Update API authentication to use HF secrets

gemini_web2api.py

@@ -10,7 +10,7 @@ Usage:
 
 Client configuration (Cherry Studio, ChatBox, etc.):
     Base URL: http://localhost:8081/v1
-    API Key: (anything or empty)
+    API Key: Set via API_KEY environment variable (Hugging Face Secrets)
 """
 import json
 import urllib.request
@@ -41,6 +41,7 @@ DEFAULT_CONFIG = {
     "log_requests": True,
     "cookie_file": None,
     "proxy": None,
+    "api_key": os.environ.get("API_KEY"),  # Set via Hugging Face Secrets
 }
 
 CONFIG = dict(DEFAULT_CONFIG)
@@ -298,6 +299,25 @@ class GeminiHandler(BaseHTTPRequestHandler):
     def log_message(self, fmt, *args):
         log(fmt % args)
 
+    def validate_api_key(self) -> bool:
+        """Validate the API key from Authorization header against configured key.
+        Returns True if valid or if no API key is configured (open access)."""
+        configured_key = CONFIG.get("api_key")
+        if not configured_key:
+            return True  # No key configured = open access
+        auth_header = self.headers.get("Authorization", "")
+        if auth_header.startswith("Bearer "):
+            provided_key = auth_header[7:].strip()
+        else:
+            provided_key = auth_header.strip()
+        if provided_key == configured_key:
+            return True
+        log(f"API key rejected from {self.client_address[0]}")
+        self.send_json(
+            {"error": {"message": "Invalid API key. Provide a valid key via 'Authorization: Bearer <key>' header.",
+                       "type": "authentication_error", "code": "invalid_api_key"}}, 401)
+        return False
+
     def send_json(self, data, status=200):
         body = json.dumps(data, ensure_ascii=False).encode()
         self.send_response(status)
@@ -317,6 +337,8 @@ class GeminiHandler(BaseHTTPRequestHandler):
     def do_GET(self):
         try:
             if self.path == "/v1/models":
+                if not self.validate_api_key():
+                    return
                 self.send_json({"object": "list", "data": [
                     {"id": n, "object": "model", "created": 1700000000,
                      "owned_by": "google", "description": c["desc"]}
@@ -334,6 +356,8 @@ class GeminiHandler(BaseHTTPRequestHandler):
 
     def do_POST(self):
         try:
+            if not self.validate_api_key():
+                return
             length = int(self.headers.get("Content-Length", 0))
             body = self.rfile.read(length) if length else b""
             if self.path == "/v1/chat/completions":
@@ -558,6 +582,7 @@ def main():
     print(f"  Listening: http://0.0.0.0:{port}")
     print(f"  Base URL:  http://localhost:{port}/v1")
     print(f"  Models:    {', '.join(MODELS.keys())}")
+    print(f"  API Key:   {'configured (set via API_KEY env)' if CONFIG.get('api_key') else 'none (open access)'}")
     print(f"  Cookie:    {'yes (' + CONFIG['cookie_file'] + ')' if CONFIG.get('cookie_file') else 'none (anonymous)'}")
     print(f"  Proxy:     {CONFIG.get('proxy') or 'none (uses system env HTTP_PROXY/HTTPS_PROXY)'}")
     print(f"  Retry:     {CONFIG['retry_attempts']}x / {CONFIG['retry_delay_sec']}s")