diff --git a/app/auth.py b/app/auth.py
new file mode 100644
index 0000000..67dad92
--- /dev/null
+++ b/app/auth.py
@@ -0,0 +1,28 @@
+import secrets
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPBasic, HTTPBasicCredentials
+
+from app.core import get_settings
+
+security = HTTPBasic(auto_error=False)
+
+
+def require_auth(credentials: HTTPBasicCredentials | None = Depends(security)) -> str:
+    settings = get_settings()
+    if not settings.auth_enabled:
+        return 'auth-disabled'
+    if credentials is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail='Authentication required',
+            headers={'WWW-Authenticate': 'Basic'},
+        )
+    username_ok = secrets.compare_digest(credentials.username, settings.admin_username)
+    password_ok = secrets.compare_digest(credentials.password, settings.admin_password)
+    if not username_ok or not password_ok:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail='Invalid username or password',
+            headers={'WWW-Authenticate': 'Basic'},
+        )
+    return credentials.username