diff --git a/api/main.py b/api/main.py
index 1890c37..eba821d 100644
--- a/api/main.py
+++ b/api/main.py
@@ -19,9 +19,11 @@ def get_api_key(api_key_header: str = Security(api_key_header)):
         # If no key is configured, deny all requests for safety
         raise HTTPException(status_code=500, detail="API_KEY not configured on server")
 
-    if hmac.compare_digest(api_key_header or "", expected_api_key):
-        return api_key_header
-    raise HTTPException(status_code=401, detail="Invalid or missing API Key")
+    if api_key_header is None:
+        raise HTTPException(status_code=401, detail="Missing API Key")
+    if not hmac.compare_digest(api_key_header, expected_api_key):
+        raise HTTPException(status_code=401, detail="Invalid API Key")
+    return api_key_header
 
 
 graphql_app = GraphQLRouter(schema)