diff --git a/src/main/scala/sc4pac/Data.scala b/src/main/scala/sc4pac/Data.scala
index 2406c3d..fcb8640 100644
--- a/src/main/scala/sc4pac/Data.scala
+++ b/src/main/scala/sc4pac/Data.scala
@@ -28,8 +28,7 @@ object JsonData extends SharedData {
 
   implicit val subPathRw: ReadWriter[os.SubPath] = readwriter[String].bimap[os.SubPath](_.toString(), os.SubPath(_))
 
-  implicit val uriRw: ReadWriter[java.net.URI] = readwriter[String].bimap[java.net.URI](_.toString(),
-    MetadataRepository.parseChannelUrl(_).left.map(new IllegalArgumentException(_)).toTry.get)
+  implicit val uriRw: ReadWriter[java.net.URI] = readwriter[String].bimap[java.net.URI](_.toString(), new java.net.URI(_))
 
   private[sc4pac] def bareModuleRead(s: String) =
     Sc4pac.parseModule(s) match {
diff --git a/src/main/scala/sc4pac/api/api.scala b/src/main/scala/sc4pac/api/api.scala
index 9a225a9..bc712c8 100644
--- a/src/main/scala/sc4pac/api/api.scala
+++ b/src/main/scala/sc4pac/api/api.scala
@@ -415,9 +415,16 @@ class Api(options: sc4pac.cli.Commands.ServerOptions) {
       wrapHttpEndpoint {
         for {
           urls         <- parseOr400[Seq[java.net.URI]](req.body, ErrorMessage.BadRequest("Malformed channel URLs.", "Pass channels as an array of strings."))
+          urls2        <- ZIO.foreach(urls)(url => ZIO.fromEither(
+                            MetadataRepository.parseChannelUrl(url.toString)  // sanitization
+                              .left.map(err => jsonResponse(
+                                ErrorMessage.BadRequest("Malformed channel URL.", err)
+                              ).status(Status.BadRequest)
+                            )
+                          ))
           pluginsData  <- readPluginsOr409
           pluginsData2 =  pluginsData.copy(config = pluginsData.config.copy(channels =
-                            if (urls.nonEmpty) urls.distinct else Constants.defaultChannelUrls
+                            if (urls2.nonEmpty) urls2.distinct else Constants.defaultChannelUrls
                           ))
           path         <- JD.Plugins.pathURIO
           _            <- JsonIo.write(path, pluginsData2, None)(ZIO.succeed(()))