| # Tasks: Secure Modal Klein Endpoint | |
| ## 1. Backend Client | |
| - [x] Add `KLEIN_MODAL_TOKEN` configuration in `app.py`. | |
| - [x] Send bearer auth to the Modal generation endpoint when configured. | |
| - [x] Send bearer auth to Modal health/status checks when configured. | |
| - [x] Ensure runtime status/setup can show token configured state without exposing the value. | |
| ## 2. Modal Worker | |
| - [x] Read `KLEIN_MODAL_TOKEN` in `modal_workers/klein_image.py`. | |
| - [x] Add token validation helper. | |
| - [x] Reject unauthorized `POST /generate` requests with HTTP 401 when the token is configured. | |
| - [x] Keep requests allowed when the token is not configured. | |
| ## 3. Documentation | |
| - [x] Add `KLEIN_MODAL_TOKEN` to `.env.example`. | |
| - [x] Update README Modal setup notes. | |
| - [x] Update runtime setup guidance for the shared token. | |
| ## 4. Verification | |
| - [x] Update `scripts/verify.py` for auth wiring and redaction. | |
| - [x] Run `python scripts\verify.py`. | |
| - [x] Run `python -m py_compile app.py scripts\verify.py modal_workers\klein_image.py`. | |
| - [x] Run `git diff --check`. | |