diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..532ac7a
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,72 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  hub:
+    name: hub (ruff + pytest)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Install the fake engine venv
+        # Its only dependency is the local SDK, so the hub's integration test
+        # can spawn a real worker instead of skipping itself.
+        run: uv sync --python 3.12
+        working-directory: engines/fake
+      - name: Install the hub venv
+        run: uv sync --python 3.12 --group dev
+        working-directory: hub
+      - name: Lint
+        run: uv run ruff check ../hub ../sdk ../engines ../scripts --exclude ../engines/gpt_sovits/vendor
+        working-directory: hub
+      - name: Test
+        # Includes the docs/api drift guard (tests/test_openapi_export.py).
+        run: uv run pytest -q
+        working-directory: hub
+
+  webui:
+    name: webui (node)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - run: npm run test:web
+        working-directory: hub
+
+  e2e:
+    name: e2e (playwright)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Install the fake engine venv
+        run: uv sync --python 3.12
+        working-directory: engines/fake
+      - name: Install the hub venv
+        run: uv sync --python 3.12
+        working-directory: hub
+      - run: npm ci
+        working-directory: hub
+      - run: npx playwright install --with-deps chromium
+        working-directory: hub
+      - run: npm run test:e2e
+        working-directory: hub
+      - uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: playwright-report
+          path: hub/playwright-report/
+          retention-days: 7
diff --git a/.gitignore b/.gitignore
index 4b95f20..3613e91 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,6 @@ engines/*/vendor/
 engines/indextts/model/
 .playwright-mcp/
 .impeccable/
+node_modules/
+hub/test-results/
+hub/playwright-report/
diff --git a/README.md b/README.md
index fc384c6..4743d04 100644
--- a/README.md
+++ b/README.md
@@ -100,7 +100,23 @@ instructions are in the file's header comment.
 The default `config.toml` binds `0.0.0.0`, so other devices on your LAN
 (e.g. your iPhone) can open `http://<mac-hostname>:5050` — the WebUI is
 responsive and installable as a PWA. Bind `127.0.0.1` instead if you want it
-local-only; there is no authentication.
+local-only.
+
+**Securing the hub.** Access control is off by default. Anyone who can reach
+the port can generate audio and change settings, so if the hub is exposed
+beyond a trusted LAN, set a token:
+
+```toml
+[hub]
+auth_token = "a-long-random-string"   # generate: openssl rand -hex 24
+```
+
+Every `/api/*` call then needs `Authorization: Bearer <token>`, and the WebUI
+asks for it once per browser. Streams that cannot send a header (the SSE feed,
+`<audio>` playback, download links) accept `?token=` instead — which puts the
+token in the hub's access log, on the same machine that already stores it in
+plaintext. The token is editable only in `config.toml`, never through the API
+it protects; the WebUI is never shown its value.
 
 ## Using it
 
@@ -161,10 +177,14 @@ schema as the `/capabilities` response example. Regenerate after changing
 an adapter:
 
 ```bash
-cd engines/<id> && uv run --no-sync python -m tts_hub_sdk.export_openapi \
-  "$(grep '^module' engine.toml | cut -d'"' -f2)" > ../../docs/api/<id>.openapi.json
+uv run --project hub python scripts/export_openapi.py           # rewrite every engine's doc
+uv run --project hub python scripts/export_openapi.py --check   # what CI enforces
 ```
 
+Adapters import their model libraries lazily, so this needs no engine venv.
+A single worker can still be exported by hand from its own directory with
+`uv run --no-sync python -m tts_hub_sdk.export_openapi adapter:MyEngine`.
+
 Engines with legacy clients also mount dialect routes — MOSS-TTS-Nano keeps
 the upstream multipart `POST /api/generate` (base64 JSON response), included
 in its OpenAPI doc.
diff --git a/README_CN.md b/README_CN.md
index af433e7..5f5ced0 100644
--- a/README_CN.md
+++ b/README_CN.md
@@ -93,7 +93,21 @@ Hugging Face 下载。每个引擎首次需要几分钟,仅此一次。
 
 默认 `config.toml` 绑定 `0.0.0.0`,局域网内其他设备(比如你的 iPhone)
 可直接打开 `http://<mac主机名>:5050`——WebUI 自适应且可作为 PWA 安装。
-只想本机访问就改绑 `127.0.0.1`;本项目没有鉴权。
+只想本机访问就改绑 `127.0.0.1`。
+
+**访问控制**默认关闭:能连到这个端口的人都能生成音频、改配置。如果 hub 会
+暴露到不完全可信的网络,设一个令牌:
+
+```toml
+[hub]
+auth_token = "一串足够长的随机字符"   # 生成:openssl rand -hex 24
+```
+
+此后所有 `/api/*` 都需要 `Authorization: Bearer <令牌>`,WebUI 会在每个
+浏览器上要求输入一次。发不了请求头的通道(SSE、`<audio>` 播放、下载链接)
+改用 `?token=`——代价是令牌会进 hub 的访问日志,而该日志与明文令牌本来就在
+同一台机器上。令牌只能在 `config.toml` 里改,不能通过它所保护的 API 修改,
+WebUI 也永远看不到它的值。
 
 ## 使用
 
@@ -151,10 +165,13 @@ curl -X POST localhost:5077/clone \
 的真实参数表。改了适配器后重新生成:
 
 ```bash
-cd engines/<id> && uv run --no-sync python -m tts_hub_sdk.export_openapi \
-  "$(grep '^module' engine.toml | cut -d'"' -f2)" > ../../docs/api/<id>.openapi.json
+uv run --project hub python scripts/export_openapi.py           # 重新生成全部引擎文档
+uv run --project hub python scripts/export_openapi.py --check   # CI 执行的漂移检查
 ```
 
+适配器都是懒加载模型库,所以这条命令不需要任何引擎 venv。也可以在单个引擎
+目录里手动导出:`uv run --no-sync python -m tts_hub_sdk.export_openapi adapter:MyEngine`。
+
 有历史客户端的引擎还挂了方言路由——MOSS-TTS-Nano 保留上游的 multipart
 `POST /api/generate`(base64 JSON 响应),也包含在它的 OpenAPI 文档里。
 
