Update app.py

app.py

@@ -31,6 +31,28 @@ SYSTEM_PROMPT = (
     "Don't repeat yourself too much.\n"
 )
 
+
+# -------------------------
+# Auth
+# -------------------------
+API_PASSWORD = os.environ.get("API_PASSWORD", "").strip()
+
+def _require_auth():
+    """
+    Require a shared secret from the client.
+    Client must send header: X-API-PASSWORD: <secret>
+    """
+    if not API_PASSWORD:
+        # If you forget to set the secret, fail closed.
+        return jsonify({"error": "Server missing API_PASSWORD secret"}), 500
+
+    provided = (request.headers.get("X-API-PASSWORD") or "").strip()
+    if not provided or provided != API_PASSWORD:
+        return jsonify({"error": "Unauthorized"}), 401
+
+    return None
+
+
 # STT (we chose base.en)
 WHISPER_MODEL_NAME = os.environ.get("WHISPER_MODEL", "base.en")
 WHISPER_DEVICE = os.environ.get("WHISPER_DEVICE", "cpu")
@@ -205,6 +227,10 @@ def health():
 
 @app.post("/v1/chat")
 def chat_text():
+    auth_resp = _require_auth()
+    if auth_resp:
+        return auth_resp
+        
     t0 = time.time()
     ip = _client_ip()
 
@@ -249,6 +275,10 @@ def tts_only():
     Timing headers:
       X-TTS-MS, X-TOTAL-MS
     """
+    auth_resp = _require_auth()
+    if auth_resp:
+        return auth_resp
+        
     ip = _client_ip()
     t0 = time.time()
 
@@ -301,6 +331,10 @@ def utterance_audio_to_audio():
     Timing headers:
       X-STT-MS, X-LLM-MS, X-TTS-MS, X-TOTAL-MS
     """
+    auth_resp = _require_auth()
+    if auth_resp:
+        return auth_resp
+        
     t0 = time.time()
     ip = _client_ip()
 
@@ -413,6 +447,10 @@ def utterance_audio_to_audio():
 
 @app.post("/v1/reset")
 def reset():
+    auth_resp = _require_auth()
+    if auth_resp:
+        return auth_resp
+        
     ip = _client_ip()
     print(f"[/v1/reset] {time.strftime('%Y-%m-%d %H:%M:%S')} ip={ip} clearing mem (was {len(HISTORY)}/{MAX_MESSAGES})")
     HISTORY.clear()