Added API key authentication alternative.

composer.json

@@ -33,7 +33,7 @@
 	},
 	"scripts": {
 		"lint": "php ./vendor/bin/phpcs -ps .",
-		"make-pot": "./vendor/bin/wp make-pot ./ languages/prompress.pot --domain=prompress"
+		"make-pot": "./vendor/bin/wp i18n make-pot ./ languages/prompress.pot --domain=prompress"
 	},
 	"config": {
 		"sort-packages": true,

inc/admin-page.php

@@ -46,6 +46,12 @@ function register_page() {
  */
 function render_page() {
 	?>
+	<script>
+		var prompress = {
+			settings: <?php echo wp_json_encode( get_settings() ); ?>,
+			configTemplate: <?php echo wp_json_encode( get_prometheus_config_template() ) . "\n"; ?>
+		};
+	</script>
 	<div id="prompress-plugin-settings"></div>
 	<?php
 }

inc/rest.php

@@ -43,6 +43,9 @@ function register_rest_routes(): void {
 		[
 			'methods'  => \WP_REST_Server::READABLE,
 			'callback' => __NAMESPACE__ . '\\storage_compatibility',
+			'permission_callback' => function () {
+				return \current_user_can( 'manage_options' );
+			},
 		]
 	);
 
@@ -52,6 +55,9 @@ function register_rest_routes(): void {
 		[
 			'methods'  => \WP_REST_Server::READABLE,
 			'callback' => __NAMESPACE__ . '\\storage_wipe',
+			'permission_callback' => function () {
+				return \current_user_can( 'manage_options' );
+			},
 		]
 	);
 }
@@ -72,6 +78,27 @@ function metrics_permissions(): bool {
 		return true;
 	}
 
+	if ( 'api-key' === $settings['authType'] ) {
+		$expected_header = strtolower( $settings['headerKey'] ?? '' );
+		if ( $expected_header ) {
+			$headers = \getallheaders();
+
+			$secret = null;
+			foreach ( $headers as $key => $value ) {
+				if ( strtolower( $key ) === $expected_header ) {
+					$secret = $value;
+					break;
+				}
+			}
+
+			if ( $secret ) {
+				return ( $settings['headerValue'] ?? null ) === $secret;
+			}
+		}
+
+		return false;
+	}
+
 	$auth_header = wp_get_auth_headers();
 	if (!empty($auth_header['Authorization'])) {
 		if (\preg_match('/Bearer\s(\S+)/', $auth_header['Authorization'], $matches)) {

inc/settings.php

@@ -36,9 +36,18 @@ function register_settings() {
 						'authentication'   => [
 							'type' => 'boolean',
 						],
+						'authType' => [
+							'type' => 'string',
+						],
 						'token'  => [
 							'type' => 'string',
 						],
+						'headerKey' => [
+							'type' => 'string',
+						],
+						'headerValue' => [
+							'type' => 'string',
+						],
 						'features' => [
 							'type'       => 'object',
 							'properties' => [
@@ -75,6 +84,31 @@ function get_settings(): array {
 	return $settings;
 }
 
+/**
+ * Returns prometheus config template.
+ */
+function get_prometheus_config_template(): string {
+	$url   = rtrim( get_home_url(), '/' ) . '/wp-json/prompress/v1/metrics';
+	$parts = wp_parse_url( $url );
+
+	$template = <<< EOC
+scrape_configs:
+  - job_name: 'live-your-site'
+    scheme: %scheme%
+%auth%
+    metric_path: '%uri%'  
+    static_configs:
+      - targets: ['%domain%']
+
+EOC;
+
+	return str_replace(
+		[ '%scheme%', '%uri%', '%domain%' ],
+		[ $parts['scheme'], $parts['path'], $parts['host'] ],
+		$template
+	);
+}
+
 /**
  * Update settings.
  */
@@ -112,7 +146,10 @@ function default_settings(): array {
 		'active'         => true,
 		'storage'        => 'apc',
 		'authentication' => false,
+		'authType'       => 'bearer',
 		'token'          => '',
+		'headerKey'      => 'x-prompress-auth',
+		'headerValue'    => '',
 		'features' => [
 			'emails'          => true,
 			'errors'          => true,