diff --git a/hub/e2e/auth.spec.mjs b/hub/e2e/auth.spec.mjs
new file mode 100644
index 0000000..7483e78
--- /dev/null
+++ b/hub/e2e/auth.spec.mjs
@@ -0,0 +1,88 @@
+import { expect, test } from "@playwright/test";
+
+import { startHub } from "./hub-fixture.mjs";
+
+const TOKEN = "e2e-secret-token";
+
+test.describe("a hub with no access token", () => {
+  let hub;
+  test.beforeAll(async () => { hub = await startHub(); });
+  test.afterAll(async () => { await hub.stop(); });
+
+  test("loads straight into the WebUI", async ({ page }) => {
+    const problems = [];
+    page.on("console", msg => { if (msg.type() === "error") problems.push(msg.text()); });
+    page.on("pageerror", err => problems.push(String(err)));
+
+    await page.goto(hub.baseURL);
+    await expect(page.getByRole("heading", { name: "Engines" })).toBeVisible();
+    await expect(page.getByRole("dialog")).toHaveCount(0);
+    // The engine list arrives over SSE, proving the stream connected.
+    await expect(page.getByText("Fake (test tones)")).toBeVisible();
+
+    // Every page shares the module graph, so visiting them all catches a
+    // broken import or a missing translation key.
+    for (const tab of ["Studio", "Voices", "History", "Settings"]) {
+      await page.getByRole("button", { name: tab }).first().click();
+      await expect(page.getByRole("heading", { name: tab })).toBeVisible();
+    }
+    expect(problems).toEqual([]);
+  });
+});
+
+test.describe("a hub guarded by an access token", () => {
+  let hub;
+  test.beforeAll(async () => { hub = await startHub({ hub: { auth_token: TOKEN } }); });
+  test.afterAll(async () => { await hub.stop(); });
+
+  test("serves the shell but gates the API until the token is entered", async ({ page }) => {
+    await page.goto(hub.baseURL);
+    const gate = page.getByRole("dialog");
+    await expect(gate).toBeVisible();
+    await expect(gate.getByText("Access token required")).toBeVisible();
+    // Nothing from the API rendered behind the gate.
+    await expect(page.getByText("Fake (test tones)")).toHaveCount(0);
+
+    await page.getByPlaceholder("Access token").fill(TOKEN);
+    await page.getByRole("button", { name: "Unlock" }).click();
+
+    await expect(gate).toHaveCount(0);
+    await expect(page.getByText("Fake (test tones)")).toBeVisible();
+  });
+
+  test("keeps the token across reloads", async ({ page }) => {
+    await page.goto(hub.baseURL);
+    await page.getByPlaceholder("Access token").fill(TOKEN);
+    await page.getByRole("button", { name: "Unlock" }).click();
+    await expect(page.getByText("Fake (test tones)")).toBeVisible();
+
+    await page.reload();
+    await expect(page.getByRole("dialog")).toHaveCount(0);
+    await expect(page.getByText("Fake (test tones)")).toBeVisible();
+  });
+
+  test("re-prompts when the stored token is wrong", async ({ page }) => {
+    await page.goto(hub.baseURL);
+    await page.evaluate(() => localStorage.setItem("aviary-token", "stale"));
+    await page.reload();
+
+    await expect(page.getByRole("dialog")).toBeVisible();
+    await page.getByPlaceholder("Access token").fill(TOKEN);
+    await page.getByRole("button", { name: "Unlock" }).click();
+    await expect(page.getByText("Fake (test tones)")).toBeVisible();
+  });
+
+  test("authorises audio and log streams that cannot send a header", async ({ page }) => {
+    await page.goto(hub.baseURL);
+    await page.getByPlaceholder("Access token").fill(TOKEN);
+    await page.getByRole("button", { name: "Unlock" }).click();
+    await expect(page.getByText("Fake (test tones)")).toBeVisible();
+
+    const status = await page.evaluate(async () => {
+      const url = new URL("/api/engines", location.origin);
+      url.searchParams.set("token", localStorage.getItem("aviary-token"));
+      return (await fetch(url)).status;
+    });
+    expect(status).toBe(200);
+  });
+});
diff --git a/hub/e2e/history.spec.mjs b/hub/e2e/history.spec.mjs
new file mode 100644
index 0000000..4d39da3
--- /dev/null
+++ b/hub/e2e/history.spec.mjs
@@ -0,0 +1,49 @@
+import { expect, test } from "@playwright/test";
+
+import { startHub } from "./hub-fixture.mjs";
+
+const SEEDED = 230;   // more than two pages, so paging has to repeat
+
+let hub;
+test.beforeAll(async () => { hub = await startHub({ history: SEEDED }); });
+test.afterAll(async () => { await hub.stop(); });
+
+test.beforeEach(async ({ page }) => {
+  await page.goto(hub.baseURL + "#history");
+  await expect(page.getByRole("heading", { name: "History" })).toBeVisible();
+});
+
+const rows = (page) => page.locator(".card").filter({ hasText: "Seeded line" });
+
+test("shows the first page and offers the rest", async ({ page }) => {
+  await expect(rows(page)).toHaveCount(100);
+  await expect(page.getByRole("button", { name: "Load 130 more" })).toBeVisible();
+  // Newest first: the last seeded row is on top, the oldest is not loaded yet.
+  await expect(page.getByText(`"Seeded line ${SEEDED - 1}"`)).toBeVisible();
+  await expect(page.getByText('"Seeded line 0"')).toHaveCount(0);
+});
+
+test("load more walks to the oldest row without duplicating any", async ({ page }) => {
+  await page.getByRole("button", { name: "Load 130 more" }).click();
+  await expect(rows(page)).toHaveCount(200);
+  await expect(page.getByRole("button", { name: "Load 30 more" })).toBeVisible();
+
+  await page.getByRole("button", { name: "Load 30 more" }).click();
+  await expect(rows(page)).toHaveCount(SEEDED);
+  await expect(page.getByRole("button", { name: /Load \d+ more/ })).toHaveCount(0);
+  await expect(page.getByText('"Seeded line 0"')).toBeVisible();
+
+  const ids = await page.locator(".card [download]").evaluateAll(
+    links => links.map(a => a.getAttribute("download")));
+  expect(new Set(ids).size).toBe(SEEDED);
+});
+
+test("deleting a loaded row updates the remaining count", async ({ page }) => {
+  await expect(page.getByRole("button", { name: "Load 130 more" })).toBeVisible();
+  await rows(page).first().getByTitle("Delete").click();
+  await page.getByRole("dialog").getByRole("button", { name: "Delete" }).click();
+
+  await expect(rows(page)).toHaveCount(99);
+  await expect(page.getByRole("button", { name: "Load 130 more" })).toBeVisible();
+  await expect(page.getByText(`"Seeded line ${SEEDED - 1}"`)).toHaveCount(0);
+});
diff --git a/hub/e2e/hub-fixture.mjs b/hub/e2e/hub-fixture.mjs
new file mode 100644
index 0000000..d4a0577
--- /dev/null
+++ b/hub/e2e/hub-fixture.mjs
@@ -0,0 +1,99 @@
+// Boots a real hub against a throwaway TTS_HUB_ROOT so browser tests exercise
+// the actual FastAPI app, SSE stream and static WebUI — not a mock.
+import { spawn, spawnSync } from "node:child_process";
+import { createServer } from "node:net";
+import { mkdtempSync, mkdirSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HUB_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const REPO = resolve(HUB_DIR, "..");
+
+/** A hub root containing only the engines a test actually needs. */
+export function makeRoot({ hub = {}, engines = ["fake"] } = {}) {
+  const root = mkdtempSync(join(tmpdir(), "aviary-e2e-"));
+  mkdirSync(join(root, "engines"));
+  for (const id of engines) {
+    symlinkSync(join(REPO, "engines", id), join(root, "engines", id));
+  }
+  const lines = ["[hub]", 'host = "127.0.0.1"', 'data_dir = "data"'];
+  for (const [key, value] of Object.entries(hub)) {
+    lines.push(`${key} = ${typeof value === "string" ? `"${value}"` : value}`);
+  }
+  writeFileSync(join(root, "config.toml"), lines.join("\n") + "\n");
+  return root;
+}
+
+async function waitForHub(baseURL, proc, log) {
+  const deadline = Date.now() + 30_000;
+  while (Date.now() < deadline) {
+    if (proc.exitCode !== null) {
+      throw new Error(`hub exited early (${proc.exitCode}):\n${log.join("")}`);
+    }
+    try {
+      // 401 also proves it is listening — a guarded hub answers nothing else.
+      const res = await fetch(baseURL + "/api/engines");
+      if (res.status === 200 || res.status === 401) return;
+    } catch { /* not up yet */ }
+    await new Promise(r => setTimeout(r, 150));
+  }
+  throw new Error(`hub did not start:\n${log.join("")}`);
+}
+
+function freePort() {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    server.on("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const { port } = server.address();
+      server.close(() => resolve(port));
+    });
+  });
+}
+
+/** Write `count` history rows straight into the hub database. */
+export function seedHistory(root, count) {
+  const data = join(root, "data");
+  mkdirSync(join(data, "audio"), { recursive: true });
+  const script = `
+import datetime, sqlite3, sys
+from tts_hub.db import DB
+db = DB(sys.argv[1])
+base = datetime.datetime(2026, 1, 1, tzinfo=datetime.UTC)
+for i in range(${count}):
+    db.execute("INSERT INTO history (id, created_at, engine, text, path,"
+               " duration, format) VALUES (?,?,?,?,?,?,?)",
+               (f"seed{i:04d}", (base + datetime.timedelta(minutes=i)).isoformat(),
+                "fake", f"Seeded line {i}", sys.argv[2] + f"/seed{i:04d}.wav", 1.0, "wav"))
+`;
+  const result = spawnSync(join(HUB_DIR, ".venv", "bin", "python"),
+                           ["-c", script, join(data, "hub.db"), join(data, "audio")],
+                           { cwd: HUB_DIR, encoding: "utf8" });
+  if (result.status !== 0) throw new Error(`seeding failed: ${result.stderr}`);
+}
+
+/** Start a hub on a free port; returns { baseURL, root, stop() }. */
+export async function startHub(options = {}) {
+  const port = await freePort();
+  const root = makeRoot({ ...options, hub: { ...options.hub, port } });
+  if (options.history) seedHistory(root, options.history);
+  const log = [];
+  const proc = spawn(
+    join(HUB_DIR, ".venv", "bin", "python"),
+    ["-c", "from tts_hub.main import main; main()"],
+    { cwd: HUB_DIR, env: { ...process.env, TTS_HUB_ROOT: root, PYTHONUNBUFFERED: "1" } },
+  );
+  proc.stdout.on("data", d => log.push(String(d)));
+  proc.stderr.on("data", d => log.push(String(d)));
+
+  const baseURL = `http://127.0.0.1:${port}`;
+  await waitForHub(baseURL, proc, log);
+  return {
+    baseURL, root, log,
+    async stop() {
+      proc.kill("SIGTERM");
+      await new Promise(r => proc.once("exit", r));
+    },
+  };
+}
diff --git a/hub/package-lock.json b/hub/package-lock.json
new file mode 100644
index 0000000..402c042
--- /dev/null
+++ b/hub/package-lock.json
@@ -0,0 +1,75 @@
+{
+  "name": "hub",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "devDependencies": {
+        "@playwright/test": "^1.62.1"
+      }
+    },
+    "node_modules/@playwright/test": {
+      "version": "1.62.1",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.62.1.tgz",
+      "integrity": "sha512-DTcUc8qii+cpHvtOwggMtBRMjKZHXYWdw8syRYu2vtzuq4Wxphqq4NfCs5Zt44L6mA8rfDfj+PHnxFc/FeK6mQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.62.1"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/playwright": {
