diff --git a/README.md b/README.md
index 43b44a1..861eebe 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,8 @@ The server listens on `http://localhost:3001` by default. Override with `PORT`.
 
 Generic Swagger CRUD is still used for most resources:
 
+All endpoints require an `Authorization: Bearer <token>` header. The mock server accepts a token defined by the `AUTH_TOKEN` environment variable, defaulting to `test-token`.
+
 ```text
 GET    /rest/v0/{resource}          list
 GET    /rest/v0/{resource}/{id}     get by ID
diff --git a/src/server.ts b/src/server.ts
index a8cc25e..aca5831 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -11,6 +11,19 @@ export async function startServer(port: number, dataStore: MockDataStore) {
   // Middleware
   app.use(express.json());
 
+  // Authentication middleware (protect only API routes)
+  const authToken = process.env.AUTH_TOKEN || "test-token";
+  app.use("/rest/v0", (req, res, next) => {
+    const auth = req.headers.authorization;
+    if (!auth) {
+      return res.status(401).json({ error: "Missing Authorization header" });
+    }
+    const [type, token] = auth.split(" ");
+    if (type !== "Bearer" || token !== authToken) {
+      return res.status(401).json({ error: "Invalid token" });
+    }
+    next();
+  });
   // HTTP request tracing
   app.use((_req, _res, next) => {
     const start = Date.now();
diff --git a/src/types.ts b/src/types.ts
index 591af95..a673e59 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -134,5 +134,10 @@ export type CreateBondedNetworkBody = {
   mtu?: number;
   nbd?: boolean;
   pifIds: Branded<"PIF">[];
-  bondMode: "lacp" | "active-backup" | "balance-xor" | "broadcast" | "round-robin";
+  bondMode:
+    | "lacp"
+    | "active-backup"
+    | "balance-xor"
+    | "broadcast"
+    | "round-robin";
 };