diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 64e6bfa..c9d8537 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -273,10 +273,13 @@ func CheckAuthHandler(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"authenticated": authenticated})
 }
 
-// AuthRequired checks if API authentication is configured
+// AuthRequired checks if single-user authentication is configured, by either
+// an API key or a username/password pair.
 func AuthRequired() bool {
 	envApiKey := config.Get("API_KEY", "")
-	return envApiKey != ""
+	envUsername := config.Get("AUTH_USERNAME", "")
+	envPassword := config.Get("AUTH_PASSWORD", "")
+	return envApiKey != "" || (envUsername != "" && envPassword != "")
 }
 
 // CheckSingleUserPaired checks if rmapi.conf exists for single-user mode
diff --git a/internal/auth/middleware.go b/internal/auth/middleware.go
index d5aa9f5..f74dc07 100644
--- a/internal/auth/middleware.go
+++ b/internal/auth/middleware.go
@@ -7,7 +7,6 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/google/uuid"
-	"github.com/rmitchellscott/aviary/internal/config"
 	"github.com/rmitchellscott/aviary/internal/database"
 )
 
@@ -84,12 +83,7 @@ func OptionalAuthMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		if !database.IsMultiUserMode() {
 			// In single-user mode, skip auth if not configured
-			envApiKey := config.Get("API_KEY", "")
-			envUsername := config.Get("AUTH_USERNAME", "")
-			envPassword := config.Get("AUTH_PASSWORD", "")
-			authConfigured := envApiKey != "" || (envUsername != "" && envPassword != "")
-
-			if !authConfigured {
+			if !AuthRequired() {
 				c.Next()
 				return
 			}