diff --git a/apps/web/src/middleware.ts b/apps/web/src/middleware.ts
index b07307b0..a6cb2574 100644
--- a/apps/web/src/middleware.ts
+++ b/apps/web/src/middleware.ts
@@ -1,18 +1,30 @@
 import { NextRequest, NextResponse } from "next/server";
 import { GITHUB_TOKEN_COOKIE } from "@open-swe/shared/constants";
+import { verifyGithubUser } from "@open-swe/shared/github/verify-user";
+
+export async function middleware(request: NextRequest) {
+  const token = request.cookies.get(GITHUB_TOKEN_COOKIE)?.value;
+  const user = token ? await verifyGithubUser(token) : null;
 
-export function middleware(request: NextRequest) {
   if (request.nextUrl.pathname === "/") {
-    const token = request.cookies.get(GITHUB_TOKEN_COOKIE)?.value;
-    if (token && token.length > 0) {
+    if (user) {
       const url = request.nextUrl.clone();
       url.pathname = "/chat";
       return NextResponse.redirect(url);
     }
   }
+
+  if (request.nextUrl.pathname.startsWith("/chat")) {
+    if (!user) {
+      const url = request.nextUrl.clone();
+      url.pathname = "/";
+      return NextResponse.redirect(url);
+    }
+  }
+
   return NextResponse.next();
 }
 
 export const config = {
-  matcher: ["/"],
+  matcher: ["/", "/chat/:path*"],
 };
diff --git a/apps/web/src/providers/Stream.tsx b/apps/web/src/providers/Stream.tsx
index e87f6dba..05b1dd4f 100644
--- a/apps/web/src/providers/Stream.tsx
+++ b/apps/web/src/providers/Stream.tsx
@@ -37,17 +37,18 @@ const StreamSession = ({ children }: { children: ReactNode }) => {
   const [customEvents, setCustomEvents] = useState<CustomNodeEvent[]>([]);
   const { refreshThreads } = useThreadsContext();
 
+  if (
+    !process.env.NEXT_PUBLIC_API_URL ||
+    !process.env.NEXT_PUBLIC_MANAGER_ASSISTANT_ID
+  ) {
+    throw new Error(
+      "Both NEXT_PUBLIC_API_URL and NEXT_PUBLIC_MANAGER_ASSISTANT_ID environment variables must be defined.",
+    );
+  }
+
   const streamValue = useTypedStream({
-    apiUrl:
-      process.env.NEXT_PUBLIC_API_URL ??
-      (() => {
-        throw new Error("NEXT_PUBLIC_API_URL is required");
-      })(),
-    assistantId:
-      process.env.NEXT_PUBLIC_MANAGER_ASSISTANT_ID ??
-      (() => {
-        throw new Error("NEXT_PUBLIC_MANAGER_ASSISTANT_ID is required");
-      })(),
+    apiUrl: process.env.NEXT_PUBLIC_API_URL,
+    assistantId: process.env.NEXT_PUBLIC_MANAGER_ASSISTANT_ID,
     reconnectOnMount: true,
     threadId: threadId ?? null,
     onCustomEvent: (event, options) => {