You can easily protect the api with nginx basic auth