_grant(
@@ -125,6 +126,7 @@ pub async fn create_grant(
         (status = 204, description = "Grant revoked (or did not exist)"),
         (status = 404, description = "Caller lacks Share permission on the underlying resource"),
     ),
+    security(("bearerAuth" = [])),
     tag = "grants"
 )]
 pub async fn revoke_grant(
@@ -174,6 +176,7 @@ pub async fn revoke_grant(
         (status = 200, description = "Role applied; returns the new full grant set", body = Vec<GrantDto>),
         (status = 404, description = "Resource not found or caller lacks Share"),
     ),
+    security(("bearerAuth" = [])),
     tag = "grants"
 )]
 pub async fn set_role(
@@ -261,6 +264,7 @@ pub struct IncomingQuery {
     responses(
         (status = 200, description = "Direct grants targeting the caller", body = Vec<GrantDto>),
     ),
+    security(("bearerAuth" = [])),
     tag = "grants"
 )]
 pub async fn list_incoming(
@@ -298,6 +302,7 @@ pub async fn list_incoming(
                         last page.",
          body = SharedWithMeDto),
     ),
+    security(("bearerAuth" = [])),
     tag = "grants"
 )]
 pub async fn list_shared_with_me(
@@ -456,6 +461,7 @@ pub async fn list_shared_with_me(
     responses(
         (status = 200, description = "Grants the caller has created", body = Vec<GrantDto>),
     ),
+    security(("bearerAuth" = [])),
     tag = "grants"
 )]
 pub async fn list_outgoing(
@@ -491,6 +497,7 @@ pub struct OnResourceQuery {
         (status = 200, description = "Grants on the specified resource", body = Vec<GrantDto>),
         (status = 404, description = "Resource not found or caller lacks Share"),
     ),
+    security(("bearerAuth" = [])),
     tag = "grants"
 )]
 pub async fn list_on_resource(
diff --git a/src/interfaces/api/handlers/music_handler.rs b/src/interfaces/api/handlers/music_handler.rs
index 58bcce65..b1662d27 100644
--- a/src/interfaces/api/handlers/music_handler.rs
+++ b/src/interfaces/api/handlers/music_handler.rs
@@ -31,6 +31,7 @@ pub struct PaginationQuery {
         (status = 400, description = "Bad request"),
         (status = 401, description = "Unauthorized")
     ),
+    security(("bearerAuth" = [])),
     tag = "playlists"
 )]
 pub async fn create_playlist(
@@ -53,6 +54,7 @@ pub async fn create_playlist(
         (status = 401, description = "Unauthorized"),
         (status = 404, description = "Playlist not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "playlists"
 )]
 pub async fn get_playlist(
@@ -73,6 +75,7 @@ pub async fn get_playlist(
         (status = 200, description = "List of playlists"),
         (status = 401, description = "Unauthorized")
     ),
+    security(("bearerAuth" = [])),
     tag = "playlists"
 )]
 pub async fn list_playlists(
@@ -101,6 +104,7 @@ pub struct IncludeSharedQuery {
         (status = 401, description = "Unauthorized"),
         (status = 404, description = "Playlist not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "playlists"
 )]
 pub async fn update_playlist(
@@ -127,6 +131,7 @@ pub async fn update_playlist(
         (status = 401, description = "Unauthorized"),
         (status = 404, description = "Playlist not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "playlists"
 )]
 pub async fn delete_playlist(
@@ -152,6 +157,7 @@ pub async fn delete_playlist(
         (status = 401, description = "Unauthorized"),
         (status = 404, description = "Playlist not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "playlists"
 )]
 pub async fn add_tracks(
@@ -181,6 +187,7 @@ pub async fn add_tracks(
         (status = 401, description = "Unauthorized"),
         (status = 404, description = "Playlist or track not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "playlists"
 )]
 pub async fn remove_track(
@@ -206,6 +213,7 @@ pub async fn remove_track(
         (status = 401, description = "Unauthorized"),
         (status = 404, description = "Playlist not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "playlists"
 )]
 pub async fn reorder_tracks(
@@ -232,6 +240,7 @@ pub async fn reorder_tracks(
         (status = 401, description = "Unauthorized"),
         (status = 404, description = "Playlist not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "playlists"
 )]
 pub async fn list_playlist_tracks(
@@ -257,6 +266,7 @@ pub async fn list_playlist_tracks(
         (status = 401, description = "Unauthorized"),
         (status = 404, description = "Playlist not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "playlists"
