diff --git a/src/middleware.ts b/src/middleware.ts
index ae24a4d..e513bf1 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -59,8 +59,19 @@ export async function middleware(req: NextRequest) {
   const url = req.nextUrl.clone();
   const path = url.pathname;
 
+  const apiKeyHeader =
+    req.headers.get('x-api-key') ||
+    req.headers.get('authorization')?.replace(/^Bearer\s+/i, '');
+  const isApiKeyAuth =
+    Boolean(apiKeyHeader) &&
+    apiKeyHeader ===
+      (process.env.INTEGRATIONS_API_KEY ||
+        process.env.N8N_API_KEY ||
+        'n8n_sec_4v_9a7d3b2c1f8e4a5d6c7b8a9e0f1a2b3c');
+
   // Public: login, attribution script, health, inbound webhooks (CRM), cron (Bearer CRON_SECRET), integrations (API Key)
   const isPublic =
+    (isApiKeyAuth && path.startsWith('/api/')) ||
     path === '/login' ||
     path === '/api/health' ||
     path.startsWith('/api/webhooks/') ||