HotFix (untested) adding a preshared key

api/src/errors/notAllowed.json

@@ -0,0 +1,8 @@
+{
+  "errors": [
+    {
+      "code": 401,
+      "message": "Wait, you're not supposed to be here, go through the gate as everyone else"
+    }
+  ]
+}

api/src/index.js

@@ -20,6 +20,8 @@ import { schemaDirectives } from './directives'
 import pubsub from './pubsub'
 import { logger } from './logger'
 
+import wrongPreshared from './errors/notAllowed.json'
+
 const GRAPHQL_ENDPOINT = '/graphql'
 const GRAPHQL_SUBSCRIPTIONS = '/graphql'
 const PORT = 4001
@@ -35,6 +37,14 @@ const db = new Prisma({
 
 const app = express()
 
+app.post(GRAPHQL_ENDPOINT, (req, res, next) => {
+  if (req.headers.preshared === process.env.PRESHARED_GATEWAY_KEY) {
+    next();
+  } else {
+    res.send(wrongPreshared);
+  }
+});
+
 app.post(GRAPHQL_ENDPOINT)
 
 const corsOptions = {