diff --git a/src/lib/bot-auth.ts b/src/lib/bot-auth.ts
new file mode 100644
index 0000000..8865cf2
--- /dev/null
+++ b/src/lib/bot-auth.ts
@@ -0,0 +1,12 @@
+// Shared-secret auth for the /api/bot/* routes — the inventory-capture
+// Telegram bot (a separate Python service, not a browser) calls these, so
+// it can't go through the Auth.js session/cookie flow the rest of the app
+// uses (src/auth.ts). Deliberately a SEPARATE secret from AUTH_SECRET
+// (session JWT signing key) and from the review-page User account's
+// password — a machine credential, not a human one, so it can be rotated
+// independently without touching either.
+export function requireBotAuth(request: Request): boolean {
+  const header = request.headers.get("authorization") ?? "";
+  const expected = `Bearer ${process.env.BOT_INGEST_SECRET}`;
+  return Boolean(process.env.BOT_INGEST_SECRET) && header === expected;
+}