diff --git a/platform/wab/src/wab/server/db/DbMgr.spec.ts b/platform/wab/src/wab/server/db/DbMgr.spec.ts
index e1cdac1da08..ad3616e46b9 100644
--- a/platform/wab/src/wab/server/db/DbMgr.spec.ts
+++ b/platform/wab/src/wab/server/db/DbMgr.spec.ts
@@ -20,6 +20,7 @@ import {
   User,
 } from "@/wab/server/entities/Entities";
 import { createTeam as createTeamRoute } from "@/wab/server/routes/teams";
+import { UnauthorizedError } from "@/wab/shared/ApiErrors/errors";
 import {
   CmsMetaType,
   CmsTableId,
@@ -1993,6 +1994,20 @@ describe("DbMgr.user", () => {
       );
     });
   });
+
+  it("rejects personal API token calls from anonymous users", () =>
+    withDb(async (_sudo, _users, [userMgr], _project, entMgr) => {
+      const anonMgr = new DbMgr(entMgr, ANON_USER);
+      await expect(anonMgr.listPersonalApiTokens()).rejects.toBeInstanceOf(
+        UnauthorizedError,
+      );
+      await expect(anonMgr.createPersonalApiToken()).rejects.toBeInstanceOf(
+        UnauthorizedError,
+      );
+
+      await userMgr().createPersonalApiToken();
+      expect(await userMgr().listPersonalApiTokens()).toHaveLength(1);
+    }));
 });
 
 describe("DbMgr organization entitlements", () => {
diff --git a/platform/wab/src/wab/server/db/DbMgr.ts b/platform/wab/src/wab/server/db/DbMgr.ts
index 25256e3685c..bae65cab26e 100644
--- a/platform/wab/src/wab/server/db/DbMgr.ts
+++ b/platform/wab/src/wab/server/db/DbMgr.ts
@@ -6526,7 +6526,10 @@ export class DbMgr implements MigrationDbMgr {
     if (this.actor.type === "SuperUser" && !userId) {
       throw new Error("Super user must specify userId to use");
     }
-    return ensure(userId, "User id should exist");
+    if (!userId) {
+      throw new UnauthorizedError("Must be logged in");
+    }
+    return userId;
   }
 
   isUserIdSelf(userId?: string) {