diff --git a/tests/test_ocr_and_interact.py b/tests/test_ocr_and_interact.py
index 632f6cc..ef5f813 100644
--- a/tests/test_ocr_and_interact.py
+++ b/tests/test_ocr_and_interact.py
@@ -5,9 +5,17 @@ from fastapi.testclient import TestClient
 
 from server import services
 from server.app import app
+from server.config import SETTINGS
 from server.models import ClickTextAction
 
 
+def _auth_headers() -> dict:
+    token = SETTINGS.get("token", "")
+    if not token:
+        return {}
+    return {"x-clickthrough-token": token}
+
+
 def test_extract_ocr_items_normalization(monkeypatch):
     class FakeOutput:
         DICT = "DICT"
@@ -81,6 +89,7 @@ def test_interact_click_text_region_optional(monkeypatch):
     response = client.post(
         "/interact",
         json={"screen": 0, "action": {"action": "click_text", "dry_run": True, "click_text": {"text": "Apply", "match": "contains"}}},
+        headers=_auth_headers(),
     )
     assert response.status_code == 200
     body = response.json()["data"]
@@ -97,10 +106,10 @@ def test_see_ocr_off_on_contract(monkeypatch):
     monkeypatch.setattr("server.app.extract_ocr_items", lambda *args, **kwargs: [{"text": "x"}])
 
     client = TestClient(app)
-    off = client.post("/see", json={"ocr": False, "with_grid": False})
+    off = client.post("/see", json={"ocr": False, "with_grid": False}, headers=_auth_headers())
     assert off.status_code == 200
     assert "ocr" not in off.json()["data"]["meta"]
-    on = client.post("/see", json={"ocr": True, "with_grid": False})
+    on = client.post("/see", json={"ocr": True, "with_grid": False}, headers=_auth_headers())
     assert on.status_code == 200
     assert on.json()["data"]["meta"]["ocr"][0]["text"] == "x"
 
@@ -121,7 +130,7 @@ def test_interact_verify_success_and_timeout(monkeypatch):
         "check_interval_ms": 10,
         "timeout_ms": 500,
     }
-    ok_resp = client.post("/interact/verify", json=payload)
+    ok_resp = client.post("/interact/verify", json=payload, headers=_auth_headers())
     assert ok_resp.status_code == 200
     ok_data = ok_resp.json()["data"]
     assert ok_data["verified"] is True
@@ -132,7 +141,7 @@ def test_interact_verify_success_and_timeout(monkeypatch):
         "_verify_ocr_text_near_point",
         lambda _spec: {"ok": False, "matches": [], "items_count": 0, "screen": {"selected": 0}, "region": {"x": 0, "y": 0, "width": 1, "height": 1}},
     )
-    timeout_resp = client.post("/interact/verify", json=payload)
+    timeout_resp = client.post("/interact/verify", json=payload, headers=_auth_headers())
     assert timeout_resp.status_code == 200
     timeout_data = timeout_resp.json()["data"]
     assert timeout_data["verified"] is False