auth

README.md

@@ -31,6 +31,13 @@ Create that file once on the server with the production values required by the
 app. The Gitea deploy step verifies that it exists, but it does not create or
 overwrite it.
 
+Protected API routes require the shared API key from `ORG_BACKEND_API_KEY`.
+Clients send it as:
+
+```text
+X-Org-Api-Key: <key>
+```
+
 The live systemd unit at `/etc/systemd/system/org-backend.service` is managed
 as a symlink to `misc/org-backend.service`, so the project copy is the source of
 truth.