diff --git a/server/web/api/route.go b/server/web/api/route.go
index 270644b..1ad71a2 100644
--- a/server/web/api/route.go
+++ b/server/web/api/route.go
@@ -30,6 +30,9 @@ func SetupRoute(route *gin.RouterGroup) {
 	route.GET("/stream", stream)
 	route.GET("/stream/*fname", stream)
 
+	route.HEAD("/play/:hash/:id", play)
+	route.GET("/play/:hash/:id", play)
+
 	route.POST("/viewed", viewed)
 
 	route.GET("/playlistall/all.m3u", allPlayList)
diff --git a/server/web/auth/auth.go b/server/web/auth/auth.go
index 721956b..bc4d66f 100644
--- a/server/web/auth/auth.go
+++ b/server/web/auth/auth.go
@@ -64,6 +64,7 @@ func BasicAuth(accounts gin.Accounts) gin.HandlerFunc {
 		user, found := pairs.searchCredential(c.Request.Header.Get("Authorization"))
 		if !found {
 			if strings.HasPrefix(c.FullPath(), "/stream") ||
+				strings.HasPrefix(c.FullPath(), "/play") ||
 				(strings.HasPrefix(c.FullPath(), "/playlist") && c.FullPath() != "/playlistall/all.m3u") {
 				c.Set("not_auth", true)
 				return