diff --git a/synapse/rest/client/v2_alpha/thirdparty.py b/synapse/rest/client/v2_alpha/thirdparty.py
index ee2f158d0..6fceb23e2 100644
--- a/synapse/rest/client/v2_alpha/thirdparty.py
+++ b/synapse/rest/client/v2_alpha/thirdparty.py
@@ -36,6 +36,8 @@ class ThirdPartyProtocolsServlet(RestServlet):
 
     @defer.inlineCallbacks
     def on_GET(self, request):
+        yield self.auth.get_user_by_req(request, allow_guest=True)
+
         protocols = yield self.appservice_handler.get_3pe_protocols()
         defer.returnValue((200, protocols))
 
@@ -52,6 +54,8 @@ class ThirdPartyProtocolServlet(RestServlet):
 
     @defer.inlineCallbacks
     def on_GET(self, request, protocol):
+        yield self.auth.get_user_by_req(request, allow_guest=True)
+
         protocols = yield self.appservice_handler.get_3pe_protocols(
             only_protocol=protocol,
         )
@@ -73,6 +77,8 @@ class ThirdPartyUserServlet(RestServlet):
 
     @defer.inlineCallbacks
     def on_GET(self, request, protocol):
+        yield self.auth.get_user_by_req(request, allow_guest=True)
+
         fields = request.args
         fields.pop("access_token", None)
 
@@ -95,6 +101,8 @@ class ThirdPartyLocationServlet(RestServlet):
 
     @defer.inlineCallbacks
     def on_GET(self, request, protocol):
+        yield self.auth.get_user_by_req(request, allow_guest=True)
+
         fields = request.args
         fields.pop("access_token", None)