diff --git a/policies/filters.go b/policies/filters.go
index 6c56fba..a3bc213 100644
--- a/policies/filters.go
+++ b/policies/filters.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"slices"
 
+	"github.com/fiatjaf/khatru"
 	"github.com/nbd-wtf/go-nostr"
 )
 
@@ -18,6 +19,14 @@ func NoComplexFilters(ctx context.Context, filter nostr.Filter) (reject bool, ms
 	return false, ""
 }
 
+// MustAuth requires all subscribers to be authenticated
+func MustAuth(ctx context.Context, filter nostr.Filter) (reject bool, msg string) {
+	if khatru.GetAuthed(ctx) == "" {
+		return true, "auth-required: all requests must be authenticated"
+	}
+	return false, ""
+}
+
 // NoEmptyFilters disallows filters that don't have at least a tag, a kind, an author or an id.
 func NoEmptyFilters(ctx context.Context, filter nostr.Filter) (reject bool, msg string) {
 	c := len(filter.Kinds) + len(filter.IDs) + len(filter.Authors)