feat: supporter-gated content with atprotofans validation (#637)

* feat: add supporter-gated content infrastructure

backend support for atprotofans content gating:

- create private R2 buckets (audio-private-dev/staging/prod)
- add R2_PRIVATE_BUCKET and PRESIGNED_URL_EXPIRY_SECONDS settings
- implement save_gated() and generate_presigned_url() in R2Storage
- add supportGate field to fm.plyr.track lexicon
- add support_gate JSONB column to tracks table
- add atprotofans validation helper (_internal/atprotofans.py)
- update audio endpoint to check supporter status for gated tracks
- 401 if not authenticated
- 402 if not a supporter
- presigned URL redirect if valid supporter

the supportGate object starts with type: "any" (any support unlocks),
with room to grow for tiers (recurring, minimum amounts, etc.)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

* feat: add support_gate parameter to upload flow

enable artists to upload supporter-gated tracks:

- add support_gate form parameter to upload endpoint
- validate support_gate JSON structure (must have type: "any")
- require atprotofans to be enabled in settings to use gating
- use save_gated() for gated tracks (private R2 bucket)
- store support_gate in Track model and ATProto record
- gated tracks use API endpoint URL instead of direct R2 URL

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

* feat(frontend): add UI for supporter-gated tracks

- TrackItem: show heart badge overlay on gated tracks with dimmed image
- Player: detect 401/402 on gated content, show toast with supporter CTA
- Upload: add "supporters only" toggle when artist has atprotofans enabled
- Types: add SupportGate interface and support_gate field to Track

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

* fix: complete supporter-gated content implementation

- fix presigned URL generation with SigV4 signature (was returning 401)
- add playback helper to check gated access BEFORE modifying queue state
(clicking locked track no longer interrupts current playback)
- add support_gate toggle to track edit UI in portal
- centralize atprotofans support URL generation in config.ts
- add 7 regression tests for gated content access control

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

* fix: migrate audio to private bucket when enabling support_gate

when enabling support_gate on an existing track, the audio file must be
migrated from the public bucket to the private bucket. otherwise the
original public r2_url remains accessible, bypassing the paywall.

- add R2Storage.migrate_to_private_bucket() - copies file then deletes original
- add migrate_track_to_private_bucket background task
- schedule migration in PATCH endpoint when support_gate is enabled on
a track that has an r2_url (indicating it's in the public bucket)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

* refactor: unify audio bucket migration to single move_audio method

- R2Storage.move_audio(file_id, extension, to_private) handles both directions
- move_track_audio background task replaces separate migrate_to_private/public
- PATCH endpoint schedules move when toggling support_gate in either direction:
- enabling gate on public track → move to private
- disabling gate on private track → move to public

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

* fix: sync ATProto record when toggling support_gate

- include support_gate changes in metadata_changed check
- pass support_gate to build_track_record
- use backend API URL for gated tracks (r2_url is None)
- fix upload page: link to /portal not /settings for atprotofans setup

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

---------

Co-authored-by: Claude Opus 4.5 <[e-mail]>

backend/.env.example

···
 R2_ENDPOINT_URL=https://8feb33b5fb57ce2bc093bc6f4141f40a.r2.cloudflarestorage.com
 R2_PUBLIC_BUCKET_URL=https://pub-154b70b3121149eda0cf1ccbae78cb33.r2.dev
 R2_PUBLIC_IMAGE_BUCKET_URL=https://pub-154b70b3121149eda0cf1ccbae78cb33.r2.dev
+R2_PRIVATE_BUCKET=audio-private-dev  # private bucket for supporter-gated audio
 MAX_UPLOAD_SIZE_MB=1536  # max audio upload size (default: 1536MB / 1.5GB - supports 2-hour WAV)
 
 # atproto

backend/alembic/versions/2025_12_22_190115_9ee155c078ed_add_support_gate_to_tracks.py

···
+"""add support_gate to tracks
+
+Revision ID: 9ee155c078ed
+Revises: f2380236c97b
+Create Date: 2025-12-22 19:01:15.063270
+
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "9ee155c078ed"
+down_revision: str | Sequence[str] | None = "f2380236c97b"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    """Add support_gate column for supporter-gated content."""
+    op.add_column(
+        "tracks",
+        sa.Column(
+            "support_gate",
+            postgresql.JSONB(astext_type=sa.Text()),
+            nullable=True,
+        ),
+    )
+
+
+def downgrade() -> None:
+    """Remove support_gate column."""
+    op.drop_column("tracks", "support_gate")

backend/src/backend/_internal/__init__.py

···
 from backend._internal.notifications import notification_service
 from backend._internal.now_playing import now_playing_service
 from backend._internal.queue import queue_service
+from backend._internal.atprotofans import validate_supporter
 
 __all__ = [
     "DeveloperToken",
···
     "start_oauth_flow",
     "start_oauth_flow_with_scopes",
     "update_session_tokens",
+    "validate_supporter",
 ]

backend/src/backend/_internal/atproto/records/fm_plyr/track.py

···
     duration: int | None = None,
     features: list[dict] | None = None,
     image_url: str | None = None,
+    support_gate: dict | None = None,
 ) -> dict[str, Any]:
     """Build a track record dict for ATProto.
 
     args:
         title: track title
         artist: artist name
-        audio_url: R2 URL for audio file
+        audio_url: R2 URL for audio file (placeholder for gated tracks)
         file_type: file extension (mp3, wav, etc)
         album: optional album name
         duration: optional duration in seconds
         features: optional list of featured artists [{did, handle, display_name, avatar_url}]
         image_url: optional cover art image URL
+        support_gate: optional gating config (e.g., {"type": "any"})
 
     returns:
         record dict ready for ATProto
···
         # validate image URL comes from allowed origin
         settings.storage.validate_image_url(image_url)
         record["imageUrl"] = image_url
+    if support_gate:
+        record["supportGate"] = support_gate
 
     return record
 
···
     duration: int | None = None,
     features: list[dict] | None = None,
     image_url: str | None = None,
+    support_gate: dict | None = None,
 ) -> tuple[str, str]:
     """Create a track record on the user's PDS using the configured collection.
 
···
         auth_session: authenticated user session
         title: track title
         artist: artist name
-        audio_url: R2 URL for audio file
+        audio_url: R2 URL for audio file (placeholder URL for gated tracks)
         file_type: file extension (mp3, wav, etc)
         album: optional album name
         duration: optional duration in seconds
         features: optional list of featured artists [{did, handle, display_name, avatar_url}]
         image_url: optional cover art image URL
+        support_gate: optional gating config (e.g., {"type": "any"})
 
     returns:
         tuple of (record_uri, record_cid)
···
         duration=duration,
         features=features,
         image_url=image_url,
+        support_gate=support_gate,
     )
 
     payload = {

backend/src/backend/_internal/atprotofans.py

···
+"""atprotofans integration for supporter validation.
+
+atprotofans is a creator support platform on ATProto. this module provides
+server-side validation of supporter relationships for content gating.
+
+the validation uses the three-party model:
+- supporter: has com.atprotofans.supporter record in their PDS
+- creator: has com.atprotofans.supporterProof record in their PDS
+- broker: has com.atprotofans.brokerProof record (atprotofans service)
+
+for direct atprotofans contributions (not via platform registration),
+the signer is the artist's own DID.
+
+see: https://atprotofans.leaflet.pub/3mabsmts3rs2b
+"""
+
+import httpx
+import logfire
+from pydantic import BaseModel
+
+
+class SupporterValidation(BaseModel):
+    """result of validating supporter status."""
+
+    valid: bool
+    profile: dict | None = None
+
+
+async def validate_supporter(
+    supporter_did: str,
+    artist_did: str,
+    timeout: float = 5.0,
+) -> SupporterValidation:
+    """validate if a user supports an artist via atprotofans.
+
+    for direct atprotofans contributions, the signer is the artist's DID.
+
+    args:
+        supporter_did: DID of the potential supporter
+        artist_did: DID of the artist (also used as signer)
+        timeout: request timeout in seconds
+
+    returns:
+        SupporterValidation with valid=True if supporter, valid=False otherwise
+    """
+    url = "https://atprotofans.com/xrpc/com.atprotofans.validateSupporter"
+    params = {
+        "supporter": supporter_did,
+        "subject": artist_did,
+        "signer": artist_did,  # for direct contributions, signer = artist
+    }
+
+    with logfire.span(
+        "atprotofans.validate_supporter",
+        supporter_did=supporter_did,
+        artist_did=artist_did,
+    ):
+        try:
+            async with httpx.AsyncClient(timeout=timeout) as client:
+                response = await client.get(url, params=params)
+
+                if response.status_code != 200:
+                    logfire.warn(
+                        "atprotofans validation failed",
+                        status_code=response.status_code,
+                        response_text=response.text[:200],
+                    )
+                    return SupporterValidation(valid=False)
+
+                data = response.json()
+                is_valid = data.get("valid", False)
+
+                logfire.info(
+                    "atprotofans validation result",
+                    valid=is_valid,
+                    has_profile=data.get("profile") is not None,
+                )
+
+                return SupporterValidation(
+                    valid=is_valid,
+                    profile=data.get("profile"),
+                )
+
+        except httpx.TimeoutException:
+            logfire.warn("atprotofans validation timeout")
+            return SupporterValidation(valid=False)
+        except Exception as e:
+            logfire.error(
+                "atprotofans validation error",
+                error=str(e),
+                exc_info=True,
+            )
+            return SupporterValidation(valid=False)

backend/src/backend/_internal/background_tasks.py

···
     logfire.info("scheduled pds comment update", comment_id=comment_id)
 
