diff --git a/routes/routes.go b/routes/routes.go
index 95ac9d8..33c465e 100644
--- a/routes/routes.go
+++ b/routes/routes.go
@@ -373,9 +373,13 @@ func RegisterRoutes(app *fiber.App, cfg *config.Config) {
 	api.Post("/pricing/check", controllers.CheckPrice)
 
 	// --------------------
-	// BOOKING CACHE APIS — no auth required (testing)
+	// BOOKING CACHE APIS — console/ops only
 	// --------------------
-	bookingCache := api.Group("/bookings/cache")
+	// Previously open "for testing", but live: listing the cache returns real
+	// bookings including customer delivery addresses, and the per-customer route
+	// takes a customer id straight from the URL. Behind console auth now.
+	bookingCache := api.Group("/bookings/cache",
+		middlewares.AuthMiddleware(cfg), middlewares.RoleCheckMiddleware(1, 3, 4))
 	bookingCache.Get("/", controllers.ListAllBookingsFromCache)
 	bookingCache.Get("/customer/:customer_id", controllers.GetCustomerBookingsFromCache)
 	bookingCache.Get("/:booking_id", controllers.GetBookingFromCache)