Protect API behind a bearer token

lib/music_library_web/auth.ex

@@ -7,11 +7,28 @@ defmodule MusicLibraryWeb.Auth do
     Plug.Crypto.secure_compare(login_password(), password)
   end
 
+  def require_api_token(conn, _opts) do
+    with ["Bearer " <> token] <- get_req_header(conn, "authorization"),
+         true <- Plug.Crypto.secure_compare(api_token(), token) do
+      conn
+    else
+      _ ->
+        conn
+        |> send_resp(:unauthorized, "Unauthorized API access")
+        |> halt()
+    end
+  end
+
   defp login_password do
     Application.get_env(:music_library, MusicLibraryWeb)
     |> Keyword.fetch!(:login_password)
   end
 
+  defp api_token do
+    Application.get_env(:music_library, MusicLibraryWeb)
+    |> Keyword.fetch!(:api_token)
+  end
+
   def require_logged_in(conn, _opts) do
     if get_session(conn, :logged_in) do
       conn

lib/music_library_web/router.ex

@@ -1,7 +1,7 @@
 defmodule MusicLibraryWeb.Router do
   use MusicLibraryWeb, :router
 
-  import MusicLibraryWeb.Auth, only: [require_logged_in: 2]
+  import MusicLibraryWeb.Auth, only: [require_logged_in: 2, require_api_token: 2]
 
   pipeline :browser do
     plug :accepts, ["html"]
@@ -14,6 +14,7 @@ defmodule MusicLibraryWeb.Router do
 
   pipeline :api do
     plug :accepts, ["json"]
+    plug :require_api_token
   end
 
   pipeline :logged_in do