diff --git a/src/auth.ts b/src/auth.ts
index a0d8eb8..b7d8b9f 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -32,6 +32,10 @@ function scopesFromPayload(payload: JWTPayload): string[] {
   return [];
 }
 
+function clientScopes(payload: JWTPayload): string[] {
+  return [...new Set([...scopesFromPayload(payload), "teams:user"])];
+}
+
 function claimList(payload: JWTPayload, key: string): string[] {
   const value = (payload as Record<string, unknown>)[key];
   if (typeof value === "string") return value.split(" ");
@@ -57,12 +61,12 @@ export async function publicContext(req: FastifyRequest): Promise<AuthContext> {
     issuer: LOGTO_ISSUER,
     audience: LOGTO_KYC_AUDIENCE,
   });
-  const scopes = scopesFromPayload(payload);
-  if (!scopes.includes("teams:user")) {
+  if (!payload.sub) {
     throw new GraphQLError("Unauthorized", {
       extensions: { code: "UNAUTHENTICATED" },
     });
   }
+  const scopes = clientScopes(payload);
   return { userId: payload.sub, scopes };
 }
 
@@ -77,12 +81,12 @@ export async function userContext(req: FastifyRequest): Promise<AuthContext> {
     issuer: LOGTO_ISSUER,
     audience: LOGTO_KYC_AUDIENCE,
   });
-  const scopes = scopesFromPayload(payload);
-  if (!scopes.includes("teams:user")) {
+  if (!payload.sub) {
     throw new GraphQLError("Unauthorized", {
       extensions: { code: "UNAUTHENTICATED" },
     });
   }
+  const scopes = clientScopes(payload);
   return { userId: payload.sub, scopes };
 }