app/auth.py

import os
from fastapi import HTTPException, Security
from fastapi.security import HTTPBearer

security = HTTPBearer()

API_KEYS_STR = os.getenv("API_KEYS", "")
VALID_KEYS = set(key.strip() for key in API_KEYS_STR.split(",") if key.strip())

async def verify_api_key(credentials: str = Security(security)):
    if credentials.credentials not in VALID_KEYS:
        raise HTTPException(status_code=403, detail="Invalid API Key")
    return credentials.credentials