diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go
index e3f0a2a884b0..8dda89295565 100644
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@@ -386,7 +386,8 @@ func RegisterRoutes(m *macaron.Macaron) {
 							Patch(reqToken(), bind(api.EditIssueOption{}), repo.EditIssue)
 
 						m.Group("/comments", func() {
-							m.Combo("").Get(repo.ListIssueComments).Post(bind(api.CreateIssueCommentOption{}), repo.CreateIssueComment)
+							m.Combo("").Get(repo.ListIssueComments).
+								Post(reqToken(), bind(api.CreateIssueCommentOption{}), repo.CreateIssueComment)
 							m.Combo("/:id", reqToken()).Patch(bind(api.EditIssueCommentOption{}), repo.EditIssueComment).
 								Delete(repo.DeleteIssueComment)
 						})