diff --git a/lib/artists/__tests__/createArtistPostHandler.test.ts b/lib/artists/__tests__/createArtistPostHandler.test.ts
index c764c5d..a08b8d2 100644
--- a/lib/artists/__tests__/createArtistPostHandler.test.ts
+++ b/lib/artists/__tests__/createArtistPostHandler.test.ts
@@ -112,28 +112,21 @@ describe("createArtistPostHandler", () => {
     expect(response.status).toBe(403);
   });
 
-  it("passes organization_id to createArtistInDb", async () => {
-    const mockArtist = {
-      id: "artist-123",
-      account_id: "artist-123",
-      name: "Test Artist",
-      account_info: [{ image: null }],
-      account_socials: [],
-    };
-    mockCreateArtistInDb.mockResolvedValue(mockArtist);
+  it("returns 403 when personal API key tries to specify organization_id", async () => {
+    // Personal API keys have orgId=null and cannot add artists to organizations
+    mockGetApiKeyDetails.mockResolvedValue({
+      accountId: "personal-account-id",
+      orgId: null,
+    });
 
     const request = createRequest({
       name: "Test Artist",
       organization_id: "660e8400-e29b-41d4-a716-446655440001",
     });
 
-    await createArtistPostHandler(request);
-
-    expect(mockCreateArtistInDb).toHaveBeenCalledWith(
-      "Test Artist",
-      "api-key-account-id",
-      "660e8400-e29b-41d4-a716-446655440001",
-    );
+    const response = await createArtistPostHandler(request);
+    expect(response.status).toBe(403);
+    expect(mockCreateArtistInDb).not.toHaveBeenCalled();
   });
 
   it("returns 401 when API key is missing", async () => {
@@ -206,4 +199,50 @@ describe("createArtistPostHandler", () => {
     expect(response.status).toBe(500);
     expect(data.error).toBe("Database error");
   });
+
+  it("returns 403 when org API key lacks access to organization_id", async () => {
+    mockGetApiKeyDetails.mockResolvedValue({
+      accountId: "550e8400-e29b-41d4-a716-446655440000",
+      orgId: "550e8400-e29b-41d4-a716-446655440000",
+    });
+
+    const request = createRequest({
+      name: "Test Artist",
+      organization_id: "550e8400-e29b-41d4-a716-446655440001",
+    });
+    const response = await createArtistPostHandler(request);
+
+    expect(response.status).toBe(403);
+    expect(mockCreateArtistInDb).not.toHaveBeenCalled();
+  });
+
+  it("allows org API key to add artist to its own organization_id", async () => {
+    const orgId = "550e8400-e29b-41d4-a716-446655440000";
+    mockGetApiKeyDetails.mockResolvedValue({
+      accountId: orgId,
+      orgId: orgId,
+    });
+
+    const mockArtist = {
+      id: "artist-123",
+      account_id: "artist-123",
+      name: "Test Artist",
+      account_info: [{ image: null }],
+      account_socials: [],
+    };
+    mockCreateArtistInDb.mockResolvedValue(mockArtist);
+
+    const request = createRequest({
+      name: "Test Artist",
+      organization_id: orgId,
+    });
+    const response = await createArtistPostHandler(request);
+
+    expect(response.status).toBe(201);
+    expect(mockCreateArtistInDb).toHaveBeenCalledWith(
+      "Test Artist",
+      orgId,
+      orgId,
+    );
+  });
 });
diff --git a/lib/artists/createArtistPostHandler.ts b/lib/artists/createArtistPostHandler.ts
index 0d0fa4d..041a311 100644
--- a/lib/artists/createArtistPostHandler.ts
+++ b/lib/artists/createArtistPostHandler.ts
@@ -4,6 +4,7 @@ import { validateCreateArtistBody } from "@/lib/artists/validateCreateArtistBody
 import { createArtistInDb } from "@/lib/artists/createArtistInDb";
 import { getApiKeyDetails } from "@/lib/keys/getApiKeyDetails";
 import { canAccessAccount } from "@/lib/organizations/canAccessAccount";
+import { RECOUP_ORG_ID } from "@/lib/const";
 
 /**
  * Handler for POST /api/artists.
@@ -71,6 +72,22 @@ export async function createArtistPostHandler(
     accountId = validated.account_id;
   }
 
+  // Validate organization_id if provided
+  if (validated.organization_id) {
+    // Only allow adding to an organization if:
+    // 1. The API key is from RECOUP_ORG_ID (universal admin access), OR
+    // 2. The API key is from the same organization as the target organization
+    const isAdmin = keyDetails.orgId === RECOUP_ORG_ID;
+    const isSameOrg = keyDetails.orgId === validated.organization_id;
+
+    if (!isAdmin && !isSameOrg) {
+      return NextResponse.json(
+        { status: "error", error: "Access denied to specified organization_id" },
+        { status: 403, headers: getCorsHeaders() },
+      );
+    }
+  }
+
   try {
     const artist = await createArtistInDb(
       validated.name,