diff --git a/delivery/controller/backbone_controller.go b/delivery/controller/backbone_controller.go
index a5973f3..162242a 100644
--- a/delivery/controller/backbone_controller.go
+++ b/delivery/controller/backbone_controller.go
@@ -2,6 +2,7 @@ package controller
 
 import (
 	"net/http"
+	"users_management/m/middleware"
 	"users_management/m/model/dto/req"
 	"users_management/m/usecase"
 	"users_management/m/utils/common"
@@ -17,10 +18,13 @@ type BackboneController struct {
 
 func (bc *BackboneController) Route() {
 	rg := bc.rg.Group("/backbone")
-	rg.GET("", bc.GetBackbone())
-	rg.POST("", bc.CreateBackbone())
-	rg.GET("/:uuid", bc.GetBackboneByID())
-	rg.PUT("/:uuid", bc.UpdateBackbone())
+	rg.Use(middleware.AuthMiddleware())
+	{
+		rg.GET("", bc.GetBackbone())
+		rg.POST("", bc.CreateBackbone())
+		rg.GET("/:uuid", bc.GetBackboneByID())
+		rg.PUT("/:uuid", bc.UpdateBackbone())
+	}
 }
 
 func NewBackboneController(bu usecase.BackboneUseCase, rg *gin.RouterGroup) *BackboneController {
diff --git a/delivery/controller/devicePort_controller.go b/delivery/controller/devicePort_controller.go
index d5502ec..0216e00 100644
--- a/delivery/controller/devicePort_controller.go
+++ b/delivery/controller/devicePort_controller.go
@@ -2,6 +2,7 @@ package controller
 
 import (
 	"net/http"
+	"users_management/m/middleware"
 	"users_management/m/model/dto/req"
 	"users_management/m/usecase"
 	"users_management/m/utils/common"
@@ -17,10 +18,13 @@ type DevicePortController struct {
 
 func (dc *DevicePortController) Route() {
 	rg := dc.rg.Group("/device-port")
-	rg.GET("", dc.GetDevicePort())
-	rg.POST("", dc.CreateDevicePort())
-	rg.GET("/:uuid", dc.GetDevicePortByID())
-	rg.PUT("/:uuid", dc.UpdateDevicePort())
+	rg.Use(middleware.AuthMiddleware())
+	{
+		rg.GET("", dc.GetDevicePort())
+		rg.POST("", dc.CreateDevicePort())
+		rg.GET("/:uuid", dc.GetDevicePortByID())
+		rg.PUT("/:uuid", dc.UpdateDevicePort())
+	}
 }
 
 func NewDevicePortController(du usecase.DevicePortUseCase, rg *gin.RouterGroup) *DevicePortController {
diff --git a/delivery/controller/devices_controller.go b/delivery/controller/devices_controller.go
index 90ea99d..680a96a 100644
--- a/delivery/controller/devices_controller.go
+++ b/delivery/controller/devices_controller.go
@@ -2,6 +2,7 @@ package controller
 
 import (
 	"net/http"
+	"users_management/m/middleware"
 	"users_management/m/model/dto/req"
 	"users_management/m/usecase"
 	"users_management/m/utils/common"
@@ -17,10 +18,13 @@ type DeviceController struct {
 
 func (dc *DeviceController) Route() {
 	rg := dc.rg.Group("/devices")
-	rg.POST("", dc.CreateDevice())
-	rg.GET("", dc.GetAllDevices())
-	rg.GET("/:uuid", dc.GetDeviceByID())
-	rg.PUT("/:uuid", dc.UpdateDevice())
+	rg.Use(middleware.AuthMiddleware())
+	{
+		rg.POST("", dc.CreateDevice())
+		rg.GET("", dc.GetAllDevices())
+		rg.GET("/:uuid", dc.GetDeviceByID())
+		rg.PUT("/:uuid", dc.UpdateDevice())
+	}
 }
 
 func NewDeviceController(du usecase.DeviceUseCase, rg *gin.RouterGroup) *DeviceController {
diff --git a/delivery/controller/fishbone_controller.go b/delivery/controller/fishbone_controller.go
index 9935ead..ca9f8f4 100644
--- a/delivery/controller/fishbone_controller.go
+++ b/delivery/controller/fishbone_controller.go
@@ -2,6 +2,7 @@ package controller
 
 import (
 	"net/http"
+	"users_management/m/middleware"
 	"users_management/m/model/dto/req"
 	"users_management/m/usecase"
 	"users_management/m/utils/common"
@@ -17,10 +18,13 @@ type FishboneController struct {
 
 func (fc *FishboneController) Route() {
 	rg := fc.rg.Group("/fishbone")
-	rg.GET("", fc.GetFishbone())
-	rg.POST("", fc.CreateFishbone())
-	rg.GET("/:uuid", fc.GetFishboneByID())
-	rg.PUT("/:uuid", fc.UpdateFishbone())
+	rg.Use(middleware.AuthMiddleware())
+	{
+		rg.GET("", fc.GetFishbone())
+		rg.POST("", fc.CreateFishbone())
+		rg.GET("/:uuid", fc.GetFishboneByID())
+		rg.PUT("/:uuid", fc.UpdateFishbone())
+	}
 }
 