+      "version": "1.62.1",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.62.1.tgz",
+      "integrity": "sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.62.1"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.62.1",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.62.1.tgz",
+      "integrity": "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    }
+  }
+}
diff --git a/hub/package.json b/hub/package.json
index 8ba27af..a6a2fed 100644
--- a/hub/package.json
+++ b/hub/package.json
@@ -2,6 +2,10 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "test:web": "node --test web-tests/*.test.mjs"
+    "test:web": "node --test web-tests/*.test.mjs",
+    "test:e2e": "playwright test"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.62.1"
   }
 }
diff --git a/hub/playwright.config.mjs b/hub/playwright.config.mjs
new file mode 100644
index 0000000..9659f64
--- /dev/null
+++ b/hub/playwright.config.mjs
@@ -0,0 +1,20 @@
+import { defineConfig, devices } from "@playwright/test";
+
+// Each spec boots its own hub on a free port (see e2e/hub-fixture.mjs), so
+// there is no shared webServer and no baseURL here.
+export default defineConfig({
+  testDir: "./e2e",
+  fullyParallel: false,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 1 : 0,
+  workers: 1,
+  reporter: process.env.CI ? "line" : "list",
+  timeout: 60_000,
+  use: {
+    trace: "retain-on-failure",
+    screenshot: "only-on-failure",
+  },
+  projects: [
+    { name: "chromium", use: { ...devices["Desktop Chrome"] } },
+  ],
+});
diff --git a/hub/tests/test_auth.py b/hub/tests/test_auth.py
new file mode 100644
index 0000000..3c6ea13
--- /dev/null
+++ b/hub/tests/test_auth.py
@@ -0,0 +1,106 @@
+"""Opt-in access token: off by default, enforced on /api/* when configured."""
+from __future__ import annotations
+
+import tomllib
+from pathlib import Path
+
+import pytest
+from fastapi.testclient import TestClient
+
+from tts_hub import config as config_module
+from tts_hub.config import load_config, save_config
+from tts_hub.main import create_app
+
+TOKEN = "s3cret-token"
+
+
+def _client(tmp_path: Path, monkeypatch, config_text: str) -> TestClient:
+    monkeypatch.setattr(config_module, "ROOT", tmp_path)
+    monkeypatch.setattr(config_module, "CONFIG_PATH", tmp_path / "config.toml")
+    monkeypatch.setattr(config_module, "ENGINES_DIR", tmp_path / "engines")
+    (tmp_path / "config.toml").write_text(config_text)
+    return TestClient(create_app())
+
+
+@pytest.fixture
+def open_hub(tmp_path: Path, monkeypatch):
+    with _client(tmp_path, monkeypatch, "[hub]\ndata_dir = 'data'\n") as client:
+        yield client
+
+
+@pytest.fixture
+def guarded_hub(tmp_path: Path, monkeypatch):
+    with _client(tmp_path, monkeypatch,
+                 f"[hub]\ndata_dir = 'data'\nauth_token = '{TOKEN}'\n") as client:
+        yield client
+
+
+def test_without_a_token_the_api_stays_open(open_hub):
+    assert open_hub.get("/api/engines").status_code == 200
+    assert open_hub.get("/api/config").json()["auth_required"] is False
+
+
+def test_guarded_api_rejects_missing_and_wrong_credentials(guarded_hub):
+    assert guarded_hub.get("/api/engines").status_code == 401
+    assert guarded_hub.get("/api/engines", headers={
+        "Authorization": "Bearer wrong"}).status_code == 401
+    assert guarded_hub.get("/api/engines?token=wrong").status_code == 401
+    assert guarded_hub.get("/api/engines").text == "unauthorized"
+
+
+def test_guarded_api_accepts_the_header_and_the_query_fallback(guarded_hub):
+    # EventSource and <audio src> can only pass the query parameter.
+    assert guarded_hub.get("/api/engines", headers={
+        "Authorization": f"Bearer {TOKEN}"}).status_code == 200
+    assert guarded_hub.get("/api/engines", headers={
+        "authorization": f"bearer {TOKEN}"}).status_code == 200
+    assert guarded_hub.get(f"/api/engines?token={TOKEN}").status_code == 200
+
+
+def test_the_webui_shell_loads_without_credentials(guarded_hub):
+    """The page that asks for the token must not itself need the token."""
+    assert guarded_hub.get("/").status_code == 200
+
+
+def test_only_the_api_prefix_is_gated(guarded_hub):
+    """A static file whose name merely starts with "api" is not an API call."""
+    served = guarded_hub.get("/apiary.html")
+    assert served.status_code != 401
+
+
+def test_config_never_echoes_the_token(guarded_hub):
+    body = guarded_hub.get("/api/config", headers={"Authorization": f"Bearer {TOKEN}"})
+    assert body.json()["auth_required"] is True
+    assert TOKEN not in body.text
+
+
+def test_token_cannot_be_rotated_through_the_api(guarded_hub):
+    response = guarded_hub.put("/api/config",
+                               headers={"Authorization": f"Bearer {TOKEN}"},
+                               json={"hub": {"auth_token": "new"}})
+    assert response.status_code == 422
+    assert guarded_hub.get(f"/api/engines?token={TOKEN}").status_code == 200
+
+
+def test_saving_settings_preserves_a_token_the_webui_never_sees(tmp_path: Path, monkeypatch):
+    monkeypatch.setattr(config_module, "ROOT", tmp_path)
+    monkeypatch.setattr(config_module, "CONFIG_PATH", tmp_path / "config.toml")
+    monkeypatch.setattr(config_module, "ENGINES_DIR", tmp_path / "engines")
+    (tmp_path / "config.toml").write_text(
+        f"[hub]\ndata_dir = 'data'\nport = 5050\nauth_token = '{TOKEN}'\n")
+
+    cfg = load_config()
+    cfg.port = 5051
+    save_config(cfg)
+
+    assert load_config().auth_token == TOKEN
+    assert f'auth_token = "{TOKEN}"' in (tmp_path / "config.toml").read_text()
+
+
+def test_an_unset_token_is_not_written_back(tmp_path: Path, monkeypatch):
+    monkeypatch.setattr(config_module, "ROOT", tmp_path)
+    monkeypatch.setattr(config_module, "CONFIG_PATH", tmp_path / "config.toml")
+    (tmp_path / "config.toml").write_text("[hub]\ndata_dir = 'data'\n")
+    save_config(load_config())
+    written = tomllib.loads((tmp_path / "config.toml").read_text())
+    assert "auth_token" not in written["hub"]
diff --git a/hub/tests/test_background_tasks.py b/hub/tests/test_background_tasks.py
new file mode 100644
index 0000000..ab30077
--- /dev/null
+++ b/hub/tests/test_background_tasks.py
@@ -0,0 +1,84 @@
+"""Detached background work must outlive garbage collection and report failures."""
+from __future__ import annotations
+
+import ast
+import asyncio
+import gc
+import logging
+from pathlib import Path
+
+from tts_hub.aio import pending, spawn
+
+
+def test_spawned_task_survives_gc_and_is_released_when_done():
+    async def scenario():
+        started = asyncio.Event()
+
+        async def work():
+            started.set()
+            await asyncio.sleep(0.05)
+            return "finished"
+
+        task = spawn(work(), name="unit")
+        assert task in pending()
+        del task            # the caller drops its reference immediately
+        await started.wait()
+        gc.collect()        # the loop alone would not keep it alive
+        assert len(pending()) == 1
+        survivor = next(iter(pending()))
+        assert await survivor == "finished"
+        await asyncio.sleep(0)
+        assert pending() == set()
+
+    asyncio.run(scenario())
+
+
+def test_spawned_failure_is_logged_instead_of_swallowed(caplog):
+    async def boom():
+        raise RuntimeError("worker exploded")
+
+    with caplog.at_level(logging.ERROR, logger="hub.aio"):
+        async def scenario():
+            task = spawn(boom(), name="explode")
+            await asyncio.gather(task, return_exceptions=True)
+            await asyncio.sleep(0)
+
+        asyncio.run(scenario())
+
+    assert "background task explode failed" in caplog.text
+    assert "worker exploded" in caplog.text
+    assert pending() == set()
+
+
+def test_cancelled_task_is_not_reported_as_a_failure(caplog):
+    with caplog.at_level(logging.ERROR, logger="hub.aio"):
+        async def scenario():
+            task = spawn(asyncio.sleep(5), name="cancelled")
+            task.cancel()
+            await asyncio.gather(task, return_exceptions=True)
+            await asyncio.sleep(0)
+
+        asyncio.run(scenario())
+
+    assert caplog.text == ""
+    assert pending() == set()
+
+
+def test_no_detached_create_task_calls_remain():
+    """Lifecycle work must go through spawn(), or it can vanish mid-flight.
+
+    A create_task whose result is stored (``self._tasks = [...]``) keeps its
+    own strong reference; only the discarded ones are the hazard.
+    """
+    package = Path(__file__).resolve().parents[1] / "tts_hub"
+    offenders = []
+    for source in sorted(package.glob("*.py")):
+        if source.name == "aio.py":
+            continue
+        tree = ast.parse(source.read_text())
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Expr) or not isinstance(node.value, ast.Call):
+                continue
+            if ast.unparse(node.value.func).endswith("asyncio.create_task"):
+                offenders.append(f"{source.name}:{node.lineno}")
+    assert offenders == [], f"use spawn() instead: {offenders}"
diff --git a/hub/tests/test_config_api.py b/hub/tests/test_config_api.py
new file mode 100644
index 0000000..bf56639
--- /dev/null
+++ b/hub/tests/test_config_api.py
@@ -0,0 +1,91 @@
+"""PUT /api/config rejects bad input instead of 500-ing or half-applying it."""
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+from fastapi.testclient import TestClient
+
+from tts_hub import config as config_module
+from tts_hub.main import create_app
+
+BASELINE = "[hub]\nhost = '0.0.0.0'\nport = 5050\ndata_dir = 'data'\n" \
+           "retention_days = 7\nmax_upload_mb = 100\n"
+
+
+@pytest.fixture
+def client(tmp_path: Path, monkeypatch):
+    monkeypatch.setattr(config_module, "ROOT", tmp_path)
+    monkeypatch.setattr(config_module, "CONFIG_PATH", tmp_path / "config.toml")
+    monkeypatch.setattr(config_module, "ENGINES_DIR", tmp_path / "engines")
+    (tmp_path / "config.toml").write_text(BASELINE)
+    with TestClient(create_app()) as test_client:
+        test_client.config_path = tmp_path / "config.toml"  # type: ignore[attr-defined]
+        yield test_client
+
+
+@pytest.mark.parametrize("payload, expected", [
+    ({"hub": {"port": "not-a-number"}}, "port must be a whole number"),
+    ({"hub": {"port": 0}}, "port must be between 1 and 65535"),
+    ({"hub": {"port": 70000}}, "port must be between 1 and 65535"),
+    ({"hub": {"retention_days": -1}}, "retention_days must be between 0 and 3650"),
+    ({"hub": {"max_upload_mb": 0}}, "max_upload_mb must be between 1 and 2048"),
+    ({"hub": {"port": 3.9}}, "port must be a whole number"),
+    ({"hub": {"port": True}}, "port must be a whole number"),
+    ({"hub": {"retention_days": None}}, "retention_days must be a whole number"),
+    ({"hub": {"max_upload_mb": [50]}}, "max_upload_mb must be a whole number"),
+    ({"hub": {"host": "   "}}, "host must not be empty"),
+    ({"hub": {"host": None}}, "host must be a string"),
+    ({"hub": {"data_dir": ""}}, "data_dir must not be empty"),
+    ({"hub": {"data_dir": 7}}, "data_dir must be a string"),
+    ({"hub": {}, "engines": "melotts"}, "engines must be an object"),
+    ({"hub": "0.0.0.0"}, "hub must be an object"),
+])
+def test_invalid_settings_are_rejected_without_touching_the_file(client, payload, expected):
+    before = client.config_path.read_text()
+    response = client.put("/api/config", json=payload)
+    assert response.status_code == 422
+    assert response.text == expected
+    assert client.config_path.read_text() == before
+
+
+def test_one_bad_field_does_not_apply_the_valid_fields_beside_it(client):
+    response = client.put("/api/config", json={
+        "hub": {"retention_days": 30, "max_upload_mb": 99999}})
+    assert response.status_code == 422
+    assert "retention_days = 7" in client.config_path.read_text()
+
+    config = client.get("/api/config").json()
+    assert config["hub"]["retention_days"] == 7
+
+
+def test_valid_settings_are_persisted_and_report_restart_fields(client):
+    response = client.put("/api/config", json={
+        "hub": {"port": 5051, "retention_days": 30, "max_upload_mb": 50,
+                "host": "127.0.0.1"},
+        "engines": {"melotts": {"idle_unload_min": 15}}})
+    assert response.status_code == 200
+    assert sorted(response.json()["restart_required_fields"]) == ["host", "port"]
+
+    saved = client.config_path.read_text()
+    assert "port = 5051" in saved
+    assert "retention_days = 30" in saved
+    assert 'host = "127.0.0.1"' in saved
+
+    config = client.get("/api/config").json()
+    assert config["hub"]["max_upload_mb"] == 50
+    assert config["engines"] == {"melotts": {"idle_unload_min": 15}}
+
+
+def test_boundary_values_are_accepted(client):
+    response = client.put("/api/config", json={
+        "hub": {"port": 65535, "retention_days": 0, "max_upload_mb": 1}})
+    assert response.status_code == 200
+    assert "retention_days = 0" in client.config_path.read_text()
+
+
+def test_numbers_sent_as_strings_still_apply(client):
+    """Hand-written clients (and older WebUI inputs) send digit strings."""
+    response = client.put("/api/config", json={"hub": {"retention_days": " 30 "}})
+    assert response.status_code == 200
+    assert "retention_days = 30" in client.config_path.read_text()
diff --git a/hub/tests/test_history_api.py b/hub/tests/test_history_api.py
new file mode 100644
index 0000000..3f8db48
--- /dev/null
+++ b/hub/tests/test_history_api.py
@@ -0,0 +1,77 @@
+"""GET /api/history pages through the whole table instead of capping at 100."""
+from __future__ import annotations
+
+import datetime
+from pathlib import Path
+
+import pytest
+from fastapi.testclient import TestClient
+
+from tts_hub import config as config_module
+from tts_hub.main import create_app
+
+
+@pytest.fixture
+def client(tmp_path: Path, monkeypatch):
+    monkeypatch.setattr(config_module, "ROOT", tmp_path)
+    monkeypatch.setattr(config_module, "CONFIG_PATH", tmp_path / "config.toml")
+    monkeypatch.setattr(config_module, "ENGINES_DIR", tmp_path / "engines")
+    (tmp_path / "config.toml").write_text("[hub]\ndata_dir = 'data'\n")
+    app = create_app()
+    base = datetime.datetime(2026, 1, 1, tzinfo=datetime.UTC)
+    for index in range(130):
+        app.state.db.execute(
+            "INSERT INTO history (id, created_at, engine, text, path)"
+            " VALUES (?,?,?,?,?)",
+            (f"item{index:03d}", (base + datetime.timedelta(minutes=index)).isoformat(),
+             "fake", f"line {index}", str(tmp_path / f"{index}.wav")))
+    with TestClient(app) as test_client:
+        yield test_client
+
+
+def test_first_page_reports_the_full_total(client):
+    page = client.get("/api/history?limit=100").json()
+    assert len(page["items"]) == 100
+    assert page["total"] == 130
+    assert page["offset"] == 0
+    assert page["items"][0]["id"] == "item129"   # newest first
+
+
+def test_the_remaining_rows_are_reachable_by_offset(client):
+    page = client.get("/api/history?limit=100&offset=100").json()
+    assert len(page["items"]) == 30
+    assert page["total"] == 130
+    assert page["items"][0]["id"] == "item029"
+    assert page["items"][-1]["id"] == "item000"
+
+
+def test_paging_covers_every_row_exactly_once(client):
+    seen = []
+    offset = 0
+    while True:
+        page = client.get(f"/api/history?limit=50&offset={offset}").json()
+        seen.extend(item["id"] for item in page["items"])
+        offset += len(page["items"])
+        if offset >= page["total"]:
+            break
+    assert len(seen) == len(set(seen)) == 130
+
+
+@pytest.mark.parametrize("query, expected_limit", [
+    ("limit=0", 1), ("limit=-5", 1), ("limit=9999", 200),
+])
+def test_limit_is_clamped_to_a_sane_range(client, query, expected_limit):
+    page = client.get(f"/api/history?{query}").json()
+    assert page["limit"] == expected_limit
+    assert len(page["items"]) == min(expected_limit, 130)
+
+
+def test_a_negative_offset_falls_back_to_the_first_page(client):
+    page = client.get("/api/history?offset=-10").json()
+    assert page["offset"] == 0
+    assert page["items"][0]["id"] == "item129"
+
+
+def test_deleting_a_row_lowers_the_total(client):
+    assert client.delete("/api/history/item129").status_code == 200
+    assert client.get("/api/history").json()["total"] == 129
diff --git a/hub/tests/test_openapi_export.py b/hub/tests/test_openapi_export.py
new file mode 100644
index 0000000..2cbe2d2
--- /dev/null
+++ b/hub/tests/test_openapi_export.py
@@ -0,0 +1,51 @@
+"""Guards for scripts/export_openapi.py, the source of docs/api/."""
+from __future__ import annotations
+
+import importlib.util
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def _load_exporter():
+    spec = importlib.util.spec_from_file_location(
+        "aviary_export_openapi", ROOT / "scripts" / "export_openapi.py")
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+exporter = _load_exporter()
+
+
+def test_every_engine_directory_is_exported():
+    exported = {d.name for d in exporter.engine_dirs()}
+    on_disk = {d.name for d in (ROOT / "engines").iterdir()
+               if d.is_dir() and (d / "engine.toml").exists()}
+    assert exported == on_disk
+
+
+def test_render_is_deterministic_and_describes_the_worker_contract():
+    fake = ROOT / "engines" / "fake"
+    first = exporter.serialize(exporter.render(fake))
+    second = exporter.serialize(exporter.render(fake))
+    assert first == second, "export must be byte-stable to be drift-checkable"
+
+    doc = json.loads(first)
+    assert set(doc["paths"]) >= {"/", "/capabilities", "/v1/audio/speech", "/clone"}
+
+
+@pytest.mark.parametrize("engine_id", sorted(
+    d.name for d in (ROOT / "engines").iterdir()
+    if d.is_dir() and (d / "engine.toml").exists()))
+def test_committed_docs_match_the_adapters(engine_id: str):
+    committed = ROOT / "docs" / "api" / f"{engine_id}.openapi.json"
+    assert committed.exists(), f"missing docs/api/{engine_id}.openapi.json"
+    fresh = exporter.serialize(exporter.render(ROOT / "engines" / engine_id))
+    assert committed.read_text() == fresh, (
+        "docs/api is stale — run: uv run --project hub python scripts/export_openapi.py")
diff --git a/hub/tests/test_sdk_ref_cache.py b/hub/tests/test_sdk_ref_cache.py
new file mode 100644
index 0000000..fa0ec48
--- /dev/null
+++ b/hub/tests/test_sdk_ref_cache.py
@@ -0,0 +1,63 @@
+"""The worker's reference-audio cache must not grow without bound."""
+from __future__ import annotations
+
+import os
+import sys
+import time
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(ROOT / "sdk"))
+
+from tts_hub_sdk.server import (  # noqa: E402  (needs the path above)
+    REF_CACHE_TTL_S, _cache_ref_audio, _prune_ref_cache,
+)
+
+
+def _age(path: Path, seconds: float) -> None:
+    stamp = time.time() - seconds
+    os.utime(path, (stamp, stamp))
+
+
+def test_pruning_drops_only_clips_past_the_ttl(tmp_path: Path):
+    fresh = tmp_path / "fresh.wav"
+    fresh.write_bytes(b"new")
+    stale = tmp_path / "stale.wav"
+    stale.write_bytes(b"old")
+    _age(stale, REF_CACHE_TTL_S + 60)
+
+    assert _prune_ref_cache(str(tmp_path)) == 1
+    assert fresh.exists()
+    assert not stale.exists()
+
+
+def test_reusing_a_cached_clip_keeps_it_alive(tmp_path: Path):
+    data = b"reference audio bytes"
+    path = Path(_cache_ref_audio(str(tmp_path), data, ".wav"))
+    _age(path, REF_CACHE_TTL_S + 60)
+
+    # A clone request for the same voice must renew it, not just read it.
+    assert _cache_ref_audio(str(tmp_path), data, ".wav") == str(path)
+    assert _prune_ref_cache(str(tmp_path)) == 0
+    assert path.exists()
+
+
+def test_identical_bytes_are_stored_once(tmp_path: Path):
+    data = b"same voice"
+    first = _cache_ref_audio(str(tmp_path), data, ".wav")
+    second = _cache_ref_audio(str(tmp_path), data, ".wav")
+    assert first == second
+    assert len(list(tmp_path.iterdir())) == 1
+    assert Path(first).read_bytes() == data
+
+
+def test_pruning_survives_a_missing_directory(tmp_path: Path):
+    assert _prune_ref_cache(str(tmp_path / "never-created")) == 0
+
+
+def test_pruning_ignores_subdirectories(tmp_path: Path):
+    nested = tmp_path / "nested"
+    nested.mkdir()
+    _age(nested, REF_CACHE_TTL_S + 60)
+    assert _prune_ref_cache(str(tmp_path)) == 0
+    assert nested.exists()
diff --git a/hub/tts_hub/aio.py b/hub/tts_hub/aio.py
new file mode 100644
index 0000000..c034632
--- /dev/null
+++ b/hub/tts_hub/aio.py
@@ -0,0 +1,37 @@
+"""Fire-and-forget task helper.
+
+The event loop keeps only a weak reference to a task, so a bare
+``asyncio.create_task`` for work nobody awaits can be garbage collected
+mid-flight. Everything here holds a strong reference until the task
+finishes, and surfaces failures that would otherwise be swallowed.
+"""
+from __future__ import annotations
+
+import asyncio
+import logging
+
+log = logging.getLogger("hub.aio")
+
+_BACKGROUND: set[asyncio.Task] = set()
+
+
+def spawn(coro, *, name: str | None = None) -> asyncio.Task:
+    """Run ``coro`` detached, keeping it alive and logging any failure."""
+    task = asyncio.create_task(coro, name=name)
+    _BACKGROUND.add(task)
+    task.add_done_callback(_finished)
+    return task
+
+
+def _finished(task: asyncio.Task) -> None:
+    _BACKGROUND.discard(task)
+    if task.cancelled():
+        return
+    exc = task.exception()
+    if exc is not None:
+        log.error("background task %s failed", task.get_name(), exc_info=exc)
+
+
+def pending() -> set[asyncio.Task]:
+    """Tasks still running (tests and diagnostics)."""
+    return set(_BACKGROUND)
diff --git a/hub/tts_hub/api.py b/hub/tts_hub/api.py
index c1dcc46..d511659 100644
--- a/hub/tts_hub/api.py
+++ b/hub/tts_hub/api.py
@@ -13,9 +13,29 @@
 from sse_starlette.sse import EventSourceResponse
 
 from . import config as C
+from .aio import spawn
 from .events import sse_dict
 
 
+def _whole_number(value) -> Optional[int]:
+    """A JSON value as an int, or None when it is not a whole number.
+
+    Bools and floats are refused rather than coerced: `true` is not 1 and
+    3.9 is not 3. Digit strings stay accepted because hand-written clients
+    send them and the WebUI's number inputs used to.
+    """
+    if isinstance(value, bool):
+        return None
+    if isinstance(value, int):
+        return value
+    if isinstance(value, str) and value.strip():
+        try:
+            return int(value.strip())
+        except ValueError:
+            return None
+    return None
+
+
 def build_router(app_state) -> APIRouter:
     r = APIRouter(prefix="/api")
     sup = app_state.supervisor
@@ -38,13 +58,13 @@ def _engine_or_404(engine_id: str):
     @r.post("/engines/{engine_id}/start")
     async def engine_start(engine_id: str):
         eng = _engine_or_404(engine_id)
-        asyncio.create_task(eng.start())
+        spawn(eng.start(), name=f"start:{engine_id}")
         return {"ok": True}
 
     @r.post("/engines/{engine_id}/stop")
     async def engine_stop(engine_id: str):
         eng = _engine_or_404(engine_id)
-        asyncio.create_task(eng.stop())
+        spawn(eng.stop(), name=f"stop:{engine_id}")
         return {"ok": True}
 
     @r.post("/engines/{engine_id}/restart")
@@ -54,7 +74,7 @@ async def engine_restart(engine_id: str):
         async def _restart():
             await eng.stop()
             await eng.start()
-        asyncio.create_task(_restart())
+        spawn(_restart(), name=f"restart:{engine_id}")
         return {"ok": True}
 
     @r.get("/engines/{engine_id}/logs")
@@ -290,12 +310,17 @@ async def voice_audio(voice_id: str):
     # ---- history ------------------------------------------------------------
     @r.get("/history")
     async def history_list(limit: int = 50, offset: int = 0):
-        return db.query(
+        """One page of history plus the total, so clients can page through it."""
+        limit = max(1, min(int(limit), 200))
+        offset = max(0, int(offset))
+        items = db.query(
             "SELECT id, created_at, engine, substr(text,1,120) AS text_preview,"
             " length(text) AS text_len, voice_mode, voice, voice_id, params,"
             " format, duration, rtf, sample_rate, size"
             " FROM history ORDER BY created_at DESC LIMIT ? OFFSET ?",
             (limit, offset))
+        total = db.one("SELECT COUNT(*) AS n FROM history")["n"]
+        return {"items": items, "total": total, "offset": offset, "limit": limit}
 
     @r.get("/history/{item_id}")
     async def history_get(item_id: str):
@@ -320,24 +345,55 @@ async def history_delete(item_id: str):
     # ---- config ------------------------------------------------------------
     @r.get("/config")
     async def config_get():
+        # auth_token itself is never echoed — only whether it is in force.
         return {"hub": {"host": cfg.host, "port": cfg.port,
                         "data_dir": cfg.data_dir,
                         "retention_days": cfg.retention_days,
                         "max_upload_mb": cfg.max_upload_mb},
+                "auth_required": bool(cfg.auth_token),
                 "engines": cfg.engines}
 
     @r.put("/config")
     async def config_put(request: Request):
         body = await request.json()
         hub = body.get("hub") or {}
+        if not isinstance(hub, dict):
+            return PlainTextResponse("hub must be an object", status_code=422)
+        # Validate everything before touching cfg: a half-applied config that
+        # then fails to save would leave the hub disagreeing with its own file.
+        parsed: dict = {}
         for k in ("host", "data_dir"):
-            if k in hub:
-                setattr(cfg, k, str(hub[k]))
-        for k in ("port", "retention_days", "max_upload_mb"):
-            if k in hub:
-                setattr(cfg, k, int(hub[k]))
-        if isinstance(body.get("engines"), dict):
-            cfg.engines = body["engines"]
+            if k not in hub:
+                continue
+            if not isinstance(hub[k], str):
+                return PlainTextResponse(f"{k} must be a string", status_code=422)
+            value = hub[k].strip()
+            if not value:
+                return PlainTextResponse(f"{k} must not be empty", status_code=422)
+            parsed[k] = value
+        for k, (low, high) in C.HUB_INT_BOUNDS.items():
+            if k not in hub:
+                continue
+            value = _whole_number(hub[k])
+            if value is None:
+                return PlainTextResponse(f"{k} must be a whole number", status_code=422)
+            if not low <= value <= high:
+                return PlainTextResponse(
+                    f"{k} must be between {low} and {high}", status_code=422)
+            parsed[k] = value
+        if "auth_token" in hub:
+            # Rotating the secret over the API it protects is a lockout waiting
+            # to happen, and the WebUI is never shown the current value.
+            return PlainTextResponse(
+                "auth_token can only be changed in config.toml", status_code=422)
+        engines_override = body.get("engines")
+        if engines_override is not None and not isinstance(engines_override, dict):
+            return PlainTextResponse("engines must be an object", status_code=422)
+
+        for k, value in parsed.items():
+            setattr(cfg, k, value)
+        if isinstance(engines_override, dict):
+            cfg.engines = engines_override
         C.save_config(cfg)
         sup.rescan(C.scan_manifests(cfg))
         restart_required = [k for k in ("host", "port", "data_dir") if k in hub]
diff --git a/hub/tts_hub/config.py b/hub/tts_hub/config.py
index 54228b4..8ed08ce 100644
--- a/hub/tts_hub/config.py
+++ b/hub/tts_hub/config.py
@@ -14,6 +14,14 @@
 ENGINES_DIR = ROOT / "engines"
 
 
+# Accepted ranges for the numeric hub settings the Settings page writes.
+HUB_INT_BOUNDS = {
+    "port": (1, 65535),
+    "retention_days": (0, 3650),
+    "max_upload_mb": (1, 2048),
+}
+
+
 @dataclasses.dataclass
 class HubConfig:
     host: str = "0.0.0.0"
@@ -21,6 +29,7 @@ class HubConfig:
     data_dir: str = "data"
     retention_days: int = 0          # history retention; 0 = keep forever
     max_upload_mb: int = 100
+    auth_token: str = ""             # empty = no authentication (default)
     engines: dict = dataclasses.field(default_factory=dict)  # per-engine overrides
 
     @property
@@ -40,6 +49,7 @@ def load_config() -> HubConfig:
         data_dir=hub.get("data_dir", "data"),
         retention_days=int(hub.get("retention_days", 0)),
         max_upload_mb=int(hub.get("max_upload_mb", 100)),
+        auth_token=str(hub.get("auth_token", "")).strip(),
         engines=raw.get("engines", {}),
     )
     for sub in ("audio", "voices", "logs", "run", "capabilities"):
@@ -56,6 +66,9 @@ def load_config() -> HubConfig:
 #   [hub]            hub-level settings
 #   [engines.<id>]   per-engine OVERRIDES on top of that engine's manifest
 #
+# Access control is off by default. Set [hub] auth_token = "<secret>" to make
+# every /api/* call require it; the WebUI then asks for it once per browser.
+#
 # Example overrides (any subset of keys):
 #   [engines.melotts]
 #   port = 5066
@@ -67,14 +80,16 @@ def load_config() -> HubConfig:
 
 
 def save_config(cfg: HubConfig) -> None:
-    doc = {
-        "hub": {
-            "host": cfg.host, "port": cfg.port, "data_dir": cfg.data_dir,
-            "retention_days": cfg.retention_days,
-            "max_upload_mb": cfg.max_upload_mb,
-        },
-        "engines": cfg.engines,
+    hub = {
+        "host": cfg.host, "port": cfg.port, "data_dir": cfg.data_dir,
+        "retention_days": cfg.retention_days,
+        "max_upload_mb": cfg.max_upload_mb,
     }
+    # Written back only when set, so saving from the Settings page can never
+    # silently drop an access token the WebUI never sees.
+    if cfg.auth_token:
+        hub["auth_token"] = cfg.auth_token
+    doc = {"hub": hub, "engines": cfg.engines}
     CONFIG_PATH.write_text(CONFIG_HEADER + tomli_w.dumps(doc))
 
 
diff --git a/hub/tts_hub/main.py b/hub/tts_hub/main.py
index 3f2afb6..c1c53c6 100644
--- a/hub/tts_hub/main.py
+++ b/hub/tts_hub/main.py
@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import logging
+import secrets
 from contextlib import asynccontextmanager
 from pathlib import Path
 
@@ -61,6 +62,26 @@ async def lifespan(app: FastAPI):
     async def unknown_id(_, exc: KeyError):
         return PlainTextResponse(f"not found: {exc}", status_code=404)
 
+    @app.middleware("http")
+    async def require_token(request, call_next):
+        """Gate /api/* when config.toml sets an auth_token; no-op otherwise.
+
+        EventSource and <audio src> cannot send an Authorization header, so a
+        ?token= query parameter is accepted as well. That puts the token in the
+        access log of the very machine that already stores it in plaintext,
+        which is a trade the single-user LAN threat model can make. Static WebUI
+        files stay open so the browser can load the page that asks for it —
+        including any whose name happens to start with "api", hence the slash.
+        """
+        token = cfg.auth_token
+        if token and request.url.path.startswith("/api/"):
+            header = request.headers.get("authorization", "")
+            supplied = (header[7:].strip() if header[:7].lower() == "bearer "
+                        else request.query_params.get("token", ""))
+            if not secrets.compare_digest(supplied, token):
+                return PlainTextResponse("unauthorized", status_code=401)
+        return await call_next(request)
+
     app.include_router(build_router(app.state))
     # No GZip middleware: SSE streams must never pass through gzip (Safari
     # buffers compressed streams), and audio goes out via FileResponse.
diff --git a/hub/tts_hub/static/js/api.js b/hub/tts_hub/static/js/api.js
index ff78e14..67a728f 100644
--- a/hub/tts_hub/static/js/api.js
+++ b/hub/tts_hub/static/js/api.js
@@ -1,22 +1,31 @@
 // Thin fetch wrapper: JSON in/out, plain-text errors surfaced as exceptions.
+// Every call carries the access token when one is configured, and a 401 opens
+// the login prompt once and then replays the request.
+import { authHeaders, withAuthRetry } from "./auth.js";
+
 async function check(res) {
   if (!res.ok) throw new Error(await res.text().catch(() => res.statusText));
   const ct = res.headers.get("content-type") || "";
   return ct.includes("json") ? res.json() : res.text();
 }
 
+const send = (init) => withAuthRetry(() => fetch(init.url, {
+  ...init.options,
+  headers: { ...(init.options?.headers || {}), ...authHeaders() },
+})).then(check);
+
 export const api = {
-  get: (url) => fetch(url).then(check),
-  post: (url, body, options = {}) => fetch(url, {
+  get: (url) => send({ url }),
+  post: (url, body, options = {}) => send({ url, options: {
     method: "POST",
     headers: body !== undefined ? { "content-type": "application/json" } : {},
     body: body !== undefined ? JSON.stringify(body) : undefined,
     ...options,
-  }).then(check),
-  del: (url) => fetch(url, { method: "DELETE" }).then(check),
-  put: (url, body) => fetch(url, {
+  } }),
+  del: (url) => send({ url, options: { method: "DELETE" } }),
+  put: (url, body) => send({ url, options: {
     method: "PUT", headers: { "content-type": "application/json" },
     body: JSON.stringify(body),
-  }).then(check),
-  upload: (url, formData) => fetch(url, { method: "POST", body: formData }).then(check),
+  } }),
+  upload: (url, formData) => send({ url, options: { method: "POST", body: formData } }),
 };
diff --git a/hub/tts_hub/static/js/app.js b/hub/tts_hub/static/js/app.js
index c5eb7e7..9aef2f3 100644
--- a/hub/tts_hub/static/js/app.js
+++ b/hub/tts_hub/static/js/app.js
@@ -10,6 +10,8 @@ import { Voices } from "./pages/voices.js";
 import { History } from "./pages/history.js";
 import { Settings } from "./pages/settings.js";
 import { DialogRoot } from "./components/Dialogs.js";
+import { AuthGate } from "./components/AuthGate.js";
+import { ensureAuthenticated } from "./auth.js";
 
 const PAGES = {
   engines: { title: "nav.engines", ico: IcEngines, comp: Engines },
@@ -84,6 +86,7 @@ function App() {
       </button>`}
 
     <${DialogRoot} />
+    <${AuthGate} />
 
     <div class="toast-zone">
       ${toasts.value.map(t => html`<div class="toast" key=${t.id}>${t.msg}</div>`)}
@@ -91,6 +94,11 @@ function App() {
   </div>`;
 }
 
-connectSSE();
-refreshVoices();
 render(html`<${App} />`, document.getElementById("app"));
+
+// A guarded hub answers 401 until the browser has the token; the gate renders
+// over the shell, and the live connections only start once it is satisfied.
+ensureAuthenticated().then(() => {
+  connectSSE();
+  refreshVoices();
+});
diff --git a/hub/tts_hub/static/js/auth.js b/hub/tts_hub/static/js/auth.js
new file mode 100644
index 0000000..c52fc5c
--- /dev/null
+++ b/hub/tts_hub/static/js/auth.js
@@ -0,0 +1,98 @@
+// Access token handling for a hub started with [hub] auth_token set.
+//
+// Dependency-free on purpose: no h.js, no DOM — the WebUI subscribes to
+// onPromptChange() and node runs this module directly in the tests.
+// When no token is stored (the default hub), every helper here is a no-op.
+import { withParam } from "./urls.js";
+
+const KEY = "aviary-token";
+const store = () => globalThis.localStorage;
+
+let token = "";
+try { token = store()?.getItem(KEY) || ""; } catch { token = ""; }
+
+let waiting = [];          // resolvers of pending promptForToken() calls
+let listeners = [];        // UI subscribers to the "prompt open" state
+let promptOpen = false;
+
+function setPrompt(open) {
+  promptOpen = open;
+  for (const fn of listeners) fn(open);
+}
+
+export const onPromptChange = (fn) => { listeners.push(fn); return () => {
+  listeners = listeners.filter(l => l !== fn);
+}; };
+
+export const isPromptOpen = () => promptOpen;
+export const hasToken = () => Boolean(token);
+
+export const authHeaders = () =>
+  token ? { Authorization: `Bearer ${token}` } : {};
+
+// EventSource and <audio src> cannot carry a header, so those URLs take the
+// token as a query parameter instead.
+export const authUrl = (url) => token ? withParam(url, "token", token) : url;
+
+export function setToken(value) {
+  token = (value || "").trim();
+  try {
+    if (token) store()?.setItem(KEY, token);
+    else store()?.removeItem(KEY);
+  } catch { /* private mode: keep it in memory for this session */ }
+}
+
+/** Open the login prompt; resolves once the user submits a token. */
+export function promptForToken() {
+  const pending = new Promise(resolve => waiting.push(resolve));
+  setPrompt(true);
+  return pending;
+}
+
+export function submitToken(value) {
+  setToken(value);
+  setPrompt(false);
+  const resolvers = waiting;
+  waiting = [];
+  for (const resolve of resolvers) resolve(token);
+}
+
+/**
+ * Run a request, asking for a token and replaying it on every 401.
+ * `send` must build a fresh request each call so the new token is picked up.
+ *
+ * The loop repeats rather than giving up after one replay: a wrong token, or
+ * one rotated in config.toml mid-session, otherwise failed the call with an
+ * "unauthorized" toast and left the user with no way back but a page reload.
+ * It only ever waits on promptForToken(), so it is paced by the user.
+ */
+export async function withAuthRetry(send) {
+  for (;;) {
+    const response = await send();
+    if (response.status !== 401) return response;
+    await promptForToken();
+  }
+}
+
+/** Block startup until the hub answers something other than 401. */
+export async function ensureAuthenticated(fetchImpl = globalThis.fetch) {
+  for (;;) {
+    let response;
+    try {
+      response = await fetchImpl(authUrl("/api/config"), { headers: authHeaders() });
+    } catch {
+      return false;   // hub unreachable: let the normal offline handling show
+    }
+    if (response.status !== 401) return true;
+    await promptForToken();
+  }
+}
+
+export const __testing = {
+  reset() {
+    token = "";
+    waiting = [];
+    listeners = [];
+    promptOpen = false;
+  },
+};
diff --git a/hub/tts_hub/static/js/components/AuthGate.js b/hub/tts_hub/static/js/components/AuthGate.js
new file mode 100644
index 0000000..9e562a2
--- /dev/null
+++ b/hub/tts_hub/static/js/components/AuthGate.js
@@ -0,0 +1,34 @@
+// Login prompt for a hub started with an access token. Only ever rendered
+// when the API answered 401 — a hub without a token never shows it.
+import { html, useState } from "../h.js";
+import { t } from "../i18n.js";
+import { submitToken } from "../auth.js";
+import { authPrompt } from "../store.js";
+
+function TokenDialog() {
+  const [value, setValue] = useState("");
+  const submit = (ev) => {
+    ev?.preventDefault();
+    if (value.trim()) submitToken(value);
+  };
+
+  return html`<div class="dialog-backdrop">
+    <form class="dialog elev-lg" role="dialog" aria-modal="true" onSubmit=${submit}>
+      <div class="dialog-title">${t("auth.title")}</div>
+      <div class="dialog-body" style="display:flex; flex-direction:column; gap:12px">
+        <p style="margin:0; font-size:13.5px; line-height:1.6">${t("auth.body")}</p>
+        <input class="input mono" type="password" autofocus autocomplete="current-password"
+               placeholder=${t("auth.placeholder")} value=${value}
+               onInput=${ev => setValue(ev.target.value)} />
+      </div>
+      <div class="dialog-actions">
+        <button class="btn btn-primary" style="min-height:42px" type="submit"
+                disabled=${!value.trim()}>${t("auth.cta")}</button>
+      </div>
+    </form>
+  </div>`;
+}
+
+export function AuthGate() {
+  return authPrompt.value ? html`<${TokenDialog} />` : null;
+}
diff --git a/hub/tts_hub/static/js/history-data.js b/hub/tts_hub/static/js/history-data.js
new file mode 100644
index 0000000..c28f30a
--- /dev/null
+++ b/hub/tts_hub/static/js/history-data.js
@@ -0,0 +1,21 @@
+// Page merging for the History list. Kept free of DOM and framework imports
+// so the ordering rules can be tested directly.
+
+/** Append the next page, ignoring rows already on screen. */
+export function appendPage(loaded, items) {
+  const seen = new Set(loaded.map(r => r.id));
+  return [...loaded, ...items.filter(r => !seen.has(r.id))];
+}
+
+/**
+ * Fold a freshly fetched first page into the list without discarding the
+ * pages the user already loaded: new generations arrive on top, rows still
+ * present are refreshed in place, and everything below is left alone.
+ */
+export function mergeNewest(loaded, items) {
+  const fresh = new Set(items.map(r => r.id));
+  return [...items, ...loaded.filter(r => !fresh.has(r.id))];
+}
+
+/** How many rows exist on the server that are not on screen yet. */
+export const remaining = (total, loadedCount) => Math.max(0, total - loadedCount);
diff --git a/hub/tts_hub/static/js/pages/engines.js b/hub/tts_hub/static/js/pages/engines.js
index b3b28a7..4822b63 100644
--- a/hub/tts_hub/static/js/pages/engines.js
+++ b/hub/tts_hub/static/js/pages/engines.js
@@ -1,5 +1,6 @@
 import { html, useState, useEffect, useRef } from "../h.js";
 import { api } from "../api.js";
+import { authUrl } from "../auth.js";
 import { t, tBackend } from "../i18n.js";
 import { engines, jobs, voices, toast, confirmDialog, dialog, fmtGB, fmtUp, STATUS,
          openConfigFor, activeJobList, go } from "../store.js";
@@ -11,7 +12,7 @@ function LogDrawer({ engineId }) {
   const [lines, setLines] = useState([]);
   const boxRef = useRef(null);
   useEffect(() => {
-    const es = new EventSource(`/api/engines/${engineId}/logs/stream`);
+    const es = new EventSource(authUrl(`/api/engines/${engineId}/logs/stream`));
     es.addEventListener("log_snapshot", ev => setLines(JSON.parse(ev.data).lines));
     es.addEventListener("log", ev =>
       setLines(prev => [...prev.slice(-399), JSON.parse(ev.data).line]));
diff --git a/hub/tts_hub/static/js/pages/history.js b/hub/tts_hub/static/js/pages/history.js
index 5e005a8..ea514cc 100644
--- a/hub/tts_hub/static/js/pages/history.js
+++ b/hub/tts_hub/static/js/pages/history.js
@@ -1,15 +1,54 @@
-import { html, useState, useEffect } from "../h.js";
+import { html, useState, useEffect, useRef } from "../h.js";
 import { api } from "../api.js";
+import { authUrl } from "../auth.js";
+import { withDownload } from "../urls.js";
+import { appendPage, mergeNewest, remaining } from "../history-data.js";
 import { t } from "../i18n.js";
 import { engines, jobs, toast, confirmDialog, dialog, studioPreset, fmtDur, go } from "../store.js";
 import * as player from "../player.js";
 import { IcDownload, IcLoad, IcTrash, IcPlay, IcPause } from "../icons.js";
 
+const PAGE = 100;
+
 export function History() {
   const [rows, setRows] = useState(null);
+  const [total, setTotal] = useState(0);
+  const [busy, setBusy] = useState(false);
   const [filter, setFilter] = useState("all");
-  const load = () => api.get("/api/history?limit=100").then(setRows)
-    .catch(err => toast(err.message));
+
+  const paging = useRef(false);         // a Load more request is in flight
+  const refreshQueued = useRef(false);  // a job finished while it was
+
+  const fetchPage = (offset) =>
+    api.get(`/api/history?limit=${PAGE}&offset=${offset}`);
+
+  const load = async () => {
+    // Merging a fresh first page mid-flight would insert rows above the
+    // offset the in-flight page was asked for, so that page comes back
+    // shifted and half of it is dropped as already-seen. Wait our turn.
+    if (paging.current) { refreshQueued.current = true; return; }
+    try {
+      const page = await fetchPage(0);
+      setRows(cur => (cur === null ? page.items : mergeNewest(cur, page.items)));
+      setTotal(page.total);
+    } catch (err) { toast(err.message); }
+  };
+
+  const loadMore = async () => {
+    paging.current = true;
+    setBusy(true);
+    try {
+      const page = await fetchPage(rows.length);
+      setRows(cur => appendPage(cur, page.items));
+      setTotal(page.total);
+    } catch (err) { toast(err.message); }
+    finally {
+      paging.current = false;
+      setBusy(false);
+      if (refreshQueued.current) { refreshQueued.current = false; load(); }
+    }
+  };
+
   useEffect(() => { load(); }, []);
   useEffect(() => {
     const done = Object.values(jobs.value).filter(j => j.status === "done").length;
@@ -21,8 +60,11 @@ export function History() {
     t("history.deleteBody"),
     t("common.delete"),
     async () => {
-      try { await api.del(`/api/history/${r.id}`); load(); }
-      catch (err) { toast(err.message); }
+      try {
+        await api.del(`/api/history/${r.id}`);
+        setRows(cur => cur.filter(row => row.id !== r.id));
+        setTotal(n => Math.max(0, n - 1));
+      } catch (err) { toast(err.message); }
       dialog.value = null;
     });
 
@@ -37,6 +79,7 @@ export function History() {
   };
 
   if (rows === null) return html`<div class="page-head"><div class="lead"><h2>${t("history.title")}</h2></div></div>`;
+  const left = remaining(total, rows.length);
   const engineIds = [...new Set(rows.map(r => r.engine))];
   const shown = filter === "all" ? rows : rows.filter(r => r.engine === filter);
   const titleOf = id => engines.value.find(e => e.id === id)?.title || id;
@@ -63,7 +106,7 @@ export function History() {
         return html`<div class="card elev-sm" style="padding:13px 18px; gap:8px" key=${r.id}>
           <div style="display:flex; align-items:center; gap:12px; flex-wrap:wrap">
             <button class="play-btn line" title=${t("common.playPause")}
-                    onClick=${() => player.toggle(key, `/api/history/${r.id}/audio`)}>
+                    onClick=${() => player.toggle(key, authUrl(`/api/history/${r.id}/audio`))}>
               ${isPlaying ? html`<${IcPause} size=${15} />` : html`<${IcPlay} size=${15} />`}
             </button>
             <div style="flex:1; min-width:180px">
@@ -78,7 +121,7 @@ export function History() {
             </div>
             <div style="display:flex; gap:7px">
               <a class="btn btn-secondary btn-icon" title=${t("history.download")}
-                 href="/api/history/${r.id}/audio?download=true"
+                 href="${withDownload(authUrl(`/api/history/${r.id}/audio`))}"
                  download="${r.engine}-${r.id}.${r.format}">
                 <${IcDownload} size=${14} />
               </a>
@@ -101,6 +144,14 @@ export function History() {
       })}
     </div>
 
