diff --git a/app/api/stories/[id]/log/route.ts b/app/api/stories/[id]/log/route.ts
index d88dca4..baf4ba6 100644
--- a/app/api/stories/[id]/log/route.ts
+++ b/app/api/stories/[id]/log/route.ts
@@ -28,6 +28,9 @@ export async function POST(
   if ('error' in auth) {
     return Response.json({ error: auth.error }, { status: auth.status })
   }
+  if (auth.isDemo) {
+    return Response.json({ error: 'Niet beschikbaar in demo-modus' }, { status: 403 })
+  }
 
   const { id: storyId } = await params
 
diff --git a/app/api/todos/route.ts b/app/api/todos/route.ts
index 2a65b32..357edf7 100644
--- a/app/api/todos/route.ts
+++ b/app/api/todos/route.ts
@@ -11,6 +11,9 @@ export async function POST(request: Request) {
   if ('error' in auth) {
     return Response.json({ error: auth.error }, { status: auth.status })
   }
+  if (auth.isDemo) {
+    return Response.json({ error: 'Niet beschikbaar in demo-modus' }, { status: 403 })
+  }
 
   const body = await request.json().catch(() => null)
   const parsed = bodySchema.safeParse(body)