diff --git a/api/src/core/api.js b/api/src/core/api.js
index c96c1cf1..51ec1697 100644
--- a/api/src/core/api.js
+++ b/api/src/core/api.js
@@ -102,6 +102,9 @@ export const runAPI = (express, app, __dirname) => {
         ...corsConfig,
     }));
 
+    app.post('/', apiLimiter);
+    app.use('/tunnel', apiLimiterStream);
+
     app.post('/', (req, res, next) => {
         if (!env.turnstileSecret || !env.jwtSecret) {
             return next();
@@ -140,9 +143,6 @@ export const runAPI = (express, app, __dirname) => {
         next();
     });
 
-    app.post('/', apiLimiter);
-    app.use('/tunnel', apiLimiterStream);
-
     app.use('/', express.json({ limit: 1024 }));
     app.use('/', (err, _, res, next) => {
         if (err) {