Add toggleable API auth for hackathon bot evaluation

config.py

@@ -88,7 +88,13 @@ API_ACCESS_KEY = (
     os.getenv("API_KEY")
 )
 
+# Competition/deployment toggle:
+# When false, endpoints are public and evaluators can call APIs without auth headers.
+REQUIRE_API_KEY = os.getenv("REQUIRE_API_KEY", "false").strip().lower() == "true"
+
 def is_api_key_valid(key: str) -> bool:
+    if not REQUIRE_API_KEY:
+        return True
     return bool(API_ACCESS_KEY and key and key.strip() == API_ACCESS_KEY)
 
 # Flag to check if Gemini is configured

main.py

@@ -125,6 +125,9 @@ async def get_api_key(
     authorization: Optional[str] = Header(None, alias="Authorization"),
 ) -> str:
     """Validate incoming API key from header or bearer auth."""
+    if not config.REQUIRE_API_KEY:
+        return "public"
+
     token = x_api_key
     if authorization:
         bearer_prefix = "Bearer "