🔒 Add API Key authentication to prevent abuse

- Add API_KEY environment variable check
- Protect /generate-pdf endpoint with API key
- Protect /generate-pdf-base64 endpoint with API key
- Keep /health endpoint public for monitoring
- Return 403 error for unauthorized requests

This protects the PDF generation API from being abused.

🦊 Created by SisiTheFox

app.py

@@ -2,9 +2,10 @@
 🦊 Sisi PDF API - Universal HTML to PDF Converter
 Perfect support for Chinese (Simplified & Traditional), Emoji, SVG, and modern CSS
 Powered by Playwright + Chromium
+🔒 Protected with API Key Authentication
 """
 
-from fastapi import FastAPI, HTTPException
+from fastapi import FastAPI, HTTPException, Header, Depends
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import Response
 from pydantic import BaseModel
@@ -13,10 +14,24 @@ from typing import Optional
 import logging
 import base64
 import asyncio
+import os
 
 logging.basicConfig(level=logging.INFO)
 logger = logging.getLogger(__name__)
 
+# 🔐 API Key Configuration
+API_KEY = os.environ.get("API_KEY", "sisi_default_key_change_me")
+
+
+def verify_api_key(x_api_key: Optional[str] = Header(None)):
+    """Verify API key from request header"""
+    if x_api_key != API_KEY:
+        raise HTTPException(
+            status_code=403,
+            detail="🔒 Invalid or missing API key. Please contact SisiTheFox for access."
+        )
+    return x_api_key
+
 app = FastAPI(
     title="Sisi PDF API",
     description="Universal HTML to PDF converter with perfect Chinese, Emoji, and SVG support",
@@ -75,9 +90,10 @@ def health_check():
 
 
 @app.post("/generate-pdf")
-async def generate_pdf(request: PDFRequest):
+async def generate_pdf(request: PDFRequest, api_key: str = Depends(verify_api_key)):
     """
     Generate PDF from HTML content
+    🔒 Requires API Key authentication
 
     Perfect support for:
     - Chinese characters (简体中文、繁體中文)
@@ -137,9 +153,10 @@ async def generate_pdf(request: PDFRequest):
 
 
 @app.post("/generate-pdf-base64")
-async def generate_pdf_base64(request: PDFRequest):
+async def generate_pdf_base64(request: PDFRequest, api_key: str = Depends(verify_api_key)):
     """
     Generate PDF and return as base64 string
+    🔒 Requires API Key authentication
     Useful for embedding in JSON responses
     """
     try: