diff --git a/apps/charging-engine/src/main.rs b/apps/charging-engine/src/main.rs
index 08a36e1..c565224 100644
--- a/apps/charging-engine/src/main.rs
+++ b/apps/charging-engine/src/main.rs
@@ -1,3 +1,4 @@
+mod auth;
 mod charging;
 mod monitoring;
 mod errors;
@@ -11,6 +12,7 @@ use tracing::info;
 
 use routes::create_router;
 use charging::{ChargingEngine, RatingPlansRepo};
+use auth::AuthConfig;
 
 #[tokio::main]
 async fn main() -> Result<()> {
@@ -44,8 +46,10 @@ async fn main() -> Result<()> {
     info!("Connected to Redis successfully");
 
     // Create application state
+    let auth_config = AuthConfig::from_env();
     let state = crate::models::AppState {
         charging_engine,
+        auth_config,
     };
 
     // Create router
diff --git a/apps/charging-engine/src/models.rs b/apps/charging-engine/src/models.rs
index 5850436..be50db1 100644
--- a/apps/charging-engine/src/models.rs
+++ b/apps/charging-engine/src/models.rs
@@ -1,8 +1,11 @@
 use serde::{Deserialize, Serialize};
 
+use crate::auth::AuthConfig;
+
 #[derive(Clone)]
 pub struct AppState {
     pub charging_engine: std::sync::Arc<crate::charging::ChargingEngine>,
+    pub auth_config: AuthConfig,
 }
 
 #[derive(Deserialize)]
diff --git a/apps/charging-engine/src/routes.rs b/apps/charging-engine/src/routes.rs
index 0f5ab1c..f9330fe 100644
--- a/apps/charging-engine/src/routes.rs
+++ b/apps/charging-engine/src/routes.rs
@@ -4,6 +4,7 @@ use axum::{
 };
 use tower_http::cors::{Any, CorsLayer};
 
+use crate::auth::auth_middleware;
 use crate::handlers::{
     add_credit, add_rating_plan, block_user, check_credit, deduct_credit, detailed_health_check,
     engine_start, engine_stop, engine_uptime, get_balance, get_error_stats, get_performance_metrics,
@@ -20,13 +21,16 @@ pub fn create_router(state: AppState) -> Router {
         .allow_headers(Any);
 
     Router::new()
+        // Public routes (no auth required - for packet-gateway integration)
+        .route("/health", get(health_check))
         .route("/v1/credit/:ip/check", post(check_credit))
         .route("/v1/credit/:ip/deduct", post(deduct_credit))
-        .route("/v1/credit/:ip/add", post(add_credit))
         .route("/v1/credit/:ip/balance", get(get_balance))
+        .route("/v1/usage", post(record_usage))
+        // Protected routes (require auth)
+        .route("/v1/credit/:ip/add", post(add_credit))
         .route("/v1/subscriber/:imsi", get(get_subscriber))
         .route("/v1/subscriber/:imsi", put(update_subscriber))
-        .route("/v1/usage", post(record_usage))
         .route("/v1/rating-plans", get(list_rating_plans))
         .route("/v1/rating-plans/:id", get(get_rating_plan))
         .route("/v1/rating-plans", post(add_rating_plan))
@@ -42,11 +46,11 @@ pub fn create_router(state: AppState) -> Router {
         .route("/v1/engine/start", post(engine_start))
         .route("/v1/engine/stop", post(engine_stop))
         .route("/v1/engine/uptime", get(engine_uptime))
-        .route("/health", get(health_check))
         .route("/v1/usage/calculate-cost", post(calculate_usage_cost))
         .route("/v1/usage/rate", post(rate_usage))
         .route("/v1/usage/process", post(process_usage))
         .route("/v1/invoice/:imsi/:period", get(generate_invoice))
         .layer(cors)
+        .route_layer(axum::middleware::from_fn_with_state(state.auth_config.clone(), auth_middleware))
         .with_state(state)
 }