 
+async def move_track_audio(track_id: int, to_private: bool) -> None:
+    """move a track's audio file between public and private buckets.
+
+    called when support_gate is toggled on an existing track.
+
+    args:
+        track_id: database ID of the track
+        to_private: if True, move to private bucket; if False, move to public
+    """
+    from backend.models import Track
+    from backend.storage import storage
+
+    async with db_session() as db:
+        result = await db.execute(select(Track).where(Track.id == track_id))
+        track = result.scalar_one_or_none()
+
+        if not track:
+            logger.warning(f"move_track_audio: track {track_id} not found")
+            return
+
+        if not track.file_id or not track.file_type:
+            logger.warning(
+                f"move_track_audio: track {track_id} missing file_id/file_type"
+            )
+            return
+
+        result_url = await storage.move_audio(
+            file_id=track.file_id,
+            extension=track.file_type,
+            to_private=to_private,
+        )
+
+        # update r2_url: None for private, public URL for public
+        if to_private:
+            # moved to private - result_url is None on success, None on failure
+            # we check by verifying the file was actually moved (no error logged)
+            track.r2_url = None
+            await db.commit()
+            logger.info(f"moved track {track_id} to private bucket")
+        elif result_url:
+            # moved to public - result_url is the public URL
+            track.r2_url = result_url
+            await db.commit()
+            logger.info(f"moved track {track_id} to public bucket")
+        else:
+            logger.error(f"failed to move track {track_id}")
+
+
+async def schedule_move_track_audio(track_id: int, to_private: bool) -> None:
+    """schedule a track audio move via docket."""
+    docket = get_docket()
+    await docket.add(move_track_audio)(track_id, to_private)
+    direction = "private" if to_private else "public"
+    logfire.info(f"scheduled track audio move to {direction}", track_id=track_id)
+
+
 # collection of all background task functions for docket registration
 background_tasks = [
     scan_copyright,
···
     pds_create_comment,
     pds_delete_comment,
     pds_update_comment,
+    move_track_audio,
 ]

backend/src/backend/api/audio.py

···
 """audio streaming endpoint."""
 
 import logfire
-from fastapi import APIRouter, Depends, HTTPException
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
 from fastapi.responses import RedirectResponse
 from pydantic import BaseModel
 from sqlalchemy import func, select
 
-from backend._internal import Session, require_auth
+from backend._internal import Session, get_optional_session, validate_supporter
 from backend.models import Track
 from backend.storage import storage
 from backend.utilities.database import db_session
···
     file_type: str | None
 
 
[e-mail]("/{file_id}")
 @router.get("/{file_id}")
-async def stream_audio(file_id: str):
+async def stream_audio(
+    file_id: str,
+    request: Request,
+    session: Session | None = Depends(get_optional_session),
+):
     """stream audio file by redirecting to R2 CDN URL.
 
-    looks up track to get cached r2_url and file extension,
-    eliminating the need to probe multiple formats.
+    for public tracks: redirects to R2 CDN URL.
+    for gated tracks: validates supporter status and returns presigned URL.
+
+    HEAD requests are used for pre-flight auth checks - they return
+    200/401/402 status without redirecting to avoid CORS issues.
 
     images are served directly via R2 URLs stored in the image_url field,
     not through this endpoint.
     """
-    # look up track to get r2_url and file_type
+    is_head_request = request.method == "HEAD"
+    # look up track to get r2_url, file_type, support_gate, and artist_did
     async with db_session() as db:
         # check for duplicates (multiple tracks with same file_id)
         count_result = await db.execute(
···
                 count=count,
             )
 
-        # get the best track: prefer non-null r2_url, then newest
+        # get the track with gating info
         result = await db.execute(
-            select(Track.r2_url, Track.file_type)
+            select(Track.r2_url, Track.file_type, Track.support_gate, Track.artist_did)
             .where(Track.file_id == file_id)
             .order_by(Track.r2_url.is_not(None).desc(), Track.created_at.desc())
             .limit(1)
         )
         track_data = result.first()
+        r2_url, file_type, support_gate, artist_did = track_data
 
-        r2_url, file_type = track_data
+    # check if track is gated
+    if support_gate is not None:
+        return await _handle_gated_audio(
+            file_id=file_id,
+            file_type=file_type,
+            artist_did=artist_did,
+            session=session,
+            is_head_request=is_head_request,
+        )
 
-    # if we have a valid r2_url cached, use it directly (zero HEADs)
+    # public track - use cached r2_url if available
     if r2_url and r2_url.startswith("http"):
         return RedirectResponse(url=r2_url)
 
···
     return RedirectResponse(url=url)
 
 
+async def _handle_gated_audio(
+    file_id: str,
+    file_type: str,
+    artist_did: str,
+    session: Session | None,
+    is_head_request: bool = False,
+) -> RedirectResponse | Response:
+    """handle streaming for supporter-gated content.
+
+    validates that the user is authenticated and either:
+    - is the artist who uploaded the track, OR
+    - supports the artist via atprotofans
+    before returning a presigned URL for the private bucket.
+
+    for HEAD requests (used for pre-flight auth checks), returns 200 status
+    without redirecting to avoid CORS issues with cross-origin redirects.
+    """
+    # must be authenticated to access gated content
+    if not session:
+        raise HTTPException(
+            status_code=401,
+            detail="authentication required for supporter-gated content",
+        )
+
+    # artist can always play their own gated tracks
+    if session.did == artist_did:
+        logfire.info(
+            "serving gated content to owner",
+            file_id=file_id,
+            artist_did=artist_did,
+        )
+    else:
+        # validate supporter status via atprotofans
+        validation = await validate_supporter(
+            supporter_did=session.did,
+            artist_did=artist_did,
+        )
+
+        if not validation.valid:
+            raise HTTPException(
+                status_code=402,
+                detail="this track requires supporter access",
+                headers={"X-Support-Required": "true"},
+            )
+
+    # for HEAD requests, just return 200 to confirm access
+    # (avoids CORS issues with cross-origin redirects)
+    if is_head_request:
+        return Response(status_code=200)
+
+    # authorized - generate presigned URL for private bucket
+    if session.did != artist_did:
+        logfire.info(
+            "serving gated content to supporter",
+            file_id=file_id,
+            supporter_did=session.did,
+            artist_did=artist_did,
+        )
+
+    url = await storage.generate_presigned_url(file_id=file_id, extension=file_type)
+    return RedirectResponse(url=url)
+
+
 @router.get("/{file_id}/url")
 async def get_audio_url(
     file_id: str,
-    session: Session = Depends(require_auth),
+    session: Session | None = Depends(get_optional_session),
 ) -> AudioUrlResponse:
-    """return direct R2 URL for offline caching.
+    """return direct URL for audio file.
 
-    unlike the streaming endpoint which returns a 307 redirect,
-    this returns the URL as JSON so the frontend can fetch and
-    cache the audio directly via the Cache API.
+    for public tracks: returns R2 CDN URL for offline caching.
+    for gated tracks: returns presigned URL after supporter validation.
 
-    used for offline mode - frontend fetches from R2 and stores locally.
+    used for offline mode - frontend fetches and caches locally.
     """
     async with db_session() as db:
         result = await db.execute(
-            select(Track.r2_url, Track.file_type)
+            select(Track.r2_url, Track.file_type, Track.support_gate, Track.artist_did)
             .where(Track.file_id == file_id)
             .order_by(Track.r2_url.is_not(None).desc(), Track.created_at.desc())
             .limit(1)
···
         if not track_data:
             raise HTTPException(status_code=404, detail="audio file not found")
 
-        r2_url, file_type = track_data
+        r2_url, file_type, support_gate, artist_did = track_data
 
-    # if we have a cached r2_url, return it
+    # check if track is gated
+    if support_gate is not None:
+        # must be authenticated
+        if not session:
+            raise HTTPException(
+                status_code=401,
+                detail="authentication required for supporter-gated content",
+            )
+
+        # artist can always access their own gated tracks
+        if session.did != artist_did:
+            # validate supporter status
+            validation = await validate_supporter(
+                supporter_did=session.did,
+                artist_did=artist_did,
+            )
+
+            if not validation.valid:
+                raise HTTPException(
+                    status_code=402,
+                    detail="this track requires supporter access",
+                    headers={"X-Support-Required": "true"},
+                )
+
+        # return presigned URL
+        url = await storage.generate_presigned_url(file_id=file_id, extension=file_type)
+        return AudioUrlResponse(url=url, file_id=file_id, file_type=file_type)
+
+    # public track - return cached r2_url if available
     if r2_url and r2_url.startswith("http"):
         return AudioUrlResponse(url=r2_url, file_id=file_id, file_type=file_type)
 

backend/src/backend/api/tracks/mutations.py

···
 """Track mutation endpoints (delete/update/restore)."""
 
 import contextlib
+import json
 import logging
 from datetime import UTC, datetime
 from typing import Annotated
+from urllib.parse import urljoin
 
 import logfire
 from fastapi import Depends, File, Form, HTTPException, UploadFile
···
     update_record,
 )
 from backend._internal.atproto.tid import datetime_to_tid
-from backend._internal.background_tasks import schedule_album_list_sync
+from backend._internal.background_tasks import (
+    schedule_album_list_sync,
+    schedule_move_track_audio,
+)
 from backend.config import settings
 from backend.models import Artist, Tag, Track, TrackTag, get_db
 from backend.schemas import TrackResponse
···
     album: Annotated[str | None, Form()] = None,
     features: Annotated[str | None, Form()] = None,
     tags: Annotated[str | None, Form(description="JSON array of tag names")] = None,
+    support_gate: Annotated[
+        str | None,
+        Form(description="JSON object for supporter gating, or 'null' to remove"),
+    ] = None,
     image: UploadFile | None = File(None),
 ) -> TrackResponse:
     """Update track metadata (only by owner)."""
···
         track.title = title
         title_changed = True
 
+    # handle support_gate update
+    # track migration direction: None = no move, True = to private, False = to public
+    move_to_private: bool | None = None
+    if support_gate is not None:
+        was_gated = track.support_gate is not None
+        if support_gate.lower() == "null" or support_gate == "":
+            # removing gating - need to move file back to public if it was gated
+            if was_gated and track.r2_url is None:
+                move_to_private = False
+            track.support_gate = None
+        else:
+            try:
+                parsed_gate = json.loads(support_gate)
+                if not isinstance(parsed_gate, dict):
+                    raise ValueError("support_gate must be a JSON object")
+                if "type" not in parsed_gate:
+                    raise ValueError("support_gate must have a 'type' field")
+                if parsed_gate["type"] not in ("any",):
+                    raise ValueError(
+                        f"unsupported support_gate type: {parsed_gate['type']}"
+                    )
+                # enabling gating - need to move file to private if it was public
+                if not was_gated and track.r2_url is not None:
+                    move_to_private = True
+                track.support_gate = parsed_gate
+            except json.JSONDecodeError as e:
+                raise HTTPException(
+                    status_code=400, detail=f"invalid support_gate JSON: {e}"
+                ) from e
+            except ValueError as e:
+                raise HTTPException(status_code=400, detail=str(e)) from e
+
     # track album changes for list sync
     old_album_id = track.album_id
     await apply_album_update(db, track, album)
···
             updated_tags.add(tag_name)
 
     # always update ATProto record if any metadata changed
+    support_gate_changed = move_to_private is not None
     metadata_changed = (
-        title_changed or album is not None or features is not None or image_changed
+        title_changed
+        or album is not None
+        or features is not None
+        or image_changed
+        or support_gate_changed
     )
     if track.atproto_record_uri and metadata_changed:
         try:
···
         if new_album_id:
             await schedule_album_list_sync(auth_session.session_id, new_album_id)
 
+    # move audio file between buckets if support_gate was toggled
+    if move_to_private is not None:
+        await schedule_move_track_audio(track.id, to_private=move_to_private)
+
     # build track_tags dict for response
     # if tags were updated, use updated_tags; otherwise query for existing
     if tags is not None:
···
         Exception: if ATProto record update fails
     """
     record_uri = track.atproto_record_uri
-    audio_url = track.r2_url
-    if not record_uri or not audio_url:
+    if not record_uri:
         return
 
+    # for gated tracks, use the API endpoint URL instead of r2_url
+    # (r2_url is None for private bucket tracks)
+    if track.support_gate is not None:
+        backend_url = settings.atproto.redirect_uri.rsplit("/", 2)[0]
+        audio_url = urljoin(backend_url + "/", f"audio/{track.file_id}")
+    else:
+        audio_url = track.r2_url
+        if not audio_url:
+            return
+
     updated_record = build_track_record(
         title=track.title,
         artist=track.artist.display_name,
···
         duration=track.duration,
         features=track.features if track.features else None,
         image_url=image_url_override or await track.get_image_url(),
+        support_gate=track.support_gate,
     )
 
     result = await update_record(

backend/src/backend/api/tracks/uploads.py

···
 from backend._internal.image import ImageFormat
 from backend._internal.jobs import job_service
 from backend.config import settings
-from backend.models import Artist, Tag, Track, TrackTag
+from backend.models import Artist, Tag, Track, TrackTag, UserPreferences
 from backend.models.job import JobStatus, JobType
 from backend.storage import storage
 from backend.utilities.audio import extract_duration
···
     image_path: str | None = None
     image_filename: str | None = None
     image_content_type: str | None = None
+
+    # supporter-gated content (e.g., {"type": "any"})
+    support_gate: dict | None = None
 
 
 async def _get_or_create_tag(
···
     upload_id: str,
     file_path: str,
     filename: str,
+    *,
+    gated: bool = False,
 ) -> str | None:
-    """save audio file to storage, returning file_id or None on failure."""
+    """save audio file to storage, returning file_id or None on failure.
+
+    args:
+        upload_id: job tracking ID
+        file_path: path to temp file
+        filename: original filename
+        gated: if True, save to private bucket (no public URL)
+    """
+    message = "uploading to private storage..." if gated else "uploading to storage..."
     await job_service.update_progress(
         upload_id,
         JobStatus.PROCESSING,
-        "uploading to storage...",
+        message,
         phase="upload",
         progress_pct=0.0,
     )
     try:
         async with R2ProgressTracker(
             job_id=upload_id,
-            message="uploading to storage...",
+            message=message,
             phase="upload",
         ) as tracker:
             with open(file_path, "rb") as file_obj:
-                file_id = await storage.save(
-                    file_obj, filename, progress_callback=tracker.on_progress
-                )
+                if gated:
+                    file_id = await storage.save_gated(
+                        file_obj, filename, progress_callback=tracker.on_progress
+                    )
+                else:
+                    file_id = await storage.save(
+                        file_obj, filename, progress_callback=tracker.on_progress
+                    )
 
         await job_service.update_progress(
             upload_id,
             JobStatus.PROCESSING,
-            "uploading to storage...",
+            message,
             phase="upload",
             progress_pct=100.0,
         )
-        logfire.info("storage.save completed", file_id=file_id)
+        logfire.info("storage.save completed", file_id=file_id, gated=gated)
         return file_id
 
     except Exception as e:
···
             with open(ctx.file_path, "rb") as f:
                 duration = extract_duration(f)
 
-            # save audio to storage
+            # validate gating requirements if support_gate is set
+            is_gated = ctx.support_gate is not None
+            if is_gated:
+                async with db_session() as db:
+                    prefs_result = await db.execute(
+                        select(UserPreferences).where(
+                            UserPreferences.did == ctx.artist_did
+                        )
+                    )
+                    prefs = prefs_result.scalar_one_or_none()
+                    if not prefs or prefs.support_url != "atprotofans":
+                        await job_service.update_progress(
+                            ctx.upload_id,
+                            JobStatus.FAILED,
+                            "upload failed",
+                            error="supporter gating requires atprotofans to be enabled in settings",
+                        )
+                        return
+
+            # save audio to storage (private bucket if gated)
             file_id = await _save_audio_to_storage(
-                ctx.upload_id, ctx.file_path, ctx.filename
+                ctx.upload_id, ctx.file_path, ctx.filename, gated=is_gated
             )
             if not file_id:
                 return
···
                     )
                     return
 
-            # get R2 URL
-            r2_url = await storage.get_url(
-                file_id, file_type="audio", extension=ext[1:]
-            )
-            if not r2_url:
-                await job_service.update_progress(
-                    ctx.upload_id,
-                    JobStatus.FAILED,
-                    "upload failed",
-                    error="failed to get public audio URL",
+            # get R2 URL (only for public tracks - gated tracks have no public URL)
+            r2_url: str | None = None
+            if not is_gated:
+                r2_url = await storage.get_url(
+                    file_id, file_type="audio", extension=ext[1:]
                 )
-                return
+                if not r2_url:
+                    await job_service.update_progress(
+                        ctx.upload_id,
+                        JobStatus.FAILED,
+                        "upload failed",
+                        error="failed to get public audio URL",
+                    )
+                    return
 
             # save image if provided
             image_url = None
···
                     phase="atproto",
                 )
                 try:
+                    # for gated tracks, use API endpoint URL instead of direct R2 URL
+                    # this ensures playback goes through our auth check
+                    if is_gated:
+                        # use backend URL for gated audio
+                        from urllib.parse import urljoin
+
+                        backend_url = settings.atproto.redirect_uri.rsplit("/", 2)[0]
+                        audio_url_for_record = urljoin(
+                            backend_url + "/", f"audio/{file_id}"
+                        )
+                    else:
+                        # r2_url is guaranteed non-None here - we returned early above if None
+                        assert r2_url is not None
+                        audio_url_for_record = r2_url
+
                     atproto_result = await create_track_record(
                         auth_session=ctx.auth_session,
                         title=ctx.title,
                         artist=artist.display_name,
-                        audio_url=r2_url,
+                        audio_url=audio_url_for_record,
                         file_type=ext[1:],
                         album=ctx.album,
                         duration=duration,
                         features=featured_artists or None,
                         image_url=image_url,
+                        support_gate=ctx.support_gate,
                     )
                     if not atproto_result:
                         raise ValueError("PDS returned no record data")
···
                     atproto_record_cid=atproto_cid,
                     image_id=image_id,
                     image_url=image_url,
+                    support_gate=ctx.support_gate,
                 )
 
                 db.add(track)
···
     album: Annotated[str | None, Form()] = None,
     features: Annotated[str | None, Form()] = None,
     tags: Annotated[str | None, Form(description="JSON array of tag names")] = None,
+    support_gate: Annotated[
+        str | None,
+        Form(description='JSON object for supporter gating, e.g., {"type": "any"}'),
+    ] = None,
     file: UploadFile = File(...),
     image: UploadFile | None = File(None),
 ) -> dict:
···
         album: Optional album name/ID to associate with the track.
         features: Optional JSON array of ATProto handles, e.g.,
             ["user1.bsky.social", "user2.bsky.social"].
+        support_gate: Optional JSON object for supporter gating.
+            Requires atprotofans to be enabled in settings.
+            Example: {"type": "any"} - requires any atprotofans support.
         file: Audio file to upload (required).
         image: Optional image file for track artwork.
         background_tasks: FastAPI background-task runner.
···
     except ValueError as e:
         raise HTTPException(status_code=400, detail=str(e)) from e
 
+    # parse and validate support_gate if provided
+    parsed_support_gate: dict | None = None
+    if support_gate:
+        try:
+            parsed_support_gate = json.loads(support_gate)
+            if not isinstance(parsed_support_gate, dict):
+                raise ValueError("support_gate must be a JSON object")
+            if "type" not in parsed_support_gate:
+                raise ValueError("support_gate must have a 'type' field")
+            if parsed_support_gate["type"] not in ("any",):
+                raise ValueError(
+                    f"unsupported support_gate type: {parsed_support_gate['type']}"
+                )
+        except json.JSONDecodeError as e:
+            raise HTTPException(
+                status_code=400, detail=f"invalid support_gate JSON: {e}"
+            ) from e
+        except ValueError as e:
+            raise HTTPException(status_code=400, detail=str(e)) from e
+
     # validate audio file type upfront
     if not file.filename:
         raise HTTPException(status_code=400, detail="no filename provided")
···
             image_path=image_path,
             image_filename=image_filename,
             image_content_type=image_content_type,
+            support_gate=parsed_support_gate,
         )
         background_tasks.add_task(_process_upload_background, ctx)
     except Exception:

backend/src/backend/config.py

···
         validation_alias="R2_IMAGE_BUCKET",
         description="R2 bucket name for image files",
     )
+    r2_private_bucket: str = Field(
+        default="",
+        validation_alias="R2_PRIVATE_BUCKET",
+        description="R2 private bucket for supporter-gated audio (no public URL)",
+    )
+    presigned_url_expiry_seconds: int = Field(
+        default=3600,
+        validation_alias="PRESIGNED_URL_EXPIRY_SECONDS",
+        description="Expiry time in seconds for presigned URLs (default 1 hour)",
+    )
     r2_endpoint_url: str = Field(
         default="",
         validation_alias="R2_ENDPOINT_URL",

backend/src/backend/models/track.py

···
         nullable=False, default=False, server_default="false"
     )
 
