diff --git a/src/auth.ts b/src/auth.ts
new file mode 100644
index 0000000..6a6edae
--- /dev/null
+++ b/src/auth.ts
@@ -0,0 +1,15 @@
+import type { Request, Response, NextFunction } from "express";
+
+const PROXY_KEY = process.env.PROXY_KEY;
+
+export function auth(req: Request, res: Response, next: NextFunction) {
+  if (!PROXY_KEY) {
+    next();
+    return;
+  }
+  if (req.headers.authorization === `Bearer ${PROXY_KEY}`) {
+    next();
+  } else {
+    res.status(401).json({ error: "Unauthorized" });
+  }
+}