diff --git a/api/internal/handler/todo.go b/api/internal/handler/todo.go
index 2904b2b..5adaf78 100644
--- a/api/internal/handler/todo.go
+++ b/api/internal/handler/todo.go
@@ -1,7 +1,24 @@
 package handler
 
-// func (h *Handler) ListTodos(c echo.Context) error {
-// 	rc := c.Request().Context()
+import (
+	"net/http"
 
-// 	todos, err := h.queries.ListTodos(rc)
-// }
+	"github.com/labstack/echo/v4"
+)
+
+func (h *Handler) ListTodos(c echo.Context) error {
+	ctx := c.Request().Context()
+
+	userInfo, err := h.AcquireConnection(ctx, c)
+	if err != nil {
+		return echo.NewHTTPError(http.StatusInternalServerError, err.Error())
+	}
+	defer userInfo.Conn.Release()
+
+	todos, err := h.queries.ListTodos(ctx, userInfo.Conn)
+	if err != nil {
+		return echo.NewHTTPError(http.StatusInternalServerError, err.Error())
+	}
+
+	return c.JSON(http.StatusOK, todos)
+}
diff --git a/api/internal/server/router.go b/api/internal/server/router.go
index bdc2954..f326591 100644
--- a/api/internal/server/router.go
+++ b/api/internal/server/router.go
@@ -11,3 +11,9 @@ import (
 func PublicRoutes(e *echo.Echo, h *handler.Handler, db *pgxpool.Pool, queries *model.Queries) {
 	e.GET("/", h.Hello)
 }
+
+func PrivateRoutes(e *echo.Echo, h *handler.Handler, db *pgxpool.Pool, queries *model.Queries) {
+	e.Use(AuthMiddleware())
+
+	e.GET("/todos", h.ListTodos)
+}
diff --git a/api/internal/server/server.go b/api/internal/server/server.go
index 89b0ae9..db975e8 100644
--- a/api/internal/server/server.go
+++ b/api/internal/server/server.go
@@ -38,6 +38,7 @@ func NewServer(db *pgxpool.Pool) (*echo.Echo, error) {
 	}))
 
 	PublicRoutes(e, h, db, queries)
+	PrivateRoutes(e, h, db, queries)
 
 	return e, nil
 }