+    # supporter-gated content (e.g., {"type": "any"} requires any atprotofans support)
+    support_gate: Mapped[dict | None] = mapped_column(
+        JSONB, nullable=True, default=None
+    )
+
+    @property
+    def is_gated(self) -> bool:
+        """check if this track requires supporter access."""
+        return self.support_gate is not None
+
     @property
     def album(self) -> str | None:
         """get album name from extra (for ATProto compatibility)."""

backend/src/backend/schemas.py

···
     title: str
     artist: str
     artist_handle: str
+    artist_did: str
     artist_avatar_url: str | None
     file_id: str
     file_type: str
···
         None  # None = not scanned, False = clear, True = flagged
     )
     copyright_match: str | None = None  # "Title by Artist" of primary match
+    support_gate: dict[str, Any] | None = None  # supporter gating config
 
     @classmethod
     async def from_track(
···
             title=track.title,
             artist=track.artist.display_name,
             artist_handle=track.artist.handle,
+            artist_did=track.artist_did,
             artist_avatar_url=track.artist.avatar_url,
             file_id=track.file_id,
             file_type=track.file_type,
···
             tags=tags,
             copyright_flagged=copyright_flagged,
             copyright_match=copyright_match,
+            support_gate=track.support_gate,
         )

backend/src/backend/storage/r2.py

···
 
         self.audio_bucket_name = settings.storage.r2_bucket
         self.image_bucket_name = settings.storage.r2_image_bucket
+        self.private_audio_bucket_name = settings.storage.r2_private_bucket
         self.public_audio_bucket_url = settings.storage.r2_public_bucket_url
         self.public_image_bucket_url = settings.storage.r2_public_image_bucket_url
+        self.presigned_url_expiry = settings.storage.presigned_url_expiry_seconds
 
         # sync client for upload (used in background tasks)
         self.client = boto3.client(
···
                 image_bucket=self.image_bucket_name,
             )
             return False
+
+    async def save_gated(
+        self,
+        file: BinaryIO,
+        filename: str,
+        progress_callback: Callable[[float], None] | None = None,
+    ) -> str:
+        """save supporter-gated audio file to private R2 bucket.
+
+        same as save() but uses the private bucket with no public URL.
+        files in this bucket are only accessible via presigned URLs.
+
+        args:
+            file: file-like object to upload
+            filename: original filename (used to determine media type)
+            progress_callback: optional callback for upload progress
+        """
+        if not self.private_audio_bucket_name:
+            raise ValueError("R2_PRIVATE_BUCKET not configured")
+
+        with logfire.span("R2 save_gated", filename=filename):
+            # compute hash in chunks (constant memory)
+            file_id = hash_file_chunked(file)[:16]
+            logfire.info("computed file hash for gated content", file_id=file_id)
+
+            # determine file extension - only audio supported for gated content
+            ext = Path(filename).suffix.lower()
+            audio_format = AudioFormat.from_extension(ext)
+            if not audio_format:
+                raise ValueError(
+                    f"unsupported audio type for gated content: {ext}. "
+                    f"supported: {AudioFormat.supported_extensions_str()}"
+                )
+
+            key = f"audio/{file_id}{ext}"
+            media_type = audio_format.media_type
+
+            # get file size for progress tracking
+            file_size = file.seek(0, 2)
+            file.seek(0)
+
+            logfire.info(
+                "uploading gated content to private R2",
+                bucket=self.private_audio_bucket_name,
+                key=key,
+                media_type=media_type,
+                file_size=file_size,
+            )
+
+            try:
+                async with self.async_session.client(
+                    "s3",
+                    endpoint_url=self.endpoint_url,
+                    aws_access_key_id=self.aws_access_key_id,
+                    aws_secret_access_key=self.aws_secret_access_key,
+                ) as client:
+                    upload_kwargs = {
+                        "Fileobj": file,
+                        "Bucket": self.private_audio_bucket_name,
+                        "Key": key,
+                        "ExtraArgs": {"ContentType": media_type},
+                    }
+
+                    if progress_callback and file_size > 0:
+                        tracker = UploadProgressTracker(file_size, progress_callback)
+                        upload_kwargs["Callback"] = tracker
+
+                    await client.upload_fileobj(**upload_kwargs)
+            except Exception as e:
+                logfire.error(
+                    "R2 gated upload failed",
+                    error=str(e),
+                    bucket=self.private_audio_bucket_name,
+                    key=key,
+                    exc_info=True,
+                )
+                raise
+
+            logfire.info("R2 gated upload complete", file_id=file_id, key=key)
+            return file_id
+
+    async def generate_presigned_url(
+        self,
+        file_id: str,
+        extension: str,
+        expires_in: int | None = None,
+    ) -> str:
+        """generate a presigned URL for accessing gated content.
+
+        presigned URLs allow time-limited access to private bucket objects
+        without exposing credentials. the URL includes a signature that
+        expires after the specified duration.
+
+        args:
+            file_id: the file identifier hash
+            extension: file extension (e.g., "mp3", "flac")
+            expires_in: optional override for expiry seconds (default from settings)
+
+        returns:
+            presigned URL string
+
+        raises:
+            ValueError: if private bucket not configured
+        """
+        if not self.private_audio_bucket_name:
+            raise ValueError("R2_PRIVATE_BUCKET not configured")
+
+        ext = extension.lstrip(".")
+        key = f"audio/{file_id}.{ext}"
+        expiry = expires_in or self.presigned_url_expiry
+
+        with logfire.span(
+            "R2 generate_presigned_url",
+            file_id=file_id,
+            key=key,
+            expires_in=expiry,
+        ):
+            async with self.async_session.client(
+                "s3",
+                endpoint_url=self.endpoint_url,
+                aws_access_key_id=self.aws_access_key_id,
+                aws_secret_access_key=self.aws_secret_access_key,
+                config=Config(signature_version="s3v4"),
+            ) as client:
+                url = await client.generate_presigned_url(
+                    "get_object",
+                    Params={
+                        "Bucket": self.private_audio_bucket_name,
+                        "Key": key,
+                    },
+                    ExpiresIn=expiry,
+                )
+                logfire.info(
+                    "generated presigned URL",
+                    file_id=file_id,
+                    expires_in=expiry,
+                )
+                return url
+
+    async def move_audio(
+        self,
+        file_id: str,
+        extension: str,
+        *,
+        to_private: bool,
+    ) -> str | None:
+        """move an audio file between public and private buckets.
+
+        copies the file to the destination bucket, then deletes from source.
+
+        args:
+            file_id: the file identifier hash
+            extension: file extension (e.g., "mp3", "flac")
+            to_private: if True, move public->private; if False, move private->public
+
+        returns:
+            new URL if successful (public URL or None for private), None on failure
+
+        raises:
+            ValueError: if private bucket not configured
+        """
+        if not self.private_audio_bucket_name:
+            raise ValueError("R2_PRIVATE_BUCKET not configured")
+
+        ext = extension.lstrip(".")
+        key = f"audio/{file_id}.{ext}"
+
+        if to_private:
+            src_bucket = self.audio_bucket_name
+            dst_bucket = self.private_audio_bucket_name
+        else:
+            src_bucket = self.private_audio_bucket_name
+            dst_bucket = self.audio_bucket_name
+
+        with logfire.span(
+            "R2 move_audio",
+            file_id=file_id,
+            key=key,
+            to_private=to_private,
+        ):
+            try:
+                async with self.async_session.client(
+                    "s3",
+                    endpoint_url=self.endpoint_url,
+                    aws_access_key_id=self.aws_access_key_id,
+                    aws_secret_access_key=self.aws_secret_access_key,
+                ) as client:
+                    # copy to destination
+                    await client.copy_object(
+                        CopySource={"Bucket": src_bucket, "Key": key},
+                        Bucket=dst_bucket,
+                        Key=key,
+                    )
+                    logfire.info(
+                        "copied audio file",
+                        file_id=file_id,
+                        src=src_bucket,
+                        dst=dst_bucket,
+                    )
+
+                    # delete from source
+                    await client.delete_object(Bucket=src_bucket, Key=key)
+                    logfire.info("deleted from source bucket", file_id=file_id)
+
+                    # return public URL if moved to public, None if moved to private
+                    if to_private:
+                        return None
+                    return f"{self.public_audio_bucket_url}/{key}"
+
+            except ClientError as e:
+                logfire.error(
+                    "R2 move_audio failed",
+                    file_id=file_id,
+                    error=str(e),
+                    exc_info=True,
+                )
+                return None

backend/tests/api/test_audio.py

···
         test_app.dependency_overrides.pop(require_auth, None)
 
