diff --git a/project/backend/settings.py b/project/backend/settings.py
index c2c84f4..c38df07 100644
--- a/project/backend/settings.py
+++ b/project/backend/settings.py
@@ -154,8 +154,9 @@
 
 REST_FRAMEWORK = {
     "DEFAULT_PERMISSION_CLASSES": [
-        "rest_framework.permissions.IsAuthenticatedOrReadOnly",
+        "rest_framework.permissions.AllowAny",  # Views handle auth via Firebase middleware
     ],
+    "DEFAULT_AUTHENTICATION_CLASSES": [],  # Disable DRF auth, using Firebase middleware
     "DEFAULT_THROTTLE_CLASSES": [
         "rest_framework.throttling.AnonRateThrottle",
         "rest_framework.throttling.UserRateThrottle",