diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,8 @@
+0.4.6.0
+=======
+
+* Add `withAuthToken` to guard groups of endpoints.
+
 0.4.5.0
 =======
 
diff --git a/example/persistent/servant-auth-token-example-persistent.cabal b/example/persistent/servant-auth-token-example-persistent.cabal
--- a/example/persistent/servant-auth-token-example-persistent.cabal
+++ b/example/persistent/servant-auth-token-example-persistent.cabal
@@ -37,7 +37,7 @@
     , servant                       >= 0.9      && < 0.10
     , servant-auth-token            >= 0.4      && < 0.5
     , servant-auth-token-api        >= 0.4      && < 0.5
-    , servant-auth-token-persistent >= 0.4      && < 0.5
+    , servant-auth-token-persistent >= 0.4      && < 0.6
     , servant-server                >= 0.9      && < 0.10
     , text                          >= 1.2      && < 1.3
     , time                          >= 1.6      && < 1.7
diff --git a/servant-auth-token.cabal b/servant-auth-token.cabal
--- a/servant-auth-token.cabal
+++ b/servant-auth-token.cabal
@@ -1,5 +1,5 @@
 name:                servant-auth-token
-version:             0.4.5.0
+version:             0.4.6.0
 synopsis:            Servant based API and server for token based authorisation
 description:         Please see README.md
 homepage:            https://github.com/ncrashed/servant-auth-token#readme
diff --git a/src/Servant/Server/Auth/Token.hs b/src/Servant/Server/Auth/Token.hs
--- a/src/Servant/Server/Auth/Token.hs
+++ b/src/Servant/Server/Auth/Token.hs
@@ -1,4 +1,4 @@
-{-# OPTIONS_GHC -fno-warn-orphans #-}
+{-# LANGUAGE UndecidableInstances #-}
 {-|
 Module      : Servant.Server.Auth.Token
 Description : Implementation of token authorisation API
@@ -34,6 +34,7 @@
   , AuthHandler
   -- * Helpers
   , guardAuthToken
+  , WithAuthToken(..)
   , ensureAdmin
   , authUserByToken
   -- * API methods
@@ -458,6 +459,36 @@
 -- doesn't have needed permissions, throw 401 response
 guardAuthToken :: forall perms m . (PermsList perms, AuthHandler m) => MToken perms -> m ()
 guardAuthToken mt = void $ guardAuthToken' (fmap unToken mt) $ unliftPerms (Proxy :: Proxy perms)
+
+class WithAuthToken a where
+
+  -- | Authenticate an entire API rather than each individual
+  -- endpoint.
+  --
+  -- As such, for a given 'HasServer' instance @api@, if you have:
+  --
+  -- @
+  --   f :: 'ServerT' api m
+  -- @
+  --
+  -- then:
+  --
+  -- @
+  --   withAuthToken f :: (AuthHandler m) => ServerT ('TokenHeader' perms :> api) m
+  -- @
+  --
+  -- (Note that the types don't reflect this, as it isn't possible to
+  -- guarantee what all possible @ServerT@ instances might be.)
+  withAuthToken :: (PermsList perms) => a -> MToken perms -> a
+
+instance (AuthHandler m) => WithAuthToken (m a) where
+  withAuthToken m mt = guardAuthToken mt *> m
+
+instance (WithAuthToken r) => WithAuthToken (a -> r) where
+  withAuthToken f mt = (`withAuthToken` mt) . f
+
+instance (WithAuthToken a, WithAuthToken b) => WithAuthToken (a :<|> b) where
+  withAuthToken (a :<|> b) mt = withAuthToken a mt :<|> withAuthToken b mt
 
 -- | Same as `guardAuthToken` but returns record about the token
 guardAuthToken' :: AuthHandler m => Maybe SimpleToken -> [Permission] -> m (WithId AuthTokenId AuthToken)