 
-async def test_get_audio_url_requires_auth(test_app: FastAPI):
-    """test that /url endpoint returns 401 without authentication."""
+async def test_get_audio_url_gated_requires_auth(
+    test_app: FastAPI, db_session: AsyncSession
+):
+    """test that /url endpoint returns 401 for gated content without authentication."""
+    # create a gated track
+    artist = Artist(
+        did="did:plc:gatedartist",
+        handle="gatedartist.bsky.social",
+        display_name="Gated Artist",
+    )
+    db_session.add(artist)
+    await db_session.flush()
+
+    track = Track(
+        title="Gated Track",
+        artist_did=artist.did,
+        file_id="gated-test-file",
+        file_type="mp3",
+        r2_url="https://cdn.example.com/audio/gated.mp3",
+        support_gate={"type": "any"},
+    )
+    db_session.add(track)
+    await db_session.commit()
+
     # ensure no auth override
     test_app.dependency_overrides.pop(require_auth, None)
 
     async with AsyncClient(
         transport=ASGITransport(app=test_app), base_url="http://test"
     ) as client:
-        response = await client.get("/audio/somefile/url")
+        response = await client.get(f"/audio/{track.file_id}/url")
+
+    assert response.status_code == 401
+    assert "authentication required" in response.json()["detail"]
+
+
+# gated content regression tests
+
+
[e-mail]
+async def gated_track(db_session: AsyncSession) -> Track:
+    """create a gated track for testing supporter access."""
+    artist = Artist(
+        did="did:plc:gatedowner",
+        handle="gatedowner.bsky.social",
+        display_name="Gated Owner",
+    )
+    db_session.add(artist)
+    await db_session.flush()
+
+    track = Track(
+        title="Supporters Only Track",
+        artist_did=artist.did,
+        file_id="gated-regression-test",
+        file_type="mp3",
+        r2_url=None,  # no cached URL - forces presigned URL generation
+        support_gate={"type": "any"},
+    )
+    db_session.add(track)
+    await db_session.commit()
+    await db_session.refresh(track)
+
+    return track
+
+
[e-mail]
+def owner_session() -> Session:
+    """session for the track owner."""
+    return Session(
+        session_id="owner-session-id",
+        did="did:plc:gatedowner",
+        handle="gatedowner.bsky.social",
+        oauth_session={
+            "access_token": "owner-access-token",
+            "refresh_token": "owner-refresh-token",
+            "dpop_key": {},
+        },
+    )
+
+
[e-mail]
+def non_supporter_session() -> Session:
+    """session for a user who is not a supporter."""
+    return Session(
+        session_id="non-supporter-session-id",
+        did="did:plc:randomuser",
+        handle="randomuser.bsky.social",
+        oauth_session={
+            "access_token": "random-access-token",
+            "refresh_token": "random-refresh-token",
+            "dpop_key": {},
+        },
+    )
+
+
+async def test_gated_stream_requires_auth(test_app: FastAPI, gated_track: Track):
+    """regression: GET /audio/{file_id} returns 401 for gated content without auth."""
+    test_app.dependency_overrides.pop(require_auth, None)
+
+    async with AsyncClient(
+        transport=ASGITransport(app=test_app), base_url="http://test"
+    ) as client:
+        response = await client.get(
+            f"/audio/{gated_track.file_id}", follow_redirects=False
+        )
+
+    assert response.status_code == 401
+    assert "authentication required" in response.json()["detail"]
+
+
+async def test_gated_head_requires_auth(test_app: FastAPI, gated_track: Track):
+    """regression: HEAD /audio/{file_id} returns 401 for gated content without auth."""
+    test_app.dependency_overrides.pop(require_auth, None)
+
+    async with AsyncClient(
+        transport=ASGITransport(app=test_app), base_url="http://test"
+    ) as client:
+        response = await client.head(f"/audio/{gated_track.file_id}")
 
     assert response.status_code == 401
+
+
+async def test_gated_head_owner_allowed(
+    test_app: FastAPI, gated_track: Track, owner_session: Session
+):
+    """regression: HEAD /audio/{file_id} returns 200 for track owner."""
+    from backend._internal import get_optional_session
+
+    test_app.dependency_overrides[get_optional_session] = lambda: owner_session
+
+    try:
+        async with AsyncClient(
+            transport=ASGITransport(app=test_app), base_url="http://test"
+        ) as client:
+            response = await client.head(f"/audio/{gated_track.file_id}")
+
+        assert response.status_code == 200
+    finally:
+        test_app.dependency_overrides.pop(get_optional_session, None)
+
+
+async def test_gated_stream_owner_redirects(
+    test_app: FastAPI, gated_track: Track, owner_session: Session
+):
+    """regression: GET /audio/{file_id} returns 307 redirect for track owner."""
+    from backend._internal import get_optional_session
+
+    mock_storage = MagicMock()
+    mock_storage.generate_presigned_url = AsyncMock(
+        return_value="https://presigned.example.com/audio/gated.mp3"
+    )
+
+    test_app.dependency_overrides[get_optional_session] = lambda: owner_session
+
+    try:
+        with patch("backend.api.audio.storage", mock_storage):
+            async with AsyncClient(
+                transport=ASGITransport(app=test_app), base_url="http://test"
+            ) as client:
+                response = await client.get(
+                    f"/audio/{gated_track.file_id}", follow_redirects=False
+                )
+
+        assert response.status_code == 307
+        assert "presigned.example.com" in response.headers["location"]
+        mock_storage.generate_presigned_url.assert_called_once()
+    finally:
+        test_app.dependency_overrides.pop(get_optional_session, None)
+
+
+async def test_gated_head_non_supporter_denied(
+    test_app: FastAPI, gated_track: Track, non_supporter_session: Session
+):
+    """regression: HEAD /audio/{file_id} returns 402 for non-supporter."""
+    from backend._internal import get_optional_session
+
+    test_app.dependency_overrides[get_optional_session] = lambda: non_supporter_session
+
+    # mock validate_supporter to return invalid
+    mock_validation = MagicMock()
+    mock_validation.valid = False
+
+    try:
+        with patch(
+            "backend.api.audio.validate_supporter",
+            AsyncMock(return_value=mock_validation),
+        ):
+            async with AsyncClient(
+                transport=ASGITransport(app=test_app), base_url="http://test"
+            ) as client:
+                response = await client.head(f"/audio/{gated_track.file_id}")
+
+        assert response.status_code == 402
+        assert response.headers.get("x-support-required") == "true"
+    finally:
+        test_app.dependency_overrides.pop(get_optional_session, None)
+
+
+async def test_gated_stream_non_supporter_denied(
+    test_app: FastAPI, gated_track: Track, non_supporter_session: Session
+):
+    """regression: GET /audio/{file_id} returns 402 for non-supporter."""
+    from backend._internal import get_optional_session
+
+    test_app.dependency_overrides[get_optional_session] = lambda: non_supporter_session
+
+    # mock validate_supporter to return invalid
+    mock_validation = MagicMock()
+    mock_validation.valid = False
+
+    try:
+        with patch(
+            "backend.api.audio.validate_supporter",
+            AsyncMock(return_value=mock_validation),
+        ):
+            async with AsyncClient(
+                transport=ASGITransport(app=test_app), base_url="http://test"
+            ) as client:
+                response = await client.get(
+                    f"/audio/{gated_track.file_id}", follow_redirects=False
+                )
+
+        assert response.status_code == 402
+        assert "supporter access" in response.json()["detail"]
+    finally:
+        test_app.dependency_overrides.pop(get_optional_session, None)

frontend/src/lib/components/Queue.svelte

···
 <script lang="ts">
 	import { queue } from '$lib/queue.svelte';
+	import { goToIndex } from '$lib/playback.svelte';
 	import type { Track } from '$lib/types';
 
 	let draggedIndex = $state<number | null>(null);
···
 								ondragover={(e) => handleDragOver(e, index)}
 								ondrop={(e) => handleDrop(e, index)}
 								ondragend={handleDragEnd}
-								onclick={() => queue.goTo(index)}
-								onkeydown={(e) => e.key === 'Enter' && queue.goTo(index)}
+								onclick={() => goToIndex(index)}
+								onkeydown={(e) => e.key === 'Enter' && goToIndex(index)}
 							>
 								<!-- drag handle for reordering -->
 								<button

frontend/src/lib/components/TrackItem.svelte

···
 	import type { Track } from '$lib/types';
 	import { queue } from '$lib/queue.svelte';
 	import { toast } from '$lib/toast.svelte';
+	import { playTrack } from '$lib/playback.svelte';
 
 	interface Props {
 		track: Track;
···
 	{/if}
 	<button
 		class="track"
-		onclick={(e) => {
+		onclick={async (e) => {
 			// only play if clicking the track itself, not a link inside
 			if (e.target instanceof HTMLAnchorElement || (e.target as HTMLElement).closest('a')) {
 				return;
 			}
-			onPlay(track);
+			// use playTrack for gated content checks, fall back to onPlay for non-gated
+			if (track.support_gate) {
+				await playTrack(track);
+			} else {
+				onPlay(track);
+			}
 		}}
 	>
-		{#if track.image_url && !trackImageError}
-			<SensitiveImage src={track.image_url}>
-				<div class="track-image">
-					<img
-						src={track.image_url}
-						alt="{track.title} artwork"
-						width="48"
-						height="48"
-						loading={imageLoading}
-						fetchpriority={imageFetchPriority}
-						onerror={() => trackImageError = true}
-					/>
+		<div class="track-image-wrapper" class:gated={track.support_gate}>
+			{#if track.image_url && !trackImageError}
+				<SensitiveImage src={track.image_url}>
+					<div class="track-image">
+						<img
+							src={track.image_url}
+							alt="{track.title} artwork"
+							width="48"
+							height="48"
+							loading={imageLoading}
+							fetchpriority={imageFetchPriority}
+							onerror={() => trackImageError = true}
+						/>
+					</div>
+				</SensitiveImage>
+			{:else if track.artist_avatar_url && !avatarError}
+				<SensitiveImage src={track.artist_avatar_url}>
+					<a
+						href="/u/{track.artist_handle}"
+						class="track-avatar"
+					>
+						<img
+							src={track.artist_avatar_url}
+							alt={track.artist}
+							width="48"
+							height="48"
+							loading={imageLoading}
+							fetchpriority={imageFetchPriority}
+							onerror={() => avatarError = true}
+						/>
+					</a>
+				</SensitiveImage>
+			{:else}
+				<div class="track-image-placeholder">
+					<svg width="24" height="24" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" xmlns="http://www.w3.org/2000/svg">
+						<circle cx="8" cy="5" r="3" stroke="currentColor" stroke-width="1.5" fill="none" />
+						<path d="M3 14c0-2.5 2-4.5 5-4.5s5 2 5 4.5" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" />
+					</svg>
 				</div>
-			</SensitiveImage>
-		{:else if track.artist_avatar_url && !avatarError}
-			<SensitiveImage src={track.artist_avatar_url}>
-				<a
-					href="/u/{track.artist_handle}"
-					class="track-avatar"
-				>
-					<img
-						src={track.artist_avatar_url}
-						alt={track.artist}
-						width="48"
-						height="48"
-						loading={imageLoading}
-						fetchpriority={imageFetchPriority}
-						onerror={() => avatarError = true}
-					/>
-				</a>
-			</SensitiveImage>
-		{:else}
-			<div class="track-image-placeholder">
-				<svg width="24" height="24" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" xmlns="http://www.w3.org/2000/svg">
-					<circle cx="8" cy="5" r="3" stroke="currentColor" stroke-width="1.5" fill="none" />
-					<path d="M3 14c0-2.5 2-4.5 5-4.5s5 2 5 4.5" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" />
-				</svg>
-			</div>
-		{/if}
+			{/if}
+			{#if track.support_gate}
+				<div class="gated-badge" title="supporters only">
+					<svg width="10" height="10" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true">
+						<path d="M12 21.35l-1.45-1.32C5.4 15.36 2 12.28 2 8.5 2 5.42 4.42 3 7.5 3c1.74 0 3.41.81 4.5 2.09C13.09 3.81 14.76 3 16.5 3 19.58 3 22 5.42 22 8.5c0 3.78-3.4 6.86-8.55 11.54L12 21.35z"/>
+					</svg>
+				</div>
+			{/if}
+		</div>
 		<div class="track-info">
 			<div class="track-title">{track.title}</div>
 			<div class="track-metadata">
···
 		align-items: center;
 		gap: 0.75rem;
 		font-family: inherit;
+	}
+
+	.track-image-wrapper {
+		position: relative;
+		flex-shrink: 0;
+		width: 48px;
+		height: 48px;
+	}
+
+	.track-image-wrapper.gated::after {
+		content: '';
+		position: absolute;
+		inset: 0;
+		background: rgba(0, 0, 0, 0.3);
+		border-radius: 4px;
+		pointer-events: none;
+	}
+
+	.gated-badge {
+		position: absolute;
+		bottom: -4px;
+		right: -4px;
+		width: 18px;
+		height: 18px;
+		display: flex;
+		align-items: center;
+		justify-content: center;
+		background: var(--accent);
+		border: 2px solid var(--bg-secondary);
+		border-radius: 50%;
+		color: white;
+		z-index: 1;
 	}
 
