diff --git a/app/Http/Middleware/QueryTokenAuth.php b/app/Http/Middleware/QueryTokenAuth.php
new file mode 100644
index 0000000..df3e90a
--- /dev/null
+++ b/app/Http/Middleware/QueryTokenAuth.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class QueryTokenAuth
+{
+    public function handle(Request $request, Closure $next)
+    {
+        if ($request->has('token') && !$request->headers->has('Authorization')) {
+            $request->headers->set('Authorization', 'Bearer ' . $request->query('token'));
+        }
+
+        return $next($request);
+    }
+}
diff --git a/resources/views/admin/qr-batches.blade.php b/resources/views/admin/qr-batches.blade.php
index be082d1..a5225db 100644
--- a/resources/views/admin/qr-batches.blade.php
+++ b/resources/views/admin/qr-batches.blade.php
@@ -101,6 +101,7 @@
             rows.innerHTML = `<tr><td colspan="8" class="py-10 text-center text-sm text-neutral-400">No batches yet. Generate your first one.</td></tr>`;
             return;
         }
+        const token = localStorage.getItem('verde:token') ?? '';
         rows.innerHTML = items.map(b => {
             const sc = b.status_counts ?? {};
             const printed = b.printed_at
@@ -115,7 +116,7 @@
                 <td>${sc.used ?? 0}</td>
                 <td>${printed}</td>
                 <td class="text-right space-x-1">
-                    <a href="/api/v1/admin/qr-batches/${b.batch_number}/print.pdf" target="_blank" class="btn-ghost px-3 py-1 text-xs">PDF</a>
+                    <a href="/api/v1/admin/qr-batches/${b.batch_number}/print.pdf?token=${token}" target="_blank" class="btn-ghost px-3 py-1 text-xs">PDF</a>
                     ${!b.printed_at ? `<button data-action="mark-printed" data-id="${b.batch_number}" class="btn-ghost px-3 py-1 text-xs">Mark printed</button>` : ''}
                 </td>
             </tr>`;
diff --git a/routes/api.php b/routes/api.php
index 7f4db8b..ceb49b1 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -51,6 +51,7 @@ use App\Http\Controllers\Api\V1\Qr\MyQrCodeController;
 use App\Http\Controllers\Api\V1\Store\PartnerStorePublicController;
 use App\Http\Controllers\Api\V1\Tenant\TenantLookupController;
 use App\Http\Controllers\Api\V1\Scanner\ScannerController;
+use App\Http\Middleware\QueryTokenAuth;
 use Illuminate\Support\Facades\Route;
 
 /*
@@ -226,9 +227,16 @@ Route::prefix('admin/qr-batches')
         Route::post('/', [AdminQrBatchController::class, 'store'])->name('store');
         Route::get('/{qr_code_batch}', [AdminQrBatchController::class, 'show'])->name('show');
         Route::post('/{qr_code_batch}/mark-printed', [AdminQrBatchController::class, 'markPrinted'])->name('mark-printed');
-        Route::get('/{qr_code_batch}/print.pdf', [AdminQrBatchController::class, 'printPdf'])->name('print-pdf');
     });
 
+Route::get('admin/qr-batches/{qr_code_batch}/print.pdf', [AdminQrBatchController::class, 'printPdf'])
+    ->middleware([
+        QueryTokenAuth::class,
+        'auth:sanctum',
+        'role:admin,super_admin'
+    ])
+    ->name('api.v1.admin.qr-batches.print-pdf');
+
 Route::prefix('admin/qr-codes')
     ->name('api.v1.admin.qr-codes.')
     ->middleware(['auth:sanctum', 'role:admin'])