diff --git a/src/test/kotlin/roomescape/payment/PaymentAPITest.kt b/src/test/kotlin/roomescape/payment/PaymentAPITest.kt
index 69017655..d22c1e61 100644
--- a/src/test/kotlin/roomescape/payment/PaymentAPITest.kt
+++ b/src/test/kotlin/roomescape/payment/PaymentAPITest.kt
@@ -3,9 +3,10 @@ package roomescape.payment
 import com.ninjasquad.springmockk.MockkBean
 import io.kotest.matchers.shouldBe
 import io.mockk.every
-import org.hamcrest.CoreMatchers.equalTo
 import org.springframework.data.repository.findByIdOrNull
+import org.springframework.http.HttpMethod
 import org.springframework.http.HttpStatus
+import roomescape.auth.exception.AuthErrorCode
 import roomescape.payment.business.PaymentService
 import roomescape.payment.exception.PaymentErrorCode
 import roomescape.payment.infrastructure.client.CardDetail
@@ -18,7 +19,9 @@ import roomescape.payment.web.PaymentConfirmRequest
 import roomescape.payment.web.PaymentCreateResponse
 import roomescape.reservation.infrastructure.persistence.ReservationEntity
 import roomescape.util.FunSpecSpringbootTest
+import roomescape.util.INVALID_PK
 import roomescape.util.PaymentFixture
+import roomescape.util.runExceptionTest
 import roomescape.util.runTest
 
 class PaymentAPITest(
@@ -31,6 +34,27 @@ class PaymentAPITest(
 ) : FunSpecSpringbootTest() {
     init {
         context("결제를 승인한다.") {
+            context("권한이 없으면 접근할 수 없다.") {
+                val endpoint = "/payments?reservationId=$INVALID_PK"
+
+                test("비회원") {
+                    runExceptionTest(
+                        method = HttpMethod.POST,
+                        endpoint = endpoint,
+                        expectedErrorCode = AuthErrorCode.TOKEN_NOT_FOUND
+                    )
+                }
+
+                test("관리자") {
+                    runExceptionTest(
+                        token = authUtil.defaultAdminLogin(),
+                        method = HttpMethod.POST,
+                        endpoint = endpoint,
+                        expectedErrorCode = AuthErrorCode.ACCESS_DENIED
+                    )
+                }
+            }
+
             val amount = 100_000
             context("간편결제 + 카드로 ${amount}원을 결제한다.") {
                 context("일시불") {
@@ -162,18 +186,12 @@ class PaymentAPITest(
                             transferDetail = null,
                         )
 
-                        runTest(
+                        runExceptionTest(
                             token = authUtil.defaultUserLogin(),
-                            using = {
-                                body(PaymentFixture.confirmRequest)
-                            },
-                            on = {
-                                post("/payments?reservationId=${reservation.id}")
-                            },
-                            expect = {
-                                statusCode(HttpStatus.BAD_REQUEST.value())
-                                body("code", equalTo(PaymentErrorCode.NOT_SUPPORTED_PAYMENT_TYPE.errorCode))
-                            }
+                            method = HttpMethod.POST,
+                            endpoint = "/payments?reservationId=${reservation.id}",
+                            requestBody = PaymentFixture.confirmRequest,
+                            expectedErrorCode = PaymentErrorCode.NOT_SUPPORTED_PAYMENT_TYPE
                         )
                     }
                 }
@@ -181,12 +199,35 @@ class PaymentAPITest(
         }
 
         context("결제를 취소한다.") {
+            context("권한이 없으면 접근할 수 없다.") {
+                val endpoint = "/payments/cancel"
+
+                test("비회원") {
+                    runExceptionTest(
+                        method = HttpMethod.POST,
+                        endpoint = endpoint,
+                        requestBody = PaymentFixture.cancelRequest,
+                        expectedErrorCode = AuthErrorCode.TOKEN_NOT_FOUND
+                    )
+                }
+
+                test("관리자") {
+                    runExceptionTest(
+                        token = authUtil.defaultAdminLogin(),
+                        method = HttpMethod.POST,
+                        endpoint = endpoint,
+                        requestBody = PaymentFixture.cancelRequest,
+                        expectedErrorCode = AuthErrorCode.ACCESS_DENIED
+                    )
+                }
+            }
+
             test("정상 취소") {
-                val token = authUtil.defaultAdminLogin()
+                val userToken = authUtil.defaultUserLogin()
                 val confirmRequest = PaymentFixture.confirmRequest
                 val reservation = dummyInitializer.createConfirmReservation(
-                    adminToken = token,
-                    reserverToken = token
+                    adminToken = authUtil.defaultAdminLogin(),
+                    reserverToken = userToken
                 )
 
                 val paymentCreateResponse = createPayment(
@@ -202,13 +243,12 @@ class PaymentAPITest(
                     )
                 } returns PaymentFixture.cancelResponse(confirmRequest.amount)
 
+                val requestBody = PaymentFixture.cancelRequest.copy(reservationId = reservation.id)
+
                 runTest(
-                    token = token,
+                    token = userToken,
                     using = {
-                        val cancelRequest = PaymentFixture.cancelRequest.copy(
-                            reservationId = reservation.id
-                        )
-                        body(cancelRequest)
+                        body(requestBody)
                     },
                     on = {
                         post("/payments/cancel")
@@ -230,24 +270,18 @@ class PaymentAPITest(
             }
 
             test("예약에 대한 결제 정보가 없으면 실패한다.") {
-                val token = authUtil.defaultAdminLogin()
+                val userToken = authUtil.defaultUserLogin()
                 val reservation = dummyInitializer.createConfirmReservation(
-                    adminToken = token,
-                    reserverToken = token,
+                    adminToken = authUtil.defaultAdminLogin(),
+                    reserverToken = userToken,
                 )
 
-                runTest(
-                    token = token,
-                    using = {
-                        body(PaymentFixture.cancelRequest.copy(reservationId = reservation.id))
-                    },
-                    on = {
-                        post("/payments/cancel")
-                    },
-                    expect = {
-                        statusCode(HttpStatus.NOT_FOUND.value())
-                        body("code", equalTo(PaymentErrorCode.PAYMENT_NOT_FOUND.errorCode))
-                    }
+                runExceptionTest(
+                    token = userToken,
+                    method = HttpMethod.POST,
+                    endpoint = "/payments/cancel",
+                    requestBody = PaymentFixture.cancelRequest.copy(reservationId = reservation.id),
+                    expectedErrorCode = PaymentErrorCode.PAYMENT_NOT_FOUND
                 )
             }
         }