Lemonade API key (lemonade-sdk#774)

* add support for API key

* document LEMONADE_API_KEY

* do not require auth on HTTP OPTIONS  method

Author: bitgamma

docs/server/lemonade-server-cli.md

@@ -55,6 +55,10 @@ Additionally, you can provide your own `llama-server` binary by giving the full
 
 The same can also be done for the `whisper-server` binary. The environment variable to set in this case is `LEMONADE_WHISPERCPP_BIN`.
 
+If you expose your server over a network you can use the `LEMONADE_API_KEY` to set an API key (use a random long string) that will be required to execute any request. The API key will be expected as HTTP Bearer authentication, which is compatible with the OpenAI API.
+
+**IMPORTANT**: If you need to access `lemonade-server` over the internet, do not expose it directly! You will also need to setup an HTTPS reverse proxy (such as nginx) and expose that instead, otherwise all communication will be in plaintext!
+
 ## `pull` Command Options
 
 The `pull` command downloads and installs models. For models already in the [Lemonade Server registry](./server_models.md), only the model name is required. To register and install custom models from Hugging Face, use the registration options below:

src/cpp/include/lemon/server.h

@@ -47,8 +47,10 @@ class Server {
     void setup_routes(httplib::Server &web_server);
     void setup_static_files(httplib::Server &web_server);
     void setup_cors(httplib::Server &web_server);
-    void setup_http_logger(httplib::Server &web_server) ;
-    
+    void setup_http_logger(httplib::Server &web_server);
+    void log_request(const httplib::Request& req);
+    httplib::Server::HandlerResponse authenticate_request(const httplib::Request& req, httplib::Response& res);
+
     // Endpoint handlers
     void handle_health(const httplib::Request& req, httplib::Response& res);
     void handle_models(const httplib::Request& req, httplib::Response& res);
@@ -102,6 +104,8 @@ class Server {
     std::unique_ptr<ModelManager> model_manager_;
 
     bool running_;
+
+    std::string api_key_;
 };
 
 } // namespace lemon

src/cpp/include/lemon_tray/server_manager.h

@@ -110,6 +110,7 @@ class ServerManager {
     std::string llamacpp_args_;
     std::string extra_models_dir_;
     std::string host_;
+    std::string api_key_;
     int port_;
     int ctx_size_;
     int max_llm_models_;

src/cpp/server/server.cpp

@@ -82,6 +82,9 @@ Server::Server(int port, const std::string& host, const std::string& log_level,
     if (log_level_ == "debug" || log_level_ == "trace") {
         std::cout << "[Server] Debug logging enabled - subprocess output will be visible" << std::endl;
     }
+
+    const char* api_key_env = std::getenv("LEMONADE_API_KEY");
+    api_key_ = api_key_env ? std::string(api_key_env) : "";
 
     setup_routes(*http_server_);
     setup_routes(*http_server_v6_);
@@ -91,15 +94,31 @@ Server::~Server() {
     stop();
 }
 
+void Server::log_request(const httplib::Request& req) {
+    if (req.path != "/api/v0/health" && req.path != "/api/v1/health") {
+        std::cout << "[Server PRE-ROUTE] " << req.method << " " << req.path << std::endl;
+        std::cout.flush();
+    }
+}
+
+httplib::Server::HandlerResponse Server::authenticate_request(const httplib::Request& req, httplib::Response& res) {
+    if ((api_key_ != "") && (req.method != "OPTIONS")) {
+        if (api_key_ != httplib::get_bearer_token_auth(req)) {
+            res.status = 401;
+            res.set_content("{\"error\": \"Invalid or missing API key\"}", "application/json");
+            return httplib::Server::HandlerResponse::Handled;
+        }
+    }
+
+    return httplib::Server::HandlerResponse::Unhandled;
+}
+
+
 void Server::setup_routes(httplib::Server &web_server) {
     // Add pre-routing handler to log ALL incoming requests (except health checks)
     web_server.set_pre_routing_handler([this](const httplib::Request& req, httplib::Response& res) {
-        // Skip logging health checks to reduce log noise
-        if (req.path != "/api/v0/health" && req.path != "/api/v1/health") {
-            std::cout << "[Server PRE-ROUTE] " << req.method << " " << req.path << std::endl;
-            std::cout.flush();
-        }
-        return httplib::Server::HandlerResponse::Unhandled;
+        this->log_request(req);
+        return authenticate_request(req, res);
     });
 
     // Setup CORS for all routes

src/cpp/tray/server_manager.cpp

@@ -106,6 +106,9 @@ bool ServerManager::start_server(
     llamacpp_args_ = llamacpp_args;
     extra_models_dir_ = extra_models_dir;
     host_ = host;
+
+    const char* api_key_env = std::getenv("LEMONADE_API_KEY");
+    api_key_ = api_key_env ? std::string(api_key_env) : "";
 
     if (!spawn_process()) {
         std::cerr << "Failed to spawn server process" << std::endl;
@@ -821,6 +824,10 @@ std::string ServerManager::make_http_request(
     httplib::Client cli(connect_host, port_);
     cli.set_connection_timeout(10, 0);  // 10 second connection timeout
     cli.set_read_timeout(timeout_seconds, 0);  // Configurable read timeout
+
+    if (api_key_ != "") {
+        cli.set_bearer_token_auth(api_key_);
+    }
 
     httplib::Result res;