diff --git a/khatru/handlers.go b/khatru/handlers.go
index d0fc24b..7be728a 100644
--- a/khatru/handlers.go
+++ b/khatru/handlers.go
@@ -322,8 +322,8 @@ func (rl *Relay) HandleWebsocket(w http.ResponseWriter, r *http.Request) {
 				case *nostr.AuthEnvelope:
 					wsBaseUrl := strings.Replace(rl.getBaseURL(r), "http", "ws", 1)
 					if pubkey, err := nip42.ValidateAuthEvent(env.Event, ws.Challenge, wsBaseUrl); err == nil {
-						total := len(ws.AuthedPublicKeys)
 						ws.authLock.Lock()
+						total := len(ws.AuthedPublicKeys)
 						if idx := slices.Index(ws.AuthedPublicKeys, pubkey); idx == -1 {
 							// this public key is not authenticated
 							if total < rl.MaxAuthenticatedClients {