Allow public root/health while keeping API auth protected

api/dependencies.py

@@ -127,6 +127,10 @@ def validate_request_api_key(request: Request, settings: Settings) -> None:
         # No API key configured -> allow
         return
 
+    # Keep Space health/app shell reachable even when API auth is enabled.
+    if _is_public_probe_request(request):
+        return
+
     # Allow Hugging Face private Space signed browser requests for UI pages.
     # This keeps API routes protected while avoiding 401 on Space shell probes.
     if _is_hf_signed_page_request(request):
@@ -202,6 +206,13 @@ def _is_hf_signed_page_request(request: Request) -> bool:
     return "text/html" in accept or "*/*" in accept
 
 
+def _is_public_probe_request(request: Request) -> bool:
+    """Return True for read-only public endpoints used by app shells/health checks."""
+    if request.method not in {"GET", "HEAD"}:
+        return False
+    return request.url.path in {"/", "/health"}
+
+
 def require_api_key(
     request: Request, settings: Settings = Depends(get_settings)
 ) -> None:

tests/api/test_auth.py

@@ -55,3 +55,36 @@ def test_anthropic_auth_token_accepts_bearer_authorization():
         assert r.json()["input_tokens"] == 2
 
     app.dependency_overrides.clear()
+
+
+def test_public_root_and_health_allowed_when_auth_enabled():
+    client = TestClient(app)
+    settings = Settings()
+    settings.anthropic_auth_token = "public-check"
+    app.dependency_overrides[get_settings] = lambda: settings
+
+    root_response = client.get("/")
+    assert root_response.status_code == 200
+
+    health_response = client.get("/health")
+    assert health_response.status_code == 200
+    assert health_response.json()["status"] == "healthy"
+
+    app.dependency_overrides.clear()
+
+
+def test_api_routes_remain_protected_when_auth_enabled():
+    client = TestClient(app)
+    settings = Settings()
+    settings.anthropic_auth_token = "still-protected"
+    app.dependency_overrides[get_settings] = lambda: settings
+
+    payload = {
+        "model": "claude-3-sonnet",
+        "messages": [{"role": "user", "content": "hello"}],
+    }
+
+    response = client.post("/v1/messages/count_tokens", json=payload)
+    assert response.status_code == 401
+
+    app.dependency_overrides.clear()