diff --git a/main.py b/main.py
index 8f185fe..535c4a6 100644
--- a/main.py
+++ b/main.py
@@ -111,6 +111,10 @@ async def require_iap(request: Request, call_next):
         return await call_next(request)
     if request.headers.get("x-goog-authenticated-user-email"):
         return await call_next(request)
+    # M2M: X-Internal-Key bypass
+    _ikey = request.headers.get("X-Internal-Key", "")
+    if _ikey and _ikey == os.environ.get("INTERNAL_API_KEY", ""):
+        return await call_next(request)
     # Fallback: aksepter Cloud Run identity token (Bearer)
     auth_header = request.headers.get("Authorization", "")
     if auth_header.startswith("Bearer "):