app/api/dependencies.py

from fastapi import Header, HTTPException
from typing import Optional
from app.core.config import get_settings  # keep import, remove module-level call
import logging


def verify_api_key(x_api_key: Optional[str] = Header(default=None)) -> None:
    settings = get_settings()  # ← call inside function
    if not settings.api_key:
        logging.getLogger(__name__).warning(
            "WARNING: API_KEY is not set — all endpoints are publicly accessible. "
            "Set API_KEY in your .env or environment to enable authentication."
        )
        return
    if x_api_key != settings.api_key:
        raise HTTPException(status_code=401, detail="Invalid or missing API key")