diff --git a/rowers/serializers.py b/rowers/serializers.py
index 00bc396b..25fdc7f2 100644
--- a/rowers/serializers.py
+++ b/rowers/serializers.py
@@ -170,7 +170,10 @@ class WorkoutSerializer(serializers.ModelSerializer):
 
     def create(self, validated_data):
         print(validated_data)
-        r = Rower.objects.get(user=self.context['request'].user)
+        if self.context['request'].user.is_authenticated:
+            r = Rower.objects.get(user=self.context['request'].user)
+        else:
+            raise PermissionDenied("Not allowed")
         d = validated_data['date']
         t = validated_data['starttime']
         rowdatetime = datetime.datetime(d.year,