diff --git a/src/everything/transports/sse.ts b/src/everything/transports/sse.ts
index 2406db7cfa..db434e9daf 100644
--- a/src/everything/transports/sse.ts
+++ b/src/everything/transports/sse.ts
@@ -16,6 +16,15 @@ app.use(
   })
 );
 
+// Optional token-based authentication middleware
+const API_KEY = process.env.API_KEY;
+app.use((req, res, next) => {
+  if (!API_KEY) { next(); return; }
+  const auth = req.headers.authorization;
+  if (auth === `Bearer ${API_KEY}`) { next(); return; }
+  res.status(401).json({ error: "Unauthorized" });
+});
+
 // Map sessionId to transport for each client
 const transports: Map<string, SSEServerTransport> = new Map<
   string,