Protect API with basic auth