diff --git a/sf_manufacturing/controllers/controllers.py b/sf_manufacturing/controllers/controllers.py
index 23be7d38..632e9e4c 100644
--- a/sf_manufacturing/controllers/controllers.py
+++ b/sf_manufacturing/controllers/controllers.py
@@ -477,7 +477,7 @@ class Manufacturing_Connect(http.Controller):
             logging.info('LocationChange error:%s' % e)
         return json.JSONEncoder().encode(res)
 
-    @http.route('/AutoDeviceApi/AGVToProduct', type='json', auth='none', methods=['GET', 'POST'], csrf=False,
+    @http.route('/AutoDeviceApi/AGVToProduct', type='json', auth='sf_token', methods=['GET', 'POST'], csrf=False,
                 cors="*")
     def AGVToProduct(self, **kw):
         """
@@ -549,7 +549,7 @@ class Manufacturing_Connect(http.Controller):
             logging.info('AGVToProduct error:%s' % e)
         return json.JSONEncoder().encode(res)
 
-    @http.route('/AutoDeviceApi/AGVDownProduct', type='json', auth='none', methods=['GET', 'POST'], csrf=False,
+    @http.route('/AutoDeviceApi/AGVDownProduct', type='json', auth='sf_token', methods=['GET', 'POST'], csrf=False,
                 cors="*")
     def AGVDownProduct(self, **kw):
         """
@@ -668,7 +668,7 @@ class Manufacturing_Connect(http.Controller):
             logging.info('AGVDownProduct error:%s' % e)
         return json.JSONEncoder().encode(res)
 
-    @http.route('/AutoDeviceApi/AgvStationState', type='json', auth='none', methods=['GET', 'POST'], csrf=False,
+    @http.route('/AutoDeviceApi/AgvStationState', type='json', auth='sf_token', methods=['GET', 'POST'], csrf=False,
                 cors="*")
     def AGVStationState(self, **kw):
         """
diff --git a/sf_manufacturing/controllers/workpiece.py b/sf_manufacturing/controllers/workpiece.py
index 5d79a1b3..370c71a0 100644
--- a/sf_manufacturing/controllers/workpiece.py
+++ b/sf_manufacturing/controllers/workpiece.py
@@ -8,7 +8,7 @@ from odoo.http import request
 
 class Workpiece(http.Controller):
 
-    @http.route('/agvApi/backfeed', type='json', auth='none', methods=['GET', 'POST'], csrf=False,
+    @http.route('/agvApi/backfeed', type='json', auth='sf_token', methods=['GET', 'POST'], csrf=False,
                 cors="*")
     def backfeed(self, **kw):
         """