 )]
 pub async fn share_playlist(
@@ -286,6 +296,7 @@ pub async fn share_playlist(
         (status = 401, description = "Unauthorized"),
         (status = 404, description = "Playlist or share not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "playlists"
 )]
 pub async fn remove_share(
@@ -311,6 +322,7 @@ pub async fn remove_share(
         (status = 401, description = "Unauthorized"),
         (status = 404, description = "Playlist not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "playlists"
 )]
 pub async fn get_playlist_shares(
@@ -336,6 +348,7 @@ pub async fn get_playlist_shares(
         (status = 401, description = "Unauthorized"),
         (status = 404, description = "File not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "playlists"
 )]
 pub async fn get_audio_metadata(
diff --git a/src/interfaces/api/handlers/photos_handler.rs b/src/interfaces/api/handlers/photos_handler.rs
index 83f8dab5..1eb6c8c3 100644
--- a/src/interfaces/api/handlers/photos_handler.rs
+++ b/src/interfaces/api/handlers/photos_handler.rs
@@ -38,6 +38,7 @@ pub struct PhotosQueryParams {
         (status = 401, description = "Unauthorized"),
         (status = 500, description = "Internal server error")
     ),
+    security(("bearerAuth" = [])),
     tag = "photos"
 )]
 pub async fn list_photos(
diff --git a/src/interfaces/api/handlers/recent_handler.rs b/src/interfaces/api/handlers/recent_handler.rs
index 08e41e37..fdadfd8c 100644
--- a/src/interfaces/api/handlers/recent_handler.rs
+++ b/src/interfaces/api/handlers/recent_handler.rs
@@ -26,6 +26,7 @@ pub struct GetRecentParams {
     responses(
         (status = 200, description = "List of recent items", body = Vec<crate::application::dtos::recent_dto::RecentItemDto>)
     ),
+    security(("bearerAuth" = [])),
     tag = "recent"
 )]
 pub async fn get_recent_items(
@@ -65,6 +66,7 @@ pub async fn get_recent_items(
         (status = 200, description = "Access recorded"),
         (status = 400, description = "Invalid item type")
     ),
+    security(("bearerAuth" = [])),
     tag = "recent"
 )]
 pub async fn record_item_access(
@@ -124,6 +126,7 @@ pub async fn record_item_access(
         (status = 200, description = "Item removed from recents"),
         (status = 404, description = "Item not in recents")
     ),
+    security(("bearerAuth" = [])),
     tag = "recent"
 )]
 pub async fn remove_from_recent(
@@ -178,6 +181,7 @@ pub async fn remove_from_recent(
     responses(
         (status = 200, description = "Recent items cleared")
     ),
+    security(("bearerAuth" = [])),
     tag = "recent"
 )]
 pub async fn clear_recent_items(
diff --git a/src/interfaces/api/handlers/search_handler.rs b/src/interfaces/api/handlers/search_handler.rs
index f6bd8844..16609a1a 100644
--- a/src/interfaces/api/handlers/search_handler.rs
+++ b/src/interfaces/api/handlers/search_handler.rs
@@ -299,6 +299,7 @@ pub struct SuggestParams {
         (status = 200, description = "Search results", body = SearchResultsDto),
         (status = 503, description = "Search service unavailable"),
     ),
+    security(("bearerAuth" = [])),
     tag = "search"
 )]
 pub async fn search_files_get(
@@ -317,6 +318,7 @@ pub async fn search_files_get(
         (status = 200, description = "Search results", body = SearchResultsDto),
         (status = 503, description = "Search service unavailable"),
     ),
+    security(("bearerAuth" = [])),
     tag = "search"
 )]
 pub async fn search_files_post(
@@ -339,6 +341,7 @@ pub async fn search_files_post(
         (status = 200, description = "Suggestions", body = SearchSuggestionsDto),
         (status = 503, description = "Search service unavailable"),
     ),
+    security(("bearerAuth" = [])),
     tag = "search"
 )]
 pub async fn suggest_files(
@@ -355,6 +358,7 @@ pub async fn suggest_files(
         (status = 200, description = "Cache cleared"),
         (status = 503, description = "Search service unavailable"),
     ),
+    security(("bearerAuth" = [])),
     tag = "search"
 )]
 pub async fn clear_search_cache(state: State<Arc<AppState>>) -> impl IntoResponse {
diff --git a/src/interfaces/api/handlers/share_handler.rs b/src/interfaces/api/handlers/share_handler.rs
index 2cc97852..b19bd9ee 100644
--- a/src/interfaces/api/handlers/share_handler.rs
+++ b/src/interfaces/api/handlers/share_handler.rs
@@ -63,6 +63,7 @@ pub struct VerifyPasswordRequest {
         (status = 201, description = "Share created", body = crate::application::dtos::share_dto::ShareDto),
