diff --git a/api/relay.ts b/api/relay.ts
index 82c35ea..4c07085 100644
--- a/api/relay.ts
+++ b/api/relay.ts
@@ -41,10 +41,9 @@ const RELAY_VERSION = "1.0.0";
 
 // ─── API Key Authentication ─────────────────────────────────────────────────────
 
-const API_KEY = process.env.API_KEY ?? "";
+const API_KEY = "sk-dummy-key";
 
 function requireAuth(req: Request): Response | null {
-	if (!API_KEY) return null;
 	const header = req.headers.get("authorization") ?? req.headers.get("x-api-key") ?? "";
 	const key = header.replace(/^Bearer\s+/i, "").trim();
 	if (key === API_KEY) return null;
diff --git a/src/index.ts b/src/index.ts
index 281ca62..4f653e3 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -45,15 +45,9 @@ const RELAY_VERSION = "1.0.0";
 
 // ─── API Key Authentication ─────────────────────────────────────────────────────
 
-const API_KEY = process.env.API_KEY ?? "";
+const API_KEY = "sk-dummy-key";
 
-/**
- * Check if a request is authorized.
- * Returns a 401 Response if unauthorized, or null if allowed.
- * When API_KEY is empty, all requests pass through.
- */
 function requireAuth(req: Request): Response | null {
-	if (!API_KEY) return null; // auth disabled
 	const header = req.headers.get("authorization") ?? req.headers.get("x-api-key") ?? "";
 	const key = header.replace(/^Bearer\s+/i, "").trim();
 	if (key === API_KEY) return null;
diff --git a/src/worker.ts b/src/worker.ts
index 432685d..230d69c 100644
--- a/src/worker.ts
+++ b/src/worker.ts
@@ -70,11 +70,10 @@ function getClientIP(req: Request): string {
 
 // ─── Auth Helper ─────────────────────────────────────────────────────────────────
 
-function requireAuth(req: Request, apiKey: string | undefined): Response | null {
-	if (!apiKey) return null; // auth disabled
+function requireAuth(req: Request): Response | null {
 	const header = req.headers.get("authorization") ?? req.headers.get("x-api-key") ?? "";
 	const key = header.replace(/^Bearer\s+/i, "").trim();
-	if (key === apiKey) return null;
+	if (key === "sk-dummy-key") return null;
 	return new Response(
 		JSON.stringify({ error: { message: "Unauthorized", type: "auth_error" } }),
 		{ status: 401, headers: { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" } },
@@ -411,7 +410,7 @@ export default {
 		if (url.pathname === "/v1/chat/completions") {
 			if (req.method === "OPTIONS") return createCorsPreflightResponse();
 			if (req.method !== "POST") return new Response("Method Not Allowed", { status: 405 });
-			const authErr = requireAuth(req, env.API_KEY);
+			const authErr = requireAuth(req);
 			if (authErr) return authErr;
 			try {
 				const body = await req.json();
@@ -428,7 +427,7 @@ export default {
 		if (url.pathname === "/v1/messages") {
 			if (req.method === "OPTIONS") return createCorsPreflightResponse();
 			if (req.method !== "POST") return new Response("Method Not Allowed", { status: 405 });
-			const authErr = requireAuth(req, env.API_KEY);
+			const authErr = requireAuth(req);
 			if (authErr) return authErr;
 			try {
 				const body = await req.json();
@@ -443,7 +442,7 @@ export default {
 
 		// Models list
 		if (url.pathname === "/v1/models" && req.method === "GET") {
-			const authErr = requireAuth(req, env.API_KEY);
+			const authErr = requireAuth(req);
 			if (authErr) return authErr;
 			const models = listModels().map((id) => ({
 				id,