diff --git a/lib/auth.js b/lib/auth.js
index 2c5447a..6e5e60f 100644
--- a/lib/auth.js
+++ b/lib/auth.js
@@ -4,12 +4,14 @@
  */
 
 const PUBLIC_PATHS = ['/', '/health', '/favicon.ico'];
-const PUBLIC_PREFIXES = ['/auth/', '/vendor/', '/placeholder-img/', '/api/', '/admin'];
+const PUBLIC_API = ['/api/settings', '/api/tools', '/api/content/advantages', '/api/content/dashboard'];
+const PUBLIC_PREFIXES = ['/auth/', '/vendor/', '/placeholder-img/', '/admin'];
 const PUBLIC_FILES = ['/shared.css', '/shared.js', '/landing.html'];
 
 function authMiddleware(req, res, next) {
   // Public paths
   if (PUBLIC_PATHS.includes(req.path)) return next();
+  if (PUBLIC_API.includes(req.path)) return next();
   if (PUBLIC_FILES.includes(req.path)) return next();
   if (PUBLIC_PREFIXES.some(p => req.path.startsWith(p))) return next();
 
diff --git a/server.js b/server.js
index 9547904..0415422 100755
--- a/server.js
+++ b/server.js
@@ -22,12 +22,19 @@ app.use(express.static('public'));
 // Auth routes (before auth middleware — public)
 app.use('/auth', require('./routes/auth'));
 
-// Public API (settings, tools, content — for landing page)
-app.use('/api', require('./routes/api'));
+// Public API (only specific endpoints for landing page)
+const apiRouter = require('./routes/api');
+app.get('/api/settings', apiRouter);
+app.get('/api/tools', apiRouter);
+app.get('/api/content/advantages', apiRouter);
+app.get('/api/content/dashboard', apiRouter);
 
 // Auth middleware (protects everything below)
 app.use(authMiddleware);
 
+// Protected API (all other /api/* routes)
+app.use('/api', apiRouter);
+
 // Health check (extended)
 const startTime = Date.now();
 app.get('/health', (req, res) => {