Update main.py

main.py

@@ -138,32 +138,40 @@ def get_scraper():
     return scraper_pool[int(time.time() * 1000) % MAX_SCRAPERS]  # Simple round-robin
 
 # API key validation - optimized to avoid string operations when possible
-async def verify_api_key(api_key: str = Security(api_key_header)) -> bool:
+async def verify_api_key(
+    request: Request,
+    api_key: str = Security(api_key_header)
+) -> bool:
+    # Allow bypass if the referer is from /playground
+    referer = request.headers.get("referer", "")
+    if referer.startswith("https://parthsadaria-lokiai.hf.space/playground"):
+        return True
+
     if not api_key:
         raise HTTPException(
             status_code=HTTP_403_FORBIDDEN,
             detail="No API key provided"
         )
-    
+
     # Only clean if needed    
     if api_key.startswith('Bearer '):
         api_key = api_key[7:]  # Remove 'Bearer ' prefix
-    
+
     # Get API keys from environment
-    valid_api_keys = get_env_vars()['api_keys']
+    valid_api_keys = get_env_vars().get('api_keys', [])
     if not valid_api_keys or valid_api_keys == ['']:
         raise HTTPException(
             status_code=HTTP_403_FORBIDDEN,
             detail="API keys not configured on server"
         )
-    
+
     # Fast check with set operation
     if api_key not in set(valid_api_keys):
         raise HTTPException(
             status_code=HTTP_403_FORBIDDEN,
             detail="Invalid API key"
         )
-    
+
     return True
 
 # Pre-load and cache models.json