diff --git a/network-poc/hub/src/main.rs b/network-poc/hub/src/main.rs
index 92783de..6f44b1b 100644
--- a/network-poc/hub/src/main.rs
+++ b/network-poc/hub/src/main.rs
@@ -691,6 +691,18 @@ async fn handle_socket(socket: WebSocket, state: Arc<AppState>, ip: IpAddr) {
                 let allocated = json.get("allocated_gb").and_then(|v| v.as_u64()).unwrap_or(4) as u32;
                 let node_type = json.get("node_type").and_then(|v| v.as_str()).unwrap_or("browser");
 
+                // API-avain vaaditaan natiivisolmuilta (ei selaimilta)
+                if node_type == "native" {
+                    let required_key = std::env::var("NODE_API_KEY").unwrap_or_default();
+                    if !required_key.is_empty() {
+                        let provided_key = json.get("api_key").and_then(|v| v.as_str()).unwrap_or("");
+                        if provided_key != required_key {
+                            tracing::warn!("Solmu {} ({}) hylätty: virheellinen API-avain", node_id, ip);
+                            break; // Suljetaan WebSocket
+                        }
+                    }
+                }
+
                 {
                     let mut map = state.nodes_vram.lock().unwrap();
                     map.insert(node_id, allocated);