 func NewFishboneController(fu usecase.FishboneUseCase, rg *gin.RouterGroup) *FishboneController {
diff --git a/delivery/controller/tower_controller.go b/delivery/controller/tower_controller.go
index c342435..93869f0 100644
--- a/delivery/controller/tower_controller.go
+++ b/delivery/controller/tower_controller.go
@@ -2,6 +2,7 @@ package controller
 
 import (
 	"net/http"
+	"users_management/m/middleware"
 	"users_management/m/model/dto/req"
 	"users_management/m/usecase"
 	"users_management/m/utils/common"
@@ -17,10 +18,13 @@ type TowerController struct {
 
 func (tc *TowerController) Route() {
 	rg := tc.rg.Group("/tower")
-	rg.GET("", tc.GetTower())
-	rg.POST("", tc.CreateTower())
-	rg.GET("/:uuid", tc.GetTowerByID())
-	rg.PUT("/:uuid", tc.UpdateTower())
+	rg.Use(middleware.AuthMiddleware())
+	{
+		rg.GET("", tc.GetTower())
+		rg.POST("", tc.CreateTower())
+		rg.GET("/:uuid", tc.GetTowerByID())
+		rg.PUT("/:uuid", tc.UpdateTower())
+	}
 }
 
 func NewTowerController(tu usecase.TowerUseCase, rg *gin.RouterGroup) *TowerController {
diff --git a/delivery/server.go b/delivery/server.go
index 3379c78..b6b0afa 100644
--- a/delivery/server.go
+++ b/delivery/server.go
@@ -5,6 +5,7 @@ import (
 	"users_management/m/config"
 	"users_management/m/delivery/controller"
 	"users_management/m/manager"
+	"users_management/m/middleware"
 	"users_management/m/utils/common"
 
 	"github.com/gin-gonic/gin"
@@ -43,11 +44,14 @@ func NewServer() *Server {
 func (s *Server) setupController() {
 	rg := s.engine.Group("/api/v1")
 	controller.NewUsersController(s.ucManager.NewUserUsecase(), s.ucManager.NewAuthUsecase(),rg).Route()
-	controller.NewDeviceController(s.ucManager.NewDeviceUsecase(), rg).Route()
-	controller.NewBackboneController(s.ucManager.NewBackboneUsecase(), rg).Route()
-	controller.NewFishboneController(s.ucManager.NewFishboneUsecase(), rg).Route()
-	controller.NewTowerController(s.ucManager.NewTowerUsecase(), rg).Route()
-	controller.NewDevicePortController(s.ucManager.NewDevicePortUsecase(), rg).Route()
+	rg.Use(middleware.AuthMiddleware())
+	{
+		controller.NewDeviceController(s.ucManager.NewDeviceUsecase(), rg).Route()
+		controller.NewBackboneController(s.ucManager.NewBackboneUsecase(), rg).Route()
+		controller.NewFishboneController(s.ucManager.NewFishboneUsecase(), rg).Route()
+		controller.NewTowerController(s.ucManager.NewTowerUsecase(), rg).Route()
+		controller.NewDevicePortController(s.ucManager.NewDevicePortUsecase(), rg).Route()
+	}
 }
 
 func (s *Server) Run() {
diff --git a/go.mod b/go.mod
index 0fcf7c3..fcd0657 100644
--- a/go.mod
+++ b/go.mod
@@ -15,6 +15,7 @@ require (
 	github.com/bytedance/sonic v1.12.8 // indirect
 	github.com/bytedance/sonic/loader v0.2.3 // indirect
 	github.com/cloudwego/base64x v0.1.5 // indirect
+	github.com/dgrijalva/jwt-go v3.2.0+incompatible // indirect
 	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
 	github.com/gin-contrib/sse v1.0.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
diff --git a/middleware/auth_middleware.go b/middleware/auth_middleware.go
new file mode 100644
index 0000000..d2878c9
--- /dev/null
+++ b/middleware/auth_middleware.go
@@ -0,0 +1,56 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+	
+	"users_management/m/utils/common"
+
+	"github.com/gin-gonic/gin"
+)
+
+func AuthMiddleware() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		token := c.GetHeader("Authorization")
+
+		if token == "" {
+			common.ErrorResponses(c, http.StatusUnauthorized, "authorization token required")
+			c.Abort()
+			return
+		}
+
+		token = strings.TrimPrefix(token, "Bearer ")
+
+		c.Set("token", token)
+
+		req, err := http.NewRequest("POST", "https://demo.api-hrm.winteraccess.id/api/v2/auth/me", nil)
+
+		if err != nil {
+			common.ErrorResponses(c, http.StatusInternalServerError, err.Error())
+			c.Abort()
+			return
+		}
+
+		req.Header.Set("Authorization", "Bearer "+token)
+		req.Header.Set("Accept", "application/json")
+
+		client := &http.Client{}
+
+		resp, err := client.Do(req)
+		if err != nil {
+			common.ErrorResponses(c, http.StatusInternalServerError, err.Error())
+			c.Abort()
+			return
+		}
+
+		defer resp.Body.Close()
+		if resp.StatusCode != http.StatusOK {
+			common.ErrorResponses(c, http.StatusUnauthorized, "Unauthroized")
+			c.Abort()
+			return
+		}
+
+		c.Next()
+
+	}
+}