diff --git a/src/api/parole/controllers/__tests__/parole.test.js b/src/api/parole/controllers/__tests__/parole.test.js
new file mode 100644
index 0000000..0820cf4
--- /dev/null
+++ b/src/api/parole/controllers/__tests__/parole.test.js
@@ -0,0 +1,91 @@
+import {describe, it, expect, vi} from 'vitest'
+
+const {default: createController} = await import('../parole.js')
+
+function buildStrapi({jwtUserId, dbUser, artiste}) {
+  const paroleDocuments = {
+    findMany: vi.fn(async () => []),
+    create: vi.fn(async ({data}) => ({id: 42, ...data}))
+  }
+  const userDocuments = {
+    findOne: vi.fn(async () => dbUser),
+    update: vi.fn(async () => {})
+  }
+  const artisteDocuments = {
+    findOne: vi.fn(async () => artiste)
+  }
+
+  const strapi = {
+    contentType: vi.fn(() => ({uid: 'api::parole.parole', kind: 'collectionType'})),
+    service: vi.fn(() => ({
+      validateParoles: vi.fn(),
+      translateLyrics: vi.fn()
+    })),
+    plugins: {
+      'users-permissions': {
+        services: {
+          jwt: {
+            getToken: vi.fn(async () => ({id: jwtUserId}))
+          }
+        }
+      }
+    },
+    documents: vi.fn(uid => {
+      if (uid === 'plugin::users-permissions.user') return userDocuments
+      if (uid === 'api::artiste.artiste') return artisteDocuments
+      if (uid === 'api::parole.parole') return paroleDocuments
+      throw new Error(`unexpected uid: ${uid}`)
+    })
+  }
+
+  return {strapi, paroleDocuments, userDocuments, artisteDocuments}
+}
+
+function buildCtx(data) {
+  return {
+    request: {
+      body: {data},
+      header: {authorization: 'Bearer faketoken'}
+    },
+    unauthorized: vi.fn(),
+    badRequest: vi.fn(),
+    notFound: vi.fn()
+  }
+}
+
+const dbUser = {id: 1, documentId: 'user-doc-1', username: 'foo', email: 'foo@bar.com'}
+const artiste = {documentId: 'artiste-doc-1'}
+
+function buildData(overrides = {}) {
+  return {
+    titre: 'Test',
+    transcription: 'Paroles...',
+    user: {...dbUser},
+    artistes: [{documentId: 'artiste-doc-1'}],
+    ...overrides
+  }
+}
+
+describe('parole.create', () => {
+  it('refuse et ne crée rien quand le user du JWT ne correspond pas au user du payload', async () => {
+    const {strapi, paroleDocuments} = buildStrapi({jwtUserId: 999, dbUser, artiste})
+    const controller = createController({strapi})
+    const ctx = buildCtx(buildData())
+
+    await controller.create(ctx)
+
+    expect(ctx.unauthorized).toHaveBeenCalled()
+    expect(paroleDocuments.create).not.toHaveBeenCalled()
+  })
+
+  it('crée la parole quand le user du JWT correspond au user du payload', async () => {
+    const {strapi, paroleDocuments} = buildStrapi({jwtUserId: 1, dbUser, artiste})
+    const controller = createController({strapi})
+    const ctx = buildCtx(buildData())
+
+    await controller.create(ctx)
+
+    expect(ctx.unauthorized).not.toHaveBeenCalled()
+    expect(paroleDocuments.create).toHaveBeenCalled()
+  })
+})
diff --git a/src/api/parole/controllers/parole.js b/src/api/parole/controllers/parole.js
index 8bdfb08..b275864 100644
--- a/src/api/parole/controllers/parole.js
+++ b/src/api/parole/controllers/parole.js
@@ -78,10 +78,10 @@ module.exports = createCoreController('api::parole.parole', ({strapi}) => ({
         ].services.jwt.getToken(ctx)
 
         if (id !== data.user.id) {
-          ctx.unauthorized('Opération non autorisée')
+          return ctx.unauthorized('Opération non autorisée')
         }
       } catch (err) {
-        ctx.unauthorized(ctx, err, 'Opération non autorisée')
+        return ctx.unauthorized('Opération non autorisée')
       }
     }
 
@@ -90,11 +90,11 @@ module.exports = createCoreController('api::parole.parole', ({strapi}) => ({
     })
 
     if (!user) {
-      ctx.notFound('Utilisateur introuvable.')
+      return ctx.notFound('Utilisateur introuvable.')
     }
 
     if (user.id !== data.user.id || user.username !== data.user.username || user.email !== data.user.email) {
-      ctx.badRequest('Informations non valides.')
+      return ctx.badRequest('Informations non valides.')
     }
 
     const artiste = await strapi.documents('api::artiste.artiste').findOne({
@@ -102,7 +102,7 @@ module.exports = createCoreController('api::parole.parole', ({strapi}) => ({
     })
 
     if (!artiste) {
-      ctx.notFound('Artiste introuvable.')
+      return ctx.notFound('Artiste introuvable.')
     }
 
     const currentUserParole = await strapi.documents('api::parole.parole').findMany({