diff --git a/src/node/routes/vscode.ts b/src/node/routes/vscode.ts
index 3ff64a179604..f8c048c6f036 100644
--- a/src/node/routes/vscode.ts
+++ b/src/node/routes/vscode.ts
@@ -210,7 +210,7 @@ router.get("/manifest.json", async (req, res) => {
 })
 
 let mintKeyPromise: Promise<Buffer> | undefined
-router.post("/mint-key", async (req, res) => {
+router.post("/mint-key", ensureAuthenticated, async (req, res) => {
   if (!mintKeyPromise) {
     mintKeyPromise = new Promise(async (resolve) => {
       const keyPath = path.join(req.args["user-data-dir"], "serve-web-key-half")
diff --git a/test/unit/node/routes/vscode.test.ts b/test/unit/node/routes/vscode.test.ts
index a5a4fb72da7a..80feefd99be2 100644
--- a/test/unit/node/routes/vscode.test.ts
+++ b/test/unit/node/routes/vscode.test.ts
@@ -4,11 +4,19 @@ import * as integration from "../../../utils/integration"
 
 describe("vscode", () => {
   let codeServer: httpserver.HttpServer | undefined
+  // TODO: Support setting this as an argument for tests.
+  const previousEnvPassword = process.env.PASSWORD
   beforeEach(() => {
+    process.env.PASSWORD = "test"
     mockLogger()
   })
 
   afterEach(async () => {
+    if (typeof previousEnvPassword !== "undefined") {
+      process.env.PASSWORD = previousEnvPassword
+    } else {
+      delete process.env.PASSWORD
+    }
     if (codeServer) {
       await codeServer.dispose()
       codeServer = undefined
@@ -27,4 +35,10 @@ describe("vscode", () => {
       })
     }).rejects.toThrow()
   })
+
+  it("should require auth", async () => {
+    codeServer = await integration.setup(["--auth=password"], "")
+    let resp = await codeServer.fetch("/mint-key", { method: "POST" })
+    expect(resp.status).toBe(401)
+  })
 })