diff --git a/crates/tabby/src/routes/chat.rs b/crates/tabby/src/routes/chat.rs
index 1b54333..cab8a58 100644
--- a/crates/tabby/src/routes/chat.rs
+++ b/crates/tabby/src/routes/chat.rs
@@ -20,6 +20,9 @@ use crate::services::chat::{ChatCompletionRequest, ChatService};
     responses(
         (status = 200, description = "Success", body = ChatCompletionChunk, content_type = "application/jsonstream"),
         (status = 405, description = "When chat model is not specified, the endpoint will returns 405 Method Not Allowed"),
+    ),
+    security(
+        ("token" = [])
     )
 )]
 #[instrument(skip(state, request))]
diff --git a/crates/tabby/src/routes/completions.rs b/crates/tabby/src/routes/completions.rs
index d394d18..72a1922 100644
--- a/crates/tabby/src/routes/completions.rs
+++ b/crates/tabby/src/routes/completions.rs
@@ -15,6 +15,9 @@ use crate::services::completion::{CompletionRequest, CompletionResponse, Complet
     responses(
         (status = 200, description = "Success", body = CompletionResponse, content_type = "application/json"),
         (status = 400, description = "Bad Request")
+    ),
+    security(
+        ("token" = [])
     )
 )]
 #[instrument(skip(state, request))]
diff --git a/crates/tabby/src/routes/events.rs b/crates/tabby/src/routes/events.rs
index c8f747d..f8b7c74 100644
--- a/crates/tabby/src/routes/events.rs
+++ b/crates/tabby/src/routes/events.rs
@@ -16,6 +16,9 @@ use tabby_common::api::event::{Event, EventLogger, LogEventRequest, SelectKind};
     responses(
         (status = 200, description = "Success"),
         (status = 400, description = "Bad Request")
+    ),
+    security(
+        ("token" = [])
     )
 )]
 pub async fn log_event(
diff --git a/crates/tabby/src/routes/health.rs b/crates/tabby/src/routes/health.rs
index 9483ac2..0557637 100644
--- a/crates/tabby/src/routes/health.rs
+++ b/crates/tabby/src/routes/health.rs
@@ -10,6 +10,9 @@ use crate::services::health;
     tag = "v1",
     responses(
         (status = 200, description = "Success", body = HealthState, content_type = "application/json"),
+    ),
+    security(
+        ("token" = [])
     )
 )]
 pub async fn health(State(state): State<Arc<health::HealthState>>) -> Json<health::HealthState> {
diff --git a/crates/tabby/src/routes/search.rs b/crates/tabby/src/routes/search.rs
index 99edade..a7ff29a 100644
--- a/crates/tabby/src/routes/search.rs
+++ b/crates/tabby/src/routes/search.rs
@@ -32,8 +32,11 @@ pub struct SearchQuery {
     responses(
         (status = 200, description = "Success" , body = SearchResponse, content_type = "application/json"),
         (status = 501, description = "When code search is not enabled, the endpoint will returns 501 Not Implemented"),
-        )
-    )]
+    ),
+    security(
+        ("token" = [])
+    )
+)]
 #[instrument(skip(state, query))]
 pub async fn search(
     State(state): State<Arc<dyn CodeSearch>>,
diff --git a/crates/tabby/src/serve.rs b/crates/tabby/src/serve.rs
index fa54cb4..5713f3a 100644
--- a/crates/tabby/src/serve.rs
+++ b/crates/tabby/src/serve.rs
@@ -12,7 +12,10 @@ use tabby_common::{
 use tokio::time::sleep;
 use tower_http::timeout::TimeoutLayer;
 use tracing::info;
-use utoipa::OpenApi;
+use utoipa::{
+    openapi::security::{HttpAuthScheme, HttpBuilder, SecurityScheme},
+    Modify, OpenApi,
+};
 use utoipa_swagger_ui::SwaggerUi;
 
 use crate::{
@@ -63,7 +66,8 @@ Install following IDE / Editor extensions to get started with [Tabby](https://gi
         api::code::SearchResponse,
         api::code::Hit,
         api::code::HitDocument
-    ))
+    )),
+    modifiers(&SecurityAddon),
 )]
 struct ApiDoc;
 
@@ -245,3 +249,21 @@ fn start_heartbeat(args: &ServeArgs) {
         }
     });
 }
+
+struct SecurityAddon;
+
+impl Modify for SecurityAddon {
+    fn modify(&self, openapi: &mut utoipa::openapi::OpenApi) {
+        if let Some(components) = &mut openapi.components {
+            components.add_security_scheme(
+                "token",
+                SecurityScheme::Http(
+                    HttpBuilder::new()
+                        .scheme(HttpAuthScheme::Bearer)
+                        .bearer_format("token")
+                        .build(),
+                ),
+            )
+        }
+    }
+}