diff --git a/src/integrations/supabase/auth-client-middleware.ts b/src/integrations/supabase/auth-client-middleware.ts
new file mode 100644
index 0000000..c833505
--- /dev/null
+++ b/src/integrations/supabase/auth-client-middleware.ts
@@ -0,0 +1,16 @@
+import { createMiddleware } from "@tanstack/react-start";
+import { supabase } from "./client";
+
+// Client-side middleware for server functions: forwards the current
+// Supabase access token as a Bearer Authorization header so that the
+// server-side `requireSupabaseAuth` middleware can authenticate the request.
+export const attachSupabaseAuth = createMiddleware({ type: "function" }).client(
+  async ({ next }) => {
+    const { data } = await supabase.auth.getSession();
+    const token = data.session?.access_token;
+    return next({
+      sendContext: {},
+      headers: token ? { Authorization: `Bearer ${token}` } : {},
+    });
+  },
+);
diff --git a/src/lib/payments.functions.ts b/src/lib/payments.functions.ts
index ef3984a..4a759c7 100644
--- a/src/lib/payments.functions.ts
+++ b/src/lib/payments.functions.ts
@@ -1,6 +1,7 @@
 import { createServerFn } from "@tanstack/react-start";
 import { getRequestHost } from "@tanstack/react-start/server";
 import { requireSupabaseAuth } from "@/integrations/supabase/auth-middleware";
+import { attachSupabaseAuth } from "@/integrations/supabase/auth-client-middleware";
 import { supabaseAdmin } from "@/integrations/supabase/client.server";
 import Stripe from "stripe";
 
@@ -30,7 +31,7 @@ function getOrigin() {
 }
 
 export const createPaymentRequest = createServerFn({ method: "POST" })
-  .middleware([requireSupabaseAuth])
+  .middleware([attachSupabaseAuth, requireSupabaseAuth])
   .inputValidator(
     (data: {
       recipient_name: string;
@@ -121,7 +122,7 @@ export const createPaymentRequest = createServerFn({ method: "POST" })
   });
 
 export const refreshPaymentStatus = createServerFn({ method: "POST" })
-  .middleware([requireSupabaseAuth])
+  .middleware([attachSupabaseAuth, requireSupabaseAuth])
   .inputValidator((data: { id: string }) => data)
   .handler(async ({ data }) => {
     const { data: row } = await supabaseAdmin
@@ -149,7 +150,7 @@ export const refreshPaymentStatus = createServerFn({ method: "POST" })
   });
 
 export const markPaymentEmailSent = createServerFn({ method: "POST" })
-  .middleware([requireSupabaseAuth])
+  .middleware([attachSupabaseAuth, requireSupabaseAuth])
   .inputValidator((data: { id: string }) => data)
   .handler(async ({ data }) => {
     await supabaseAdmin
@@ -160,7 +161,7 @@ export const markPaymentEmailSent = createServerFn({ method: "POST" })
   });
 
 export const cancelPaymentRequest = createServerFn({ method: "POST" })
-  .middleware([requireSupabaseAuth])
+  .middleware([attachSupabaseAuth, requireSupabaseAuth])
   .inputValidator((data: { id: string }) => data)
   .handler(async ({ data }) => {
     await supabaseAdmin