i think i may be way off on the way im thinking and need help with some clarity.

i have my route.js in the api/protect/ folder as GET route handlers and i want to protect it from getting accessed without being logged in. im using supabase for auth. do i just need to send the token and verify it on the api route or it there some middleware i need to use, any help or links would be amazing as im stuck in the mud. thanks