diff --git a/artdag.py b/artdag.py
index b61bdca..eb41a14 100755
--- a/artdag.py
+++ b/artdag.py
@@ -363,14 +363,28 @@ def import_file(filepath):
 @cli.command()
 @click.argument("filepath", type=click.Path(exists=True))
 def upload(filepath):
-    """Upload a file to cache (works with remote servers)."""
-    with open(filepath, "rb") as f:
-        files = {"file": (Path(filepath).name, f)}
-        resp = requests.post(f"{get_server()}/cache/upload", files=files)
-        resp.raise_for_status()
-        result = resp.json()
-    click.echo(f"Uploaded: {result['content_hash']}")
-    click.echo(f"Size: {result['size']} bytes")
+    """Upload a file to cache (works with remote servers). Requires login."""
+    # Check auth
+    token_data = load_token()
+    if not token_data.get("access_token"):
+        click.echo("Not logged in. Please run: artdag login <username>", err=True)
+        sys.exit(1)
+
+    try:
+        with open(filepath, "rb") as f:
+            files = {"file": (Path(filepath).name, f)}
+            headers = {"Authorization": f"Bearer {token_data['access_token']}"}
+            resp = requests.post(f"{get_server()}/cache/upload", files=files, headers=headers)
+            if resp.status_code == 401:
+                click.echo("Authentication failed. Please login again.", err=True)
+                sys.exit(1)
+            resp.raise_for_status()
+            result = resp.json()
+        click.echo(f"Uploaded: {result['content_hash']}")
+        click.echo(f"Size: {result['size']} bytes")
+    except requests.RequestException as e:
+        click.echo(f"Upload failed: {e}", err=True)
+        sys.exit(1)
 
 
 @cli.command()