diff --git a/src/c3nav/api/newapi.py b/src/c3nav/api/newapi.py
index 60ec3d0f..a8a4124d 100644
--- a/src/c3nav/api/newapi.py
+++ b/src/c3nav/api/newapi.py
@@ -9,8 +9,8 @@ class APITokenSchema(Schema):
     token: str
 
 
-@auth_api_router.get('/session/', response=APITokenSchema,
+@auth_api_router.get('/session/', response=APITokenSchema, auth=None,
                      summary="Get session API token")
 def session_token(request):
-    print()
-    return {"token": request.COOKIES.get(settings.SESSION_COOKIE_NAME, 'anonymous')}
+    session_id = request.COOKIES.get(settings.SESSION_COOKIE_NAME, None)
+    return {"token": "anonymous" if session_id is None else f"session:{session_id}"}
diff --git a/src/c3nav/api/urls.py b/src/c3nav/api/urls.py
index 21eb8617..0b952abd 100644
--- a/src/c3nav/api/urls.py
+++ b/src/c3nav/api/urls.py
@@ -10,7 +10,9 @@ from rest_framework.response import Response
 from rest_framework.routers import SimpleRouter
 
 from c3nav.api.api import SessionViewSet
+from c3nav.api.exceptions import CustomAPIException
 from c3nav.api.newapi import auth_api_router
+from c3nav.api.newauth import BearerAuth
 from c3nav.editor.api import ChangeSetViewSet, EditorViewSet
 from c3nav.mapdata.api import (AccessRestrictionGroupViewSet, AccessRestrictionViewSet, AreaViewSet, BuildingViewSet,
                                ColumnViewSet, CrossDescriptionViewSet, DoorViewSet, DynamicLocationPositionViewSet,
@@ -21,13 +23,22 @@ from c3nav.mapdata.api import (AccessRestrictionGroupViewSet, AccessRestrictionV
 from c3nav.mapdata.utils.user import can_access_editor
 from c3nav.mesh.api import FirmwareViewSet
 from c3nav.mesh.newapi import api_router as mesh_api_router
+from c3nav.mapdata.newapi import api_router as mapdata_api_router
 from c3nav.routing.api import RoutingViewSet
 
 ninja_api = NinjaAPI(
     title="c3nav API",
     version="v2",
     docs_url="/",
+    auth=BearerAuth(),
 )
+
+
+@ninja_api.exception_handler(CustomAPIException)
+def on_invalid_token(request, exc):
+    return ninja_api.create_response(request, {"detail": exc.detail}, status=exc.status_code)
+
+
 ninja_api.add_router("/auth/", auth_api_router)
 ninja_api.add_router("/mesh/", mesh_api_router)
 
diff --git a/src/c3nav/mesh/newapi.py b/src/c3nav/mesh/newapi.py
index d42ff014..c30ff48d 100644
--- a/src/c3nav/mesh/newapi.py
+++ b/src/c3nav/mesh/newapi.py
@@ -5,6 +5,7 @@ from ninja import Router as APIRouter
 from ninja import Schema
 from ninja.pagination import paginate
 
+from c3nav.api.newauth import auth_responses
 from c3nav.mesh.dataformats import BoardType
 from c3nav.mesh.messages import ChipType
 from c3nav.mesh.models import FirmwareVersion
@@ -38,15 +39,15 @@ class Error(Schema):
     detail: str
 
 
-@api_router.get('/firmwares/', response=list[FirmwareSchema],
-                summary="List available firmwares")
+@api_router.get('/firmwares/', summary="List available firmwares",
+                response={200: list[FirmwareSchema], **auth_responses})
 @paginate
 def firmware_list(request):
     return FirmwareVersion.objects.all()
 
 
-@api_router.get('/firmwares/{firmware_id}/', response={200: FirmwareSchema, 404: Error},
-                summary="Get specific firmware")
+@api_router.get('/firmwares/{firmware_id}/', summary="Get specific firmware",
+                response={200: FirmwareSchema, **auth_responses})
 def firmware_detail(request, firmware_id: int):
     try:
         return FirmwareVersion.objects.get(id=firmware_id)