         (status = 400, description = "Bad request")
     ),
+    security(("bearerAuth" = [])),
     tag = "shares"
 )]
 pub async fn create_shared_link(
@@ -85,6 +86,7 @@ pub async fn create_shared_link(
         (status = 200, description = "Share details", body = crate::application::dtos::share_dto::ShareDto),
         (status = 404, description = "Share not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "shares"
 )]
 pub async fn get_shared_link(
@@ -110,6 +112,7 @@ pub async fn get_shared_link(
     responses(
         (status = 200, description = "List of shares", body = Vec<crate::application::dtos::share_dto::ShareDto>)
     ),
+    security(("bearerAuth" = [])),
     tag = "shares"
 )]
 pub async fn get_user_shares(
@@ -163,6 +166,7 @@ pub async fn get_user_shares(
         (status = 200, description = "Share updated", body = crate::application::dtos::share_dto::ShareDto),
         (status = 404, description = "Share not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "shares"
 )]
 pub async fn update_shared_link(
@@ -193,6 +197,7 @@ pub async fn update_shared_link(
         (status = 204, description = "Share deleted"),
         (status = 404, description = "Share not found")
     ),
+    security(("bearerAuth" = [])),
     tag = "shares"
 )]
 pub async fn delete_shared_link(
diff --git a/src/interfaces/api/handlers/trash_handler.rs b/src/interfaces/api/handlers/trash_handler.rs
index 22d8f2fa..79b2c756 100644
--- a/src/interfaces/api/handlers/trash_handler.rs
+++ b/src/interfaces/api/handlers/trash_handler.rs
@@ -17,6 +17,7 @@ use std::sync::Arc;
         (status = 200, description = "List of trashed items"),
         (status = 501, description = "Trash feature not enabled")
     ),
+    security(("bearerAuth" = [])),
     tag = "trash"
 )]
 #[instrument(skip_all)]
@@ -71,6 +72,7 @@ pub async fn get_trash_items(
         (status = 200, description = "File moved to trash"),
         (status = 501, description = "Trash feature not enabled")
     ),
+    security(("bearerAuth" = [])),
     tag = "trash"
 )]
 #[instrument(skip_all)]
@@ -132,6 +134,7 @@ pub async fn move_file_to_trash(
         (status = 200, description = "Folder moved to trash"),
         (status = 501, description = "Trash feature not enabled")
     ),
+    security(("bearerAuth" = [])),
     tag = "trash"
 )]
 #[instrument(skip_all)]
@@ -195,6 +198,7 @@ pub async fn move_folder_to_trash(
         (status = 200, description = "Item restored from trash"),
         (status = 501, description = "Trash feature not enabled")
     ),
+    security(("bearerAuth" = [])),
     tag = "trash"
 )]
 #[instrument(skip_all)]
@@ -266,6 +270,7 @@ pub async fn restore_from_trash(
         (status = 200, description = "Item permanently deleted"),
         (status = 501, description = "Trash feature not enabled")
     ),
+    security(("bearerAuth" = [])),
     tag = "trash"
 )]
 #[instrument(skip_all)]
@@ -338,6 +343,7 @@ pub async fn delete_permanently(
         (status = 200, description = "Trash emptied successfully"),
         (status = 501, description = "Trash feature not enabled")
     ),
+    security(("bearerAuth" = [])),
     tag = "trash"
 )]
 #[instrument(skip_all)]
diff --git a/src/interfaces/api/mod.rs b/src/interfaces/api/mod.rs
index 1abdc793..31c68bc1 100644
--- a/src/interfaces/api/mod.rs
+++ b/src/interfaces/api/mod.rs
@@ -7,8 +7,8 @@ pub use routes::create_api_routes;
 pub use routes::create_health_routes;
 pub use routes::create_public_api_routes;
 
-use utoipa::{Modify, OpenApi};
 use utoipa::openapi::security::{Http, HttpAuthScheme, SecurityScheme};
+use utoipa::{Modify, OpenApi};
 
 use crate::application::dtos::contact_dto::{
     AddressDto, ContactDto, ContactGroupDto, EmailDto, PhoneDto,
@@ -47,6 +47,7 @@ use crate::application::dtos::user_dto::{
 use crate::application::ports::chunked_upload_ports::{
     ChunkUploadResponseDto, CreateUploadResponseDto, UploadStatusResponseDto,
 };
+use crate::interfaces::api::handlers::auth_handler::SystemStatus;
 use crate::interfaces::api::handlers::chunked_upload_handler::{
     CompleteUploadResponse, CreateUploadRequest,
 };
@@ -57,7 +58,6 @@ use crate::interfaces::api::handlers::contacts_handler::{
 use crate::interfaces::api::handlers::dedup_handler::{
     DedupUploadResponse, HashCheckResponse, StatsResponse,
 };
-use crate::interfaces::api::handlers::auth_handler::SystemStatus;
 use crate::interfaces::api::handlers::file_handler::MoveFilePayload;
 
 #[derive(OpenApi)]