diff --git a/app/controllers/testing_api_settings_controller.rb b/app/controllers/testing_api_settings_controller.rb
index 6c34fed7f..75269175a 100644
--- a/app/controllers/testing_api_settings_controller.rb
+++ b/app/controllers/testing_api_settings_controller.rb
@@ -2,6 +2,8 @@
 
 class TestingApiSettingsController < ApplicationController
   def index
+    raise CanCan::AccessDenied unless current_account.testing?
+
     authorize!(:manage, current_user.access_token)
 
     @webhook_url = current_account.webhook_urls.first_or_initialize