+    ${left > 0 && html`
+      <div style="display:flex; justify-content:center; margin-top:14px">
+        <button class="btn btn-secondary" style="min-height:40px"
+                disabled=${busy} onClick=${loadMore}>
+          ${busy ? t("history.loadingMore") : t("history.loadMore", { n: left })}
+        </button>
+      </div>`}
+
     ${!shown.length && html`
       <div class="dashed-empty">${t("history.empty")}</div>`}
   </div>`;
diff --git a/hub/tts_hub/static/js/pages/studio.js b/hub/tts_hub/static/js/pages/studio.js
index 9a36237..35efc77 100644
--- a/hub/tts_hub/static/js/pages/studio.js
+++ b/hub/tts_hub/static/js/pages/studio.js
@@ -1,5 +1,7 @@
 import { html, useState, useEffect, useMemo } from "../h.js";
 import { api } from "../api.js";
+import { authUrl } from "../auth.js";
+import { withDownload } from "../urls.js";
 import { t, tLabel, tBackend } from "../i18n.js";
 import { engines, jobs, voices, toast, studioPreset, dialog, fmtDur, STATUS, go } from "../store.js";
 import * as player from "../player.js";
@@ -28,7 +30,7 @@ export function ResultCard({ jobId }) {
   const j = jobs.value[jobId];
   if (!j) return null;
   const eng = engines.value.find(e => e.id === j.engine);
-  const url = `/api/jobs/${jobId}/audio`;
+  const url = authUrl(`/api/jobs/${jobId}/audio`);
   const key = "result:" + jobId;
   const isPlaying = player.playing.value === key;
   const frac = isPlaying && player.dur.value ? player.pos.value / player.dur.value : 0;
@@ -93,7 +95,7 @@ export function ResultCard({ jobId }) {
     </div>
     <div style="display:flex; gap:8px; flex-wrap:wrap">
       <a class="btn btn-secondary" style="min-height:38px; font-size:12px"
-         href="${url}?download=true" download="${j.engine}-${jobId}.${j.format}">
+         href="${withDownload(url)}" download="${j.engine}-${jobId}.${j.format}">
         <${IcDownload} size=${13} /> ${j.engine}-${jobId.slice(0, 4)}.${j.format}
       </a>
       <button class="btn btn-ghost" style="min-height:38px; font-size:12px" onClick=${saveVoice}>
diff --git a/hub/tts_hub/static/js/pages/voices.js b/hub/tts_hub/static/js/pages/voices.js
index a6369b9..1209f35 100644
--- a/hub/tts_hub/static/js/pages/voices.js
+++ b/hub/tts_hub/static/js/pages/voices.js
@@ -1,5 +1,6 @@
 import { html, useEffect } from "../h.js";
 import { api } from "../api.js";
+import { authUrl } from "../auth.js";
 import { t, tBackend } from "../i18n.js";
 import { voices, refreshVoices, toast, dialog, confirmDialog, go, studioPreset } from "../store.js";
 import * as player from "../player.js";
@@ -48,7 +49,7 @@ export function Voices() {
         return html`<div class="card elev-sm" style="padding:15px 18px; gap:10px" key=${v.id}>
           <div style="display:flex; align-items:center; gap:12px; flex-wrap:wrap">
             <button class="play-btn alt" title=${t("common.playPause")}
-                    onClick=${() => player.toggle(key, `/api/voices/${v.id}/audio`)}>
+                    onClick=${() => player.toggle(key, authUrl(`/api/voices/${v.id}/audio`))}>
               ${isPlaying ? html`<${IcPause} size=${15} />` : html`<${IcPlay} size=${15} />`}
             </button>
             <div style="flex:1; min-width:150px">
diff --git a/hub/tts_hub/static/js/store.js b/hub/tts_hub/static/js/store.js
index 894d886..daf195e 100644
--- a/hub/tts_hub/static/js/store.js
+++ b/hub/tts_hub/static/js/store.js
@@ -1,6 +1,7 @@
 // Global state (signals) + the single /api/events SSE client.
 import { signal } from "./h.js";
 import { api } from "./api.js";
+import { authUrl, isPromptOpen, onPromptChange } from "./auth.js";
 export { fmtDur } from "./format.js";
 
 export const engines = signal([]);          // snapshots incl. capabilities
@@ -9,12 +10,15 @@ export const voices = signal([]);
 export const route = signal(location.hash.slice(1).split("?")[0] || "engines");
 export const theme = signal(localStorage.getItem("aviary-theme") || "system");
 export const toasts = signal([]);
+export const authPrompt = signal(isPromptOpen());  // access-token login gate
 export const dialog = signal(null);         // {type:'confirm'|'upload'|'help'|'saveVoice', ...}
 
 // Cross-page hand-offs.
 export const studioPreset = signal(null);   // {engine, text, params, voice_id}
 export const openConfigFor = signal(null);  // engine id whose config panel to open
 
+onPromptChange(open => { authPrompt.value = open; });
+
 window.addEventListener("hashchange", () => {
   route.value = location.hash.slice(1).split("?")[0] || "engines";
 });
@@ -58,7 +62,7 @@ export async function refreshVoices() {
 }
 
 export function connectSSE() {
-  const es = new EventSource("/api/events");
+  const es = new EventSource(authUrl("/api/events"));
   es.addEventListener("snapshot", (ev) => {
     const d = JSON.parse(ev.data);
     engines.value = d.engines;
diff --git a/hub/tts_hub/static/js/urls.js b/hub/tts_hub/static/js/urls.js
new file mode 100644
index 0000000..be36cb1
--- /dev/null
+++ b/hub/tts_hub/static/js/urls.js
@@ -0,0 +1,6 @@
+// Query-string helpers. Endpoints can already carry a token parameter, so
+// nothing may assume a bare path when appending its own.
+export const withParam = (url, key, value) =>
+  url + (url.includes("?") ? "&" : "?") + key + "=" + encodeURIComponent(value);
+
+export const withDownload = (url) => withParam(url, "download", "true");
diff --git a/hub/tts_hub/static/locales/en.json b/hub/tts_hub/static/locales/en.json
index c4c0fa2..07a2658 100644
--- a/hub/tts_hub/static/locales/en.json
+++ b/hub/tts_hub/static/locales/en.json
@@ -144,6 +144,8 @@
   "history.download": "Download",
   "history.loadIntoStudio": "Load into Studio",
   "history.empty": "Nothing here for this filter yet.",
+  "history.loadMore": "Load {n} more",
+  "history.loadingMore": "Loading…",
 
   "settings.title": "Settings",
   "settings.tagline": "Changes are written straight to the hub's config file.",
@@ -202,5 +204,10 @@
   "warn.long": "Quite long ({n} s) — most engines use only the first ~10–30 s",
   "warn.lowSr": "Low sample rate ({n} Hz) — clone fidelity may suffer",
   "warn.clipping": "Clipping detected",
-  "warn.quiet": "Very low volume — near silence"
+  "warn.quiet": "Very low volume — near silence",
+
+  "auth.title": "Access token required",
+  "auth.body": "This hub is protected by an access token. Paste it once — this browser remembers it.",
+  "auth.placeholder": "Access token",
+  "auth.cta": "Unlock"
 }
diff --git a/hub/tts_hub/static/locales/fr.json b/hub/tts_hub/static/locales/fr.json
index 0f0215b..fb35ec4 100644
--- a/hub/tts_hub/static/locales/fr.json
+++ b/hub/tts_hub/static/locales/fr.json
@@ -144,6 +144,8 @@
   "history.download": "Télécharger",
   "history.loadIntoStudio": "Charger dans Studio",
   "history.empty": "Rien ici pour ce filtre pour l'instant.",
+  "history.loadMore": "Charger {n} de plus",
+  "history.loadingMore": "Chargement…",
 
   "settings.title": "Réglages",
   "settings.tagline": "Les changements sont écrits directement dans le fichier de configuration du hub.",
@@ -202,5 +204,10 @@
   "warn.long": "Assez long ({n} s) — la plupart des moteurs n'utilisent que les ~10–30 premières secondes",
   "warn.lowSr": "Fréquence d'échantillonnage basse ({n} Hz) — la fidélité du clone peut en pâtir",
   "warn.clipping": "Écrêtage détecté",
-  "warn.quiet": "Volume très faible — quasi-silence"
+  "warn.quiet": "Volume très faible — quasi-silence",
+
+  "auth.title": "Jeton d'accès requis",
+  "auth.body": "Ce hub est protégé par un jeton d'accès. Collez-le une fois — ce navigateur s'en souviendra.",
+  "auth.placeholder": "Jeton d'accès",
+  "auth.cta": "Déverrouiller"
 }
diff --git a/hub/tts_hub/static/locales/zh.json b/hub/tts_hub/static/locales/zh.json
index 82d0b66..b6871fc 100644
--- a/hub/tts_hub/static/locales/zh.json
+++ b/hub/tts_hub/static/locales/zh.json
@@ -144,6 +144,8 @@
   "history.download": "下载",
   "history.loadIntoStudio": "载入工作台",
   "history.empty": "这个筛选下暂时没有内容。",
+  "history.loadMore": "再加载 {n} 条",
+  "history.loadingMore": "加载中…",
 
   "settings.title": "设置",
   "settings.tagline": "改动会直接写入 hub 的配置文件。",
@@ -202,5 +204,10 @@
   "warn.long": "偏长({n} 秒)——多数引擎只用前约 10–30 秒",
   "warn.lowSr": "采样率偏低({n} Hz)——克隆保真度可能受影响",
   "warn.clipping": "检测到削波(clipping)",
-  "warn.quiet": "音量极低或近乎静音"
+  "warn.quiet": "音量极低或近乎静音",
+
+  "auth.title": "需要访问令牌",
+  "auth.body": "此 hub 已启用访问令牌保护。粘贴一次即可,本浏览器会记住它。",
+  "auth.placeholder": "访问令牌",
+  "auth.cta": "解锁"
 }
diff --git a/hub/tts_hub/supervisor.py b/hub/tts_hub/supervisor.py
index 286e7f7..64524f8 100644
--- a/hub/tts_hub/supervisor.py
+++ b/hub/tts_hub/supervisor.py
@@ -25,6