diff --git a/main.py b/main.py
index 53b4e4d..a03b4b6 100644
--- a/main.py
+++ b/main.py
@@ -1,4 +1,4 @@
-from fastapi import FastAPI, HTTPException, Depends
+from fastapi import FastAPI, HTTPException, Depends, Header
 from fastapi.middleware.cors import CORSMiddleware
 from pydantic import BaseModel
 from typing import List, Optional
@@ -9,6 +9,9 @@ from database import get_db, create_tables, Item as ItemModel
 from schemas import ScrapeRequest, ScrapedPost
 from scraper import scrape_and_store
 
+# API Key for Django backend authentication
+API_KEY = os.getenv("ENGINE_API_KEY")
+
 app = FastAPI(
     title=os.getenv("FASTAPI_TITLE", "FastAPI ISS Project"),
     description=os.getenv("FASTAPI_DESCRIPTION", "A FastAPI project with Docker and PostgreSQL support"),
@@ -99,8 +102,15 @@ async def delete_item(item_id: int, db: Session = Depends(get_db)):
 # ============================================================================
 
 @app.post("/scrape/", response_model=List[ScrapedPost])
-async def scrape_posts(request: ScrapeRequest, db: Session = Depends(get_db)):
+async def scrape_posts(
+    request: ScrapeRequest,
+    x_api_key: str = Header(...),
+    db: Session = Depends(get_db)
+):
     """Scrape Instagram posts for a given username"""
+    if x_api_key != API_KEY:
+        raise HTTPException(status_code=403, detail="Forbidden: Invalid API key")
+    
     try:
         return scrape_and_store(db, request)
     except Exception as e: