send x-api-key in requests to bypass bot detection

src/server/Archive.ts

@@ -59,6 +59,7 @@ export async function readGameRecord(
       method: "GET",
       headers: {
         "Content-Type": "application/json",
+        "x-api-key": config.apiKey(),
       },
     });
     const record = await response.json();

src/server/GamePreviewRoute.ts

@@ -54,6 +54,9 @@ export function registerGamePreviewRoute(opts: {
       const apiDomain = config.jwtIssuer();
       const encodedID = encodeURIComponent(gameID);
       const response = await fetch(`${apiDomain}/game/${encodedID}`, {
+        headers: {
+          "x-api-key": config.apiKey(),
+        },
         signal: controller.signal,
       });
       if (!response.ok) return null;

src/server/jwt.ts

@@ -74,6 +74,7 @@ export async function getUserMe(
     const response = await fetch(config.jwtIssuer() + "/users/@me", {
       headers: {
         authorization: `Bearer ${token}`,
+        "x-api-key": config.apiKey(),
       },
     });
     if (response.status !== 200) {