 	.track-image,
···
 			gap: 0.5rem;
 		}
 
+		.track-image-wrapper,
 		.track-image,
 		.track-image-placeholder,
 		.track-avatar {
 			width: 40px;
 			height: 40px;
+		}
+
+		.gated-badge {
+			width: 16px;
+			height: 16px;
+			bottom: -3px;
+			right: -3px;
+		}
+
+		.gated-badge svg {
+			width: 8px;
+			height: 8px;
 		}
 
 		.track-title {
···
 			padding: 0.5rem 0.65rem;
 		}
 
+		.track-image-wrapper,
 		.track-image,
 		.track-image-placeholder,
 		.track-avatar {
 			width: 36px;
 			height: 36px;
+		}
+
+		.gated-badge {
+			width: 14px;
+			height: 14px;
+			bottom: -2px;
+			right: -2px;
+		}
+
+		.gated-badge svg {
+			width: 7px;
+			height: 7px;
 		}
 
 		.track-title {

frontend/src/lib/components/player/Player.svelte

···
 	import { nowPlaying } from '$lib/now-playing.svelte';
 	import { moderation } from '$lib/moderation.svelte';
 	import { preferences } from '$lib/preferences.svelte';
+	import { toast } from '$lib/toast.svelte';
 	import { API_URL } from '$lib/config';
 	import { getCachedAudioUrl } from '$lib/storage';
 	import { onMount } from 'svelte';
···
 	import TrackInfo from './TrackInfo.svelte';
 	import PlaybackControls from './PlaybackControls.svelte';
 	import type { Track } from '$lib/types';
+
+	// atprotofans base URL for supporter CTAs
+	const ATPROTOFANS_URL = 'https://atprotofans.com';
 
 	// check if artwork should be shown in media session (respects sensitive content settings)
 	function shouldShowArtwork(url: string | null | undefined): boolean {
···
 		);
 	});
 
+	// gated content error types
+	interface GatedError {
+		type: 'gated';
+		artistDid: string;
+		artistHandle: string;
+		requiresAuth: boolean;
+	}
+
 	// get audio source URL - checks local cache first, falls back to network
-	async function getAudioSource(file_id: string): Promise<string> {
+	// throws GatedError if the track requires supporter access
+	async function getAudioSource(file_id: string, track: Track): Promise<string> {
 		try {
 			const cachedUrl = await getCachedAudioUrl(file_id);
 			if (cachedUrl) {
···
 		} catch (err) {
 			console.error('failed to check audio cache:', err);
 		}
+
+		// for gated tracks, check authorization first
+		if (track.support_gate) {
+			const response = await fetch(`${API_URL}/audio/${file_id}`, {
+				method: 'HEAD',
+				credentials: 'include'
+			});
+
+			if (response.status === 401) {
+				throw {
+					type: 'gated',
+					artistDid: track.artist_did,
+					artistHandle: track.artist_handle,
+					requiresAuth: true
+				} as GatedError;
+			}
+
+			if (response.status === 402) {
+				throw {
+					type: 'gated',
+					artistDid: track.artist_did,
+					artistHandle: track.artist_handle,
+					requiresAuth: false
+				} as GatedError;
+			}
+		}
+
 		return `${API_URL}/audio/${file_id}`;
 	}
 
···
 	let previousTrackId = $state<number | null>(null);
 	let isLoadingTrack = $state(false);
 
+	// store previous playback state for restoration on gated errors
+	let savedPlaybackState = $state<{
+		track: Track;
+		src: string;
+		currentTime: number;
+		paused: boolean;
+	} | null>(null);
+
 	$effect(() => {
 		if (!player.currentTrack || !player.audioElement) return;
 
 		// only load new track if it actually changed
 		if (player.currentTrack.id !== previousTrackId) {
 			const trackToLoad = player.currentTrack;
+			const audioElement = player.audioElement;
+
+			// save current playback state BEFORE changing anything
+			// (only if we have a playing/paused track to restore to)
+			if (previousTrackId !== null && audioElement.src && !audioElement.src.startsWith('blob:')) {
+				const prevTrack = queue.tracks.find((t) => t.id === previousTrackId);
+				if (prevTrack) {
+					savedPlaybackState = {
+						track: prevTrack,
+						src: audioElement.src,
+						currentTime: audioElement.currentTime,
+						paused: audioElement.paused
+					};
+				}
+			}
+
+			// update tracking state
 			previousTrackId = trackToLoad.id;
 			player.resetPlayCount();
 			isLoadingTrack = true;
···
 			cleanupBlobUrl();
 
 			// async: get audio source (cached or network)
-			getAudioSource(trackToLoad.file_id).then((src) => {
-				// check if track is still current (user may have changed tracks during await)
-				if (player.currentTrack?.id !== trackToLoad.id || !player.audioElement) {
-					// track changed, cleanup if we created a blob URL
+			getAudioSource(trackToLoad.file_id, trackToLoad)
+				.then((src) => {
+					// check if track is still current (user may have changed tracks during await)
+					if (player.currentTrack?.id !== trackToLoad.id || !player.audioElement) {
+						// track changed, cleanup if we created a blob URL
+						if (src.startsWith('blob:')) {
+							URL.revokeObjectURL(src);
+						}
+						return;
+					}
+
+					// successfully got source - clear saved state
+					savedPlaybackState = null;
+
+					// track if this is a blob URL so we can revoke it later
 					if (src.startsWith('blob:')) {
-						URL.revokeObjectURL(src);
+						currentBlobUrl = src;
 					}
-					return;
-				}
+
+					player.audioElement.src = src;
+					player.audioElement.load();
 
-				// track if this is a blob URL so we can revoke it later
-				if (src.startsWith('blob:')) {
-					currentBlobUrl = src;
-				}
+					// wait for audio to be ready before allowing playback
+					player.audioElement.addEventListener(
+						'loadeddata',
+						() => {
+							isLoadingTrack = false;
+						},
+						{ once: true }
+					);
+				})
+				.catch((err) => {
+					isLoadingTrack = false;
 
-				player.audioElement.src = src;
-				player.audioElement.load();
+					// handle gated content errors with supporter CTA
+					if (err && err.type === 'gated') {
+						const gatedErr = err as GatedError;
 
-				// wait for audio to be ready before allowing playback
-				player.audioElement.addEventListener(
-					'loadeddata',
-					() => {
-						isLoadingTrack = false;
-					},
-					{ once: true }
-				);
-			});
+						if (gatedErr.requiresAuth) {
+							toast.info('sign in to play supporter-only tracks');
+						} else {
+							// show toast with supporter CTA
+							const supportUrl = gatedErr.artistDid
+								? `${ATPROTOFANS_URL}/${gatedErr.artistDid}`
+								: `${ATPROTOFANS_URL}/${gatedErr.artistHandle}`;
+
+							toast.info('this track is for supporters only', 5000, {
+								label: 'become a supporter',
+								href: supportUrl
+							});
+						}
+
+						// restore previous playback if we had something playing
+						if (savedPlaybackState && player.audioElement) {
+							player.currentTrack = savedPlaybackState.track;
+							previousTrackId = savedPlaybackState.track.id;
+							player.audioElement.src = savedPlaybackState.src;
+							player.audioElement.currentTime = savedPlaybackState.currentTime;
+							if (!savedPlaybackState.paused) {
+								player.audioElement.play().catch(() => {});
+							}
+							savedPlaybackState = null;
+							return;
+						}
+
+						// no previous state to restore - skip to next or stop
+						if (queue.hasNext) {
+							queue.next();
+						} else {
+							player.currentTrack = null;
+							player.paused = true;
+						}
+						return;
+					}
+
+					console.error('failed to load audio:', err);
+				});
 		}
 	});
 

frontend/src/lib/config.ts

···
 
 export const API_URL = PUBLIC_API_URL || 'http://localhost:8001';
 
