diff --git a/backend/app/Exceptions/Handler.php b/backend/app/Exceptions/Handler.php
index 56af264..68c889d 100644
--- a/backend/app/Exceptions/Handler.php
+++ b/backend/app/Exceptions/Handler.php
@@ -2,7 +2,9 @@
 
 namespace App\Exceptions;
 
+use Illuminate\Auth\AuthenticationException;
 use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler;
+use Illuminate\Http\JsonResponse;
 use Throwable;
 
 class Handler extends ExceptionHandler
@@ -27,4 +29,14 @@ public function register(): void
             //
         });
     }
+
+    /**
+     * This app is a pure JSON API (SPA frontend, no server-rendered login route),
+     * so unauthenticated requests always get a 401 JSON response instead of
+     * Laravel's default redirect-to-login fallback.
+     */
+    protected function unauthenticated($request, AuthenticationException $exception): JsonResponse
+    {
+        return response()->json(['message' => $exception->getMessage()], 401);
+    }
 }