diff --git a/endpoints/web.py b/endpoints/web.py
index 752a77c09..4b7b2b65f 100644
--- a/endpoints/web.py
+++ b/endpoints/web.py
@@ -518,6 +518,7 @@ def deny_application():
 @param_required('client_id')
 @param_required('redirect_uri')
 @param_required('scope')
+@process_auth_or_cookie
 def request_authorization_code():
   provider = FlaskAuthorizationProvider()
   response_type = request.args.get('response_type', 'code')