feat: added

README.md

@@ -22,13 +22,24 @@ Text-only inference. Returns full response in one JSON body (no streaming).
 
 **Response:** `{ "response": "..." }`
 
+**Auth:** If `API_KEY` env var is set, send it via header `X-API-Key: <key>` or `Authorization: Bearer <key>`. If unset, no auth.
+
 ### `GET /health`
-Health check and model load status.
+Health check and model load status (no auth).
 
 ## Usage
 
 ```bash
+# Without API key (when API_KEY is not set)
+curl -X POST "http://localhost:7860/prompt" \
+  -H "Content-Type: application/json" \
+  -d '{"prompt": "What is 2+2?"}'
+
+# With API key
 curl -X POST "http://localhost:7860/prompt" \
   -H "Content-Type: application/json" \
+  -H "X-API-Key: your-secret-key" \
   -d '{"prompt": "What is 2+2?"}'
 ```
+
+Set `API_KEY` in the environment to enable protection (e.g. `API_KEY=your-secret-key node server.js`).

server.js

@@ -9,6 +9,7 @@ import crypto from "crypto";
 const app = express();
 const PORT = 7860;
 const MODEL_ID = "huggingworld/Qwen3.5-0.8B-ONNX";
+const API_KEY = process.env.API_KEY;
 
 let model = null;
 let processor = null;
@@ -87,6 +88,16 @@ const swaggerDoc = {
     version: "1.0.0",
     description: "Text inference API using Qwen3.5-0.8B ONNX with transformers.js",
   },
+  components: {
+    securitySchemes: {
+      ApiKeyAuth: {
+        type: "apiKey",
+        in: "header",
+        name: "X-API-Key",
+        description: "Set API_KEY env var; send as X-API-Key or Authorization: Bearer <key>",
+      },
+    },
+  },
   paths: {
     "/": {
       get: {
@@ -121,13 +132,28 @@ const swaggerDoc = {
         responses: {
           200: { description: "Inference result" },
           400: { description: "Invalid input" },
+          401: { description: "Invalid or missing API key" },
           503: { description: "Model not loaded" },
         },
+        security: [{ ApiKeyAuth: [] }],
       },
     },
   },
 };
 
+function requireApiKey(req, res, next) {
+  if (!API_KEY) return next();
+  const bearer = req.headers.authorization?.startsWith("Bearer ")
+    ? req.headers.authorization.slice(7)
+    : null;
+  const key = bearer ?? req.headers["x-api-key"] ?? null;
+  if (key !== API_KEY) {
+    log("warn", "api_key_rejected", { request_id: req.requestId, path: req.path });
+    return res.status(401).json({ detail: "Invalid or missing API key." });
+  }
+  next();
+}
+
 app.use("/docs", swaggerUi.serve, swaggerUi.setup(swaggerDoc));
 
 app.use((req, res, next) => {
@@ -165,7 +191,7 @@ app.get("/health", (req, res) => {
   res.json({ status: "healthy", model_loaded: model !== null });
 });
 
-app.post("/prompt", express.json(), async (req, res) => {
+app.post("/prompt", requireApiKey, express.json(), async (req, res) => {
   const prompt = req.body.prompt;
   const maxTokens = parseInt(req.body.max_tokens) || 256;
   log("info", "prompt_request_received", {