Usually, for these kind of programs, I put them behind a proxy with basic auth.

Also, when I tried to add something on the demo site, it asked me for an auth key.

Looking at the code, the package.json file has an entry for AUTH_KEY (in the Cloudflare config) to prevent random people from pasting stuff.

Ah, well that's kinda perfect actually