diff --git a/_dot_vercel_copy/output/functions/api.func/router.js b/_dot_vercel_copy/output/functions/api.func/router.js
index ce879c68..69960271 100644
--- a/_dot_vercel_copy/output/functions/api.func/router.js
+++ b/_dot_vercel_copy/output/functions/api.func/router.js
@@ -8,6 +8,7 @@ import { default as patInfo } from "./api-renamed/status/pat-info.js";
 import { default as statusUp } from "./api-renamed/status/up.js";
 import { default as authenticate } from "./api-renamed/authenticate.js";
 import { default as deleteUser } from "./api-renamed/delete-user.js";
+import { default as privateAccess } from "./api-renamed/private-access.js";
 
 export default async (req, res) => {
   // remaining code expects express.js-like request and response objects
@@ -55,6 +56,9 @@ export default async (req, res) => {
     case "/api/delete-user":
       deleteUser(req, res);
       break;
+    case "/api/private-access":
+      privateAccess(req, res);
+      break;
     default:
       res.statusCode = 404;
       res.end("Not Found");
diff --git a/_dot_vercel_copy/output/functions/api/private-access.func b/_dot_vercel_copy/output/functions/api/private-access.func
new file mode 120000
index 00000000..2e79e533
--- /dev/null
+++ b/_dot_vercel_copy/output/functions/api/private-access.func
@@ -0,0 +1 @@
+../api.func
\ No newline at end of file
diff --git a/api-renamed/private-access.js b/api-renamed/private-access.js
new file mode 100644
index 00000000..14bd57d8
--- /dev/null
+++ b/api-renamed/private-access.js
@@ -0,0 +1,18 @@
+import { logger } from "../src/common/utils.js";
+import { hasPrivateAccess } from "../src/common/database.js";
+
+/**
+ * @param {any} req The request.
+ * @param {any} res The response.
+ */
+export default async (req, res) => {
+  const { user_key } = req.query;
+  try {
+    const result = await hasPrivateAccess(user_key);
+    res.send(result);
+  } catch (err) {
+    logger.error(err);
+    res.send("Something went wrong: " + err.message);
+  }
+};
+
diff --git a/src/common/database.js b/src/common/database.js
index 293b3e63..86248e0b 100644
--- a/src/common/database.js
+++ b/src/common/database.js
@@ -191,3 +191,35 @@ export async function deleteUser(userKey) {
     console.log(`Deleted ${result.rowCount} user(s).`);
   }
 }
+
+/**
+ * Checks if private_access is true for the given user_key.
+ *
+ * @param {string} userKey user key of the user to be checked
+ * @returns {Promise<boolean>} true if private_access is true, false otherwise
+ */
+export async function hasPrivateAccess(userKey) {
+  if (!pool) {
+    return false;
+  }
+
+  const query = `
+      SELECT private_access
+      FROM authenticated_users
+      WHERE user_key = $1
+      LIMIT 1
+    `;
+  try {
+    const { rows } = await pool.query(query, [userKey]);
+    if (rows.length === 0) {
+      return false;
+    }
+    return rows[0].private_access;
+  } catch (err) {
+    if (err.code === "42P01") {
+      return false;
+    } else {
+      throw err;
+    }
+  }
+}
diff --git a/src/users.js b/src/users.js
index 56b911c1..31fe793b 100644
--- a/src/users.js
+++ b/src/users.js
@@ -63,13 +63,11 @@ async function githubAuthenticate(code) {
           "Content-Type": "application/x-www-form-urlencoded",
           Accept: "application/json",
         },
-        // TODO: above headers are not in github-trends, so double check
       },
     );
 
     const body = res.data;
     const accessToken = body && body.access_token ? body.access_token : null;
-    // TODO: verify above parsing logic, as it's new, by ChatGPT
 
     if (!accessToken) {
       throw new Error("OAuth Error: access_token missing from response");