diff --git a/build.gradle b/build.gradle
index 4411033..cbeb567 100644
--- a/build.gradle
+++ b/build.gradle
@@ -47,5 +47,8 @@ dependencies {
     testImplementation 'org.springframework.boot:spring-boot-starter-webmvc-test'
     testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
     implementation 'org.springframework.cloud:spring-cloud-starter-openfeign:4.1.0'
+    //security
+    implementation 'org.springframework.boot:spring-boot-starter-security'
+    implementation("io.jsonwebtoken:jjwt:0.13.0")
 }
 
diff --git a/src/main/java/ru/soune/nocopy/adminpanel/config/SecurityConfig.java b/src/main/java/ru/soune/nocopy/adminpanel/config/SecurityConfig.java
new file mode 100644
index 0000000..e410b56
--- /dev/null
+++ b/src/main/java/ru/soune/nocopy/adminpanel/config/SecurityConfig.java
@@ -0,0 +1,34 @@
+package ru.soune.nocopy.adminpanel.config;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import ru.soune.nocopy.adminpanel.util.JwtAuthFilter;
+
+@Configuration
+@EnableWebSecurity
+@RequiredArgsConstructor
+public class SecurityConfig {
+
+    private final JwtAuthFilter jwtAuthFilter;
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+        http
+                .csrf(AbstractHttpConfigurer::disable)
+                .sessionManagement(session ->
+                        session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().authenticated()
+                )
+                .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);
+
+        return http.build();
+    }
+}
\ No newline at end of file
diff --git a/src/main/java/ru/soune/nocopy/adminpanel/dto/BaseRequest.java b/src/main/java/ru/soune/nocopy/adminpanel/dto/BaseRequest.java
index 207ec47..baae892 100644
--- a/src/main/java/ru/soune/nocopy/adminpanel/dto/BaseRequest.java
+++ b/src/main/java/ru/soune/nocopy/adminpanel/dto/BaseRequest.java
@@ -13,9 +13,6 @@ public class BaseRequest {
     @JsonProperty("msg_id")
     Integer msgId;
 
-    @JsonProperty("token")
-    String token;
-
     @JsonProperty("message_body")
     Object messageBody;
 
diff --git a/src/main/java/ru/soune/nocopy/adminpanel/handler/AdminUserHandler.java b/src/main/java/ru/soune/nocopy/adminpanel/handler/AdminUserHandler.java
index 5f0f639..3e8420b 100644
--- a/src/main/java/ru/soune/nocopy/adminpanel/handler/AdminUserHandler.java
+++ b/src/main/java/ru/soune/nocopy/adminpanel/handler/AdminUserHandler.java
@@ -56,7 +56,6 @@ public class AdminUserHandler implements RequestHandler {
             case "toggle_active" -> handleToggleActive(request, adminRequest);
             case "delete" -> handleDelete(request, adminRequest);
             case "get_permissions_by_id" -> handleGetPermissionsById(request, adminRequest);
-            case "get_permissions_by_token" -> handleGetPermissionsByToken(request, adminRequest);
             case "update_permissions" -> handleUpdatePermissions(request, adminRequest);
             default -> handleInvalidAction(request, action);
         };
@@ -397,7 +396,7 @@ public class AdminUserHandler implements RequestHandler {
                 .availableActions(Arrays.asList(
                         "login", "create", "get_all", "get_by_id",
                         "update", "set_super_admin", "toggle_active", "delete",
-                        "get_permissions", "update_permissions"))
+                        "get_permissions_by_id", "update_permissions"))
                 .build();
 
         return BaseResponse.builder()
@@ -457,63 +456,6 @@ public class AdminUserHandler implements RequestHandler {
         }
     }
 
-    private BaseResponse handleGetPermissionsByToken(BaseRequest request, AdminUserRequest adminRequest) {
-        try {
-            Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
-
-            if (!currentUserId.equals(adminRequest.getAdminId())) {
-                if (!adminSectionPermissionService.canRead(currentUserId,
-                        AdminSection.USERS)) {
-                    return BaseResponse.builder()
-                            .msgId(request.getMsgId())
-                            .messageCode(MessageCode.PERMISSION_DENIED.getCode())
-                            .messageDesc("You can't update profile")
-                            .build();
-                }
-            }
-
-            String token = request.getToken();
-            if (token == null || token.isEmpty()) {
-                return BaseResponse.builder()
-                        .msgId(request.getMsgId())
-                        .messageCode(MessageCode.INVALID_CREDENTIALS.getCode())
-                        .messageDesc("Token is required")
-                        .build();
-            }
-
-            String email = jwtUtil.extractEmail(token);
-            AdminUser admin = adminUserService.findByEmail(email);
-            Map<AdminSection, Integer> sectionPermissions = permissionService.getAllPermissions(admin.getId());
-
-            Map<String, Integer> permissionsMap = new HashMap<>();
-            sectionPermissions.forEach((section, value) ->
-                    permissionsMap.put(section.name().toLowerCase(), value));
-
-            AdminUserResponse response = AdminUserResponse.builder()
-                    .id(admin.getId())
-                    .fullName(admin.getFullName())
-                    .email(admin.getEmail())
-                    .isActive(admin.getIsActive())
-                    .isSuperAdmin(AdminPermission.isSuperAdmin(admin.getPermissions()))
-                    .createdAt(admin.getCreatedAt().toString())
-                    .permissions(permissionsMap)
-                    .build();
-
-            return BaseResponse.builder()
-                    .msgId(request.getMsgId())
-                    .messageCode(MessageCode.SUCCESS.getCode())
-                    .messageDesc(MessageCode.SUCCESS.getDescription())
-                    .messageBody(response)
-                    .build();
-        } catch (AdminUserNotFoundException e) {
-            return BaseResponse.builder()
-                    .msgId(request.getMsgId())
-                    .messageCode(MessageCode.ADMIN_NOT_FOUND.getCode())
-                    .messageDesc(MessageCode.ADMIN_NOT_FOUND.getDescription())
-                    .build();
-        }
-    }
-
     private BaseResponse handleUpdatePermissions(BaseRequest request, AdminUserRequest adminRequest) {
         try {
             Long currentUserId = (Long) httpServletRequest.getAttribute("userId");