| Add this line to your env file before deploying with real patient data: | |
| PROVIDER_TOKEN=replace_this_with_a_long_random_string | |
| If PROVIDER_TOKEN is not set, provider routes remain unprotected | |
| (existing behaviour, safe for local dev and demos). | |
| Generate a secure token with: python3 -c "import secrets; print(secrets.token_urlsafe(32))" | |