+/**
+ * generate atprotofans support URL for an artist.
+ * canonical format: https://atprotofans.com/support/{did}
+ */
+export function getAtprotofansSupportUrl(did: string): string {
+	return `https://atprotofans.com/support/${did}`;
+}
+
 interface ServerConfig {
 	max_upload_size_mb: number;
 	max_image_size_mb: number;

frontend/src/lib/playback.svelte.ts

···
+/**
+ * playback helper - guards queue operations with gated content checks.
+ *
+ * all playback actions should go through this module to prevent
+ * gated tracks from interrupting current playback.
+ */
+
+import { browser } from '$app/environment';
+import { queue } from './queue.svelte';
+import { toast } from './toast.svelte';
+import { API_URL, getAtprotofansSupportUrl } from './config';
+import type { Track } from './types';
+
+interface GatedCheckResult {
+	allowed: boolean;
+	requiresAuth?: boolean;
+	artistDid?: string;
+	artistHandle?: string;
+}
+
+/**
+ * check if a track can be played by the current user.
+ * returns immediately for non-gated tracks.
+ * for gated tracks, makes a HEAD request to verify access.
+ */
+async function checkAccess(track: Track): Promise<GatedCheckResult> {
+	// non-gated tracks are always allowed
+	if (!track.support_gate) {
+		return { allowed: true };
+	}
+
+	// gated track - check access via HEAD request
+	try {
+		const response = await fetch(`${API_URL}/audio/${track.file_id}`, {
+			method: 'HEAD',
+			credentials: 'include'
+		});
+
+		if (response.ok) {
+			return { allowed: true };
+		}
+
+		if (response.status === 401) {
+			return {
+				allowed: false,
+				requiresAuth: true,
+				artistDid: track.artist_did,
+				artistHandle: track.artist_handle
+			};
+		}
+
+		if (response.status === 402) {
+			return {
+				allowed: false,
+				requiresAuth: false,
+				artistDid: track.artist_did,
+				artistHandle: track.artist_handle
+			};
+		}
+
+		// unexpected status - allow and let Player handle any errors
+		return { allowed: true };
+	} catch {
+		// network error - allow and let Player handle any errors
+		return { allowed: true };
+	}
+}
+
+/**
+ * show appropriate toast for denied access.
+ */
+function showDeniedToast(result: GatedCheckResult): void {
+	if (result.requiresAuth) {
+		toast.info('sign in to play supporter-only tracks');
+	} else if (result.artistDid) {
+		toast.info('this track is for supporters only', 5000, {
+			label: 'become a supporter',
+			href: getAtprotofansSupportUrl(result.artistDid)
+		});
+	} else {
+		toast.info('this track is for supporters only');
+	}
+}
+
+/**
+ * play a single track now.
+ * checks gated access before modifying queue state.
+ * shows toast if access denied - does NOT interrupt current playback.
+ */
+export async function playTrack(track: Track): Promise<boolean> {
+	if (!browser) return false;
+
+	const result = await checkAccess(track);
+	if (!result.allowed) {
+		showDeniedToast(result);
+		return false;
+	}
+
+	queue.playNow(track);
+	return true;
+}
+
+/**
+ * set the queue and optionally start playing at a specific index.
+ * checks gated access for the starting track before modifying queue state.
+ */
+export async function playQueue(tracks: Track[], startIndex = 0): Promise<boolean> {
+	if (!browser || tracks.length === 0) return false;
+
+	const startTrack = tracks[startIndex];
+	if (!startTrack) return false;
+
+	const result = await checkAccess(startTrack);
+	if (!result.allowed) {
+		showDeniedToast(result);
+		return false;
+	}
+
+	queue.setQueue(tracks, startIndex);
+	return true;
+}
+
+/**
+ * add tracks to queue and optionally start playing.
+ * if playNow is true, checks gated access for the first added track.
+ */
+export async function addToQueue(tracks: Track[], playNow = false): Promise<boolean> {
+	if (!browser || tracks.length === 0) return false;
+
+	if (playNow) {
+		const result = await checkAccess(tracks[0]);
+		if (!result.allowed) {
+			showDeniedToast(result);
+			return false;
+		}
+	}
+
+	queue.addTracks(tracks, playNow);
+	return true;
+}
+
+/**
+ * go to a specific index in the queue.
+ * checks gated access before changing position.
+ */
+export async function goToIndex(index: number): Promise<boolean> {
+	if (!browser) return false;
+
+	const track = queue.tracks[index];
+	if (!track) return false;
+
+	const result = await checkAccess(track);
+	if (!result.allowed) {
+		showDeniedToast(result);
+		return false;
+	}
+
+	queue.goTo(index);
+	return true;
+}

frontend/src/lib/types.ts

···
 	tracks: Track[];
 }
 
+export interface SupportGate {
+	type: 'any' | string;
+}
+
 export interface Track {
 	id: number;
 	title: string;
···
 	file_type: string;
 	artist_handle: string;
 	artist_avatar_url?: string;
+	artist_did?: string;
 	r2_url?: string;
 	atproto_record_uri?: string;
 	atproto_record_cid?: string;
···
 	is_liked?: boolean;
 	copyright_flagged?: boolean | null; // null = not scanned, false = clear, true = flagged
 	copyright_match?: string | null; // "Title by Artist" of primary match
+	support_gate?: SupportGate | null; // if set, track requires supporter access
 }
 
 export interface User {

frontend/src/lib/uploader.svelte.ts

···
 		features: FeaturedArtist[],
 		image: File | null | undefined,
 		tags: string[],
+		supportGated: boolean,
 		onSuccess?: () => void,
 		callbacks?: UploadProgressCallback
 	): void {
···
 		}
 		if (image) {
 			formData.append('image', image);
+		}
+		if (supportGated) {
+			formData.append('support_gate', JSON.stringify({ type: 'any' }));
 		}
 
 		const xhr = new XMLHttpRequest();

frontend/src/routes/playlist/[id]/+page.svelte

···
 	import { toast } from "$lib/toast.svelte";
 	import { player } from "$lib/player.svelte";
 	import { queue } from "$lib/queue.svelte";
+	import { playQueue } from "$lib/playback.svelte";
 	import { fetchLikedTracks } from "$lib/tracks.svelte";
 	import type { PageData } from "./$types";
 	import type { PlaylistWithTracks, Track } from "$lib/types";
···
 		queue.playNow(track);
 	}
 
-	function playNow() {
+	async function playNow() {
 		if (tracks.length > 0) {
-			queue.setQueue(tracks);
-			queue.playNow(tracks[0]);
-			toast.success(`playing ${playlist.name}`, 1800);
+			// use playQueue to check gated access on first track before modifying queue
+			const played = await playQueue(tracks);
+			if (played) {
+				toast.success(`playing ${playlist.name}`, 1800);
+			}
 		}
 	}
 

frontend/src/routes/portal/+page.svelte

···
 	let editFeaturedArtists = $state<FeaturedArtist[]>([]);
 	let editTags = $state<string[]>([]);
 	let editImageFile = $state<File | null>(null);
+	let editSupportGate = $state(false);
 	let hasUnresolvedEditFeaturesInput = $state(false);
 
 	// profile editing state
···
 		editAlbum = track.album?.title || '';
 		editFeaturedArtists = track.features || [];
 		editTags = track.tags || [];
+		editSupportGate = track.support_gate !== null && track.support_gate !== undefined;
 	}
 
 	function cancelEdit() {
···
 		editFeaturedArtists = [];
 		editTags = [];
 		editImageFile = null;
+		editSupportGate = false;
 	}
 
 
···
 		}
 		// always send tags (empty array clears them)
 		formData.append('tags', JSON.stringify(editTags));
+		// send support_gate - null to remove, or {type: "any"} to enable
+		if (editSupportGate) {
+			formData.append('support_gate', JSON.stringify({ type: 'any' }));
+		} else {
+			formData.append('support_gate', 'null');
+		}
 		if (editImageFile) {
 			formData.append('image', editImageFile);
 		}
···
 												<p class="file-info">{editImageFile.name} (will replace current)</p>
 											{/if}
 										</div>
+										{#if atprotofansEligible || track.support_gate}
+											<div class="edit-field-group">
+												<label class="edit-label">supporter access</label>
+												<label class="toggle-row">
+													<input
+														type="checkbox"
+														bind:checked={editSupportGate}
+													/>
+													<span>only supporters can play this track</span>
+												</label>
+												{#if editSupportGate}
+													<p class="field-hint">
+														only users who support you via <a href="https://atprotofans.com" target="_blank" rel="noopener">atprotofans</a> can play this track
+													</p>
+												{/if}
+											</div>
+										{/if}
 									</div>
 									<div class="edit-actions">
 										<button
···
 								<div class="track-info">
 					<div class="track-title">
 						{track.title}
+						{#if track.support_gate}
+							<span class="support-gate-badge" title="supporters only">
+								<svg width="12" height="12" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true">
+									<path d="M12 21.35l-1.45-1.32C5.4 15.36 2 12.28 2 8.5 2 5.42 4.42 3 7.5 3c1.74 0 3.41.81 4.5 2.09C13.09 3.81 14.76 3 16.5 3 19.58 3 22 5.42 22 8.5c0 3.78-3.4 6.86-8.55 11.54L12 21.35z"/>
+								</svg>
+							</span>
+						{/if}
 						{#if track.copyright_flagged}
 							{@const matchText = track.copyright_match ? `potential copyright violation: ${track.copyright_match}` : 'potential copyright violation'}
 							{#if track.atproto_record_url}
···
 		color: var(--text-secondary);
 	}
 
