diff --git a/packages/endpoint-micropub/test/integration/403-query-invalid-me-in-api-get.js b/packages/endpoint-micropub/test/integration/403-query-invalid-me-in-api-get.js
new file mode 100644
index 000000000..c7fce44ab
--- /dev/null
+++ b/packages/endpoint-micropub/test/integration/403-query-invalid-me-in-api-get.js
@@ -0,0 +1,29 @@
+import { strict as assert } from "node:assert";
+import { after, describe, it } from "node:test";
+
+import { mockAgent } from "@indiekit-test/mock-agent";
+import { testServer } from "@indiekit-test/server";
+import supertest from "supertest";
+
+await mockAgent("indiekit");
+
+const server = await testServer({
+  application: {
+    tokenEndpoint: "https://token-endpoint.example",
+    introspectionEndpoint: "https://token-endpoint.example/introspect",
+  },
+});
+
+describe("endpoint-micropub GET /micropub", () => {
+  it("Returns 403 error when me does not match publication in api GET request", async () => {
+    const result = await supertest(server)
+      .get("/micropub")
+      .auth("another", { type: "bearer" })
+      .set("accept", "application/json")
+      .query({ q: "config" });
+
+    assert.equal(result.status, 403);
+  });
+
+  after(() => server.close());
+});
diff --git a/packages/indiekit/lib/indieauth.js b/packages/indiekit/lib/indieauth.js
index 7c8f53863..861a38c4e 100644
--- a/packages/indiekit/lib/indieauth.js
+++ b/packages/indiekit/lib/indieauth.js
@@ -242,7 +242,11 @@ export const IndieAuth = class {
 
         next();
       } catch (error) {
-        if (request.method === "GET") {
+        const isApiRequest =
+          request.headers.authorization?.toLowerCase().startsWith("bearer ") ||
+          request.headers.accept?.includes("application/json");
+
+        if (!isApiRequest && request.method === "GET") {
           return response.redirect(
             `/session/login?redirect=${request.originalUrl}`,
           );