diff --git a/go-backend/cmd/api/main.go b/go-backend/cmd/api/main.go
index 19236d9..a18ea7c 100644
--- a/go-backend/cmd/api/main.go
+++ b/go-backend/cmd/api/main.go
@@ -260,6 +260,7 @@ func main() {
 			auth.GET("/verify", authHandler.VerifyEmail)
 			auth.POST("/forgot-password", authHandler.ForgotPassword)
 			auth.POST("/reset-password", authHandler.ResetPassword)
+			auth.GET("/altcha-challenge", authHandler.GetAltchaChallenge)
 		}
 
 		authorized := v1.Group("")
@@ -510,8 +511,7 @@ func main() {
 		}
 	}
 
-	// ALTCHA challenge endpoints (no auth required)
-	r.GET("/api/v1/auth/altcha-challenge", authHandler.GetAltchaChallenge)
+	// Admin ALTCHA challenge endpoint (no auth required)
 	r.GET("/api/v1/admin/altcha-challenge", adminHandler.GetAltchaChallenge)
 
 	// Admin login (no auth middleware - this IS the auth step)