diff --git a/internal/api/websocket.go b/internal/api/websocket.go
index e5240e2..a5a2a90 100644
--- a/internal/api/websocket.go
+++ b/internal/api/websocket.go
@@ -35,6 +35,11 @@ func WebSocketHandler(hub *websocket.Hub, database *db.DB) gin.HandlerFunc {
 		room := hub.GetOrCreateRoom(roomID)
 
 		tokenString := c.Query("token")
+		if tokenString == "" {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "missing token"})
+			return
+		}
+
 		claims, err := auth.ParseAccessToken(tokenString)
 		if err != nil {
 			c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})