+	.toggle-row {
+		display: flex;
+		align-items: center;
+		gap: 0.5rem;
+		cursor: pointer;
+		font-size: 0.9rem;
+		color: var(--text-primary);
+	}
+
+	.toggle-row input[type="checkbox"] {
+		width: 16px;
+		height: 16px;
+		accent-color: var(--accent);
+	}
+
+	.field-hint {
+		font-size: 0.8rem;
+		color: var(--text-tertiary);
+		margin-top: 0.25rem;
+	}
+
+	.field-hint a {
+		color: var(--accent);
+		text-decoration: none;
+	}
+
+	.field-hint a:hover {
+		text-decoration: underline;
+	}
+
 	.track-title {
 		font-weight: 600;
 		font-size: 1rem;
···
 		display: flex;
 		align-items: center;
 		gap: 0.5rem;
+	}
+
+	.support-gate-badge {
+		display: inline-flex;
+		align-items: center;
+		color: var(--accent);
+		flex-shrink: 0;
 	}
 
 	.copyright-flag {

frontend/src/routes/track/[id]/+page.svelte

···
 	import { checkImageSensitive } from '$lib/moderation.svelte';
 	import { player } from '$lib/player.svelte';
 	import { queue } from '$lib/queue.svelte';
+	import { playTrack } from '$lib/playback.svelte';
 	import { auth } from '$lib/auth.svelte';
 	import { toast } from '$lib/toast.svelte';
 	import type { Track } from '$lib/types';
···
 		window.location.href = '/';
 	}
 
-	function handlePlay() {
+	async function handlePlay() {
 		if (player.currentTrack?.id === track.id) {
 			// this track is already loaded - just toggle play/pause
 			player.togglePlayPause();
 		} else {
 			// different track or no track - start this one
-			queue.playNow(track);
+			// use playTrack for gated content checks
+			if (track.support_gate) {
+				await playTrack(track);
+			} else {
+				queue.playNow(track);
+			}
 		}
 	}
 
···
 		return `${minutes}:${seconds.toString().padStart(2, '0')}`;
 	}
 
-	function seekToTimestamp(ms: number) {
+	async function seekToTimestamp(ms: number) {
 		const doSeek = () => {
 			if (player.audioElement) {
 				player.audioElement.currentTime = ms / 1000;
···
 		}
 
 		// otherwise start playing and wait for audio to be ready
-		queue.playNow(track);
+		// use playTrack for gated content checks
+		let played = false;
+		if (track.support_gate) {
+			played = await playTrack(track);
+		} else {
+			queue.playNow(track);
+			played = true;
+		}
+
+		if (!played) return; // gated - can't seek
+
 		if (player.audioElement && player.audioElement.readyState >= 1) {
 			doSeek();
 		} else {

frontend/src/routes/u/[handle]/+page.svelte

···
 <script lang="ts">
 	import { fade } from 'svelte/transition';
-	import { API_URL } from '$lib/config';
+	import { API_URL, getAtprotofansSupportUrl } from '$lib/config';
 	import { browser } from '$app/environment';
 	import type { Analytics, Track, Playlist } from '$lib/types';
 	import { formatDuration } from '$lib/stats.svelte';
···
 const supportUrl = $derived(() => {
 	if (!artist?.support_url) return null;
 	if (artist.support_url === 'atprotofans') {
-		return `https://atprotofans.com/u/${artist.did}`;
+		return getAtprotofansSupportUrl(artist.did);
 	}
 	return artist.support_url;
 });

frontend/src/routes/u/[handle]/album/[slug]/+page.svelte

···
 	import { checkImageSensitive } from '$lib/moderation.svelte';
 	import { player } from '$lib/player.svelte';
 	import { queue } from '$lib/queue.svelte';
+	import { playQueue } from '$lib/playback.svelte';
 	import { toast } from '$lib/toast.svelte';
 	import { auth } from '$lib/auth.svelte';
 	import { API_URL } from '$lib/config';
···
 		queue.playNow(track);
 	}
 
-	function playNow() {
+	async function playNow() {
 		if (tracks.length > 0) {
-			queue.setQueue(tracks);
-			queue.playNow(tracks[0]);
-			toast.success(`playing ${albumMetadata.title}`, 1800);
+			// use playQueue to check gated access on first track before modifying queue
+			const played = await playQueue(tracks);
+			if (played) {
+				toast.success(`playing ${albumMetadata.title}`, 1800);
+			}
 		}
 	}
 

frontend/src/routes/upload/+page.svelte

···
 	import AlbumSelect from "$lib/components/AlbumSelect.svelte";
 	import WaveLoading from "$lib/components/WaveLoading.svelte";
 	import TagInput from "$lib/components/TagInput.svelte";
-	import type { FeaturedArtist, AlbumSummary } from "$lib/types";
+	import type { FeaturedArtist, AlbumSummary, Artist } from "$lib/types";
 	import { API_URL, getServerConfig } from "$lib/config";
 	import { uploader } from "$lib/uploader.svelte";
 	import { toast } from "$lib/toast.svelte";
···
 	let uploadTags = $state<string[]>([]);
 	let hasUnresolvedFeaturesInput = $state(false);
 	let attestedRights = $state(false);
+	let supportGated = $state(false);
 
 	// albums for selection
 	let albums = $state<AlbumSummary[]>([]);
+
+	// artist profile for checking atprotofans eligibility
+	let artistProfile = $state<Artist | null>(null);
 
 	onMount(async () => {
 		// wait for auth to finish loading
···
 			return;
 		}
 
-		await loadMyAlbums();
+		await Promise.all([loadMyAlbums(), loadArtistProfile()]);
 		loading = false;
 	});
 
+	async function loadArtistProfile() {
+		if (!auth.user) return;
+		try {
+			const response = await fetch(
+				`${API_URL}/artists/by-handle/${auth.user.handle}`,
+			);
+			if (response.ok) {
+				artistProfile = await response.json();
+			}
+		} catch (_e) {
+			console.error("failed to load artist profile:", _e);
+		}
+	}
+
 	async function loadMyAlbums() {
 		if (!auth.user) return;
 		try {
···
 		const uploadFeatures = [...featuredArtists];
 		const uploadImage = imageFile;
 		const tagsToUpload = [...uploadTags];
+		const isGated = supportGated;
 
 		const clearForm = () => {
 			title = "";
···
 			featuredArtists = [];
 			uploadTags = [];
 			attestedRights = false;
+			supportGated = false;
 
 			const fileInput = document.getElementById(
 				"file-input",
···
 			uploadFeatures,
 			uploadImage,
 			tagsToUpload,
+			isGated,
 			async () => {
 				await loadMyAlbums();
 			},
···
 				{/if}
 			</div>
 
+			<div class="form-group supporter-gating">
+				{#if artistProfile?.support_url}
+					<label class="checkbox-label">
+						<input
+							type="checkbox"
+							bind:checked={supportGated}
+						/>
+						<span class="checkbox-text">
+							<svg class="heart-icon" width="14" height="14" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true">
+								<path d="M12 21.35l-1.45-1.32C5.4 15.36 2 12.28 2 8.5 2 5.42 4.42 3 7.5 3c1.74 0 3.41.81 4.5 2.09C13.09 3.81 14.76 3 16.5 3 19.58 3 22 5.42 22 8.5c0 3.78-3.4 6.86-8.55 11.54L12 21.35z"/>
+							</svg>
+							supporters only
+						</span>
+					</label>
+					<p class="gating-note">
+						only users who support you via <a href={artistProfile.support_url} target="_blank" rel="noopener">atprotofans</a> can play this track
+					</p>
+				{:else}
+					<div class="gating-disabled">
+						<span class="gating-disabled-icon">
+							<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+								<path d="M12 21.35l-1.45-1.32C5.4 15.36 2 12.28 2 8.5 2 5.42 4.42 3 7.5 3c1.74 0 3.41.81 4.5 2.09C13.09 3.81 14.76 3 16.5 3 19.58 3 22 5.42 22 8.5c0 3.78-3.4 6.86-8.55 11.54L12 21.35z"/>
+							</svg>
+						</span>
+						<span class="gating-disabled-text">
+							want to gate tracks for supporters? <a href="https://atprotofans.com" target="_blank" rel="noopener">set up atprotofans</a>, then enable it in your <a href="/portal">portal</a>
+						</span>
+					</div>
+				{/if}
+			</div>
+
 			<div class="form-group attestation">
 				<label class="checkbox-label">
 					<input
···
 	}
 
 	.attestation-note a:hover {
+		text-decoration: underline;
+	}
+
+	.supporter-gating {
+		background: color-mix(in srgb, var(--accent) 8%, var(--bg-primary));
+		padding: 1rem;
+		border-radius: 4px;
+		border: 1px solid color-mix(in srgb, var(--accent) 20%, var(--border-default));
+	}
+
+	.supporter-gating .checkbox-text {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.4rem;
+	}
+
+	.supporter-gating .heart-icon {
+		color: var(--accent);
+	}
+
+	.gating-note {
+		margin-top: 0.5rem;
+		margin-left: 2rem;
+		font-size: 0.8rem;
+		color: var(--text-tertiary);
+		line-height: 1.4;
+	}
+
+	.gating-note a {
+		color: var(--accent);
+		text-decoration: none;
+	}
+
+	.gating-note a:hover {
+		text-decoration: underline;
+	}
+
+	.gating-disabled {
+		display: flex;
+		align-items: flex-start;
+		gap: 0.75rem;
+		color: var(--text-muted);
+	}
+
+	.gating-disabled-icon {
+		flex-shrink: 0;
+		margin-top: 0.1rem;
+	}
+
+	.gating-disabled-text {
+		font-size: 0.85rem;
+		line-height: 1.4;
+	}
+
+	.gating-disabled-text a {
+		color: var(--accent);
+		text-decoration: none;
+	}
+
+	.gating-disabled-text a:hover {
 		text-decoration: underline;
 	}
 

lexicons/track.json

···
             "type": "string",
             "format": "datetime",
             "description": "Timestamp when the track was uploaded."
+          },
+          "supportGate": {
+            "type": "ref",
+            "ref": "#supportGate",
+            "description": "If set, this track requires viewer to be a supporter of the artist via atprotofans."
           }
+        }
+      }
+    },
+    "supportGate": {
+      "type": "object",
+      "description": "Configuration for supporter-gated content.",
+      "required": ["type"],
+      "properties": {
+        "type": {
+          "type": "string",
+          "description": "The type of support required to access this content.",
+          "knownValues": ["any"]
         }
       }
     },