diff --git a/src/main.go b/src/main.go
index 85467aa..ca18bf2 100644
--- a/src/main.go
+++ b/src/main.go
@@ -167,27 +167,28 @@ func main() {
 	bearerAuth := admin.TokenAuthMiddleware(cfg.Admin.SecretToken)
 	adminAuth := func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			// First, try session-based authentication
-			cookie, err := r.Cookie("nextwks_session")
-			if err == nil && cookie != nil {
-				session, err := sessionStore.ValidateSession(cookie.Value)
-				if err == nil && session != nil {
-					isAdmin, _ := roleChecker.IsAdmin(session.UserID)
-					if isAdmin {
-						ctx := context.WithValue(r.Context(), auth.ContextUserID, session.UserID)
-						ctx = context.WithValue(ctx, auth.ContextRole, "admin")
-						next.ServeHTTP(w, r.WithContext(ctx))
-						return
-					} else {
-						ctx := context.WithValue(r.Context(), auth.ContextUserID, session.UserID)
-						ctx = context.WithValue(ctx, auth.ContextRole, "user")
-						next.ServeHTTP(w, r.WithContext(ctx))
-						return
-					}
-				}
+			if token := r.Header.Get("Authorization"); token != "" {
+				bearerAuth(next).ServeHTTP(w, r)
+				return
 			}
-			// Fall back to bearer token
-			bearerAuth(next).ServeHTTP(w, r)
+			cookie, err := r.Cookie("nextwks_session")
+			if err != nil || cookie == nil {
+				oidcHandler.LoginRedirect(w, r)
+				return
+			}
+			session, err := sessionStore.ValidateSession(cookie.Value)
+			if err != nil || session == nil {
+				oidcHandler.LoginRedirect(w, r)
+				return
+			}
+			isAdmin, _ := roleChecker.IsAdmin(session.UserID)
+			if isAdmin {
+				ctx := context.WithValue(r.Context(), auth.ContextUserID, session.UserID)
+				ctx = context.WithValue(ctx, auth.ContextRole, "admin")
+				next.ServeHTTP(w, r.WithContext(ctx))
+				return
+			}
+			http.Error(w, "{\"error\":\"admin access required\"}", http.StatusForbidden)
 		})
 	}