diff --git a/apps/web/lib/api-auth.ts b/apps/web/lib/api-auth.ts
index 9e0cccb..b0d8319 100644
--- a/apps/web/lib/api-auth.ts
+++ b/apps/web/lib/api-auth.ts
@@ -67,7 +67,8 @@ export async function requireSessionOrApiKey(
         void db
           .update(apiKeys)
           .set({ lastUsedAt: new Date() })
-          .where(eq(apiKeys.id, keyRow.id));
+          .where(eq(apiKeys.id, keyRow.id))
+          .catch((err) => console.error("[api-auth] failed to update apiKeys.lastUsedAt", err));
 
         const [user] = await db
           .select({
diff --git a/apps/web/proxy.ts b/apps/web/proxy.ts
index 761d6ef..1822d13 100644
--- a/apps/web/proxy.ts
+++ b/apps/web/proxy.ts
@@ -13,9 +13,16 @@ export async function proxy(request: NextRequest) {
 
   if (isPublic) return NextResponse.next();
 
+  // API-key clients authenticate via `Authorization: Bearer ek_...`, not a
+  // session cookie — they'd otherwise be rejected here before ever reaching
+  // requireSessionOrApiKey (lib/api-auth.ts), which is the only place that
+  // actually verifies the key. Defer to it instead of requiring a cookie.
+  const authHeader = request.headers.get("authorization");
+  const hasApiKeyHeader = isApi && authHeader?.startsWith("Bearer ek_");
+
   const sessionCookie = getSessionCookie(request);
 
-  if (!sessionCookie) {
+  if (!sessionCookie && !hasApiKeyHeader) {
     if (isApi) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }