diff --git a/members/patronimage.pl b/members/patronimage.pl
index da62b87553..c4a6e5eb40 100755
--- a/members/patronimage.pl
+++ b/members/patronimage.pl
@@ -47,7 +47,7 @@ This script, when called from within HTML and passed a valid patron borrowernumb
 
 =cut
 
-my ($status, $cookie, $sessionID) = check_api_auth($query, { catalogue => 1 } );
+my ($status, $cookie, $sessionID) = check_api_auth($query, [ { borrowers => '*' }, { circulate => '*' } ] );
 
 unless ( $status eq 'ok' ) {
     print $query->header(-type => 'text/plain', -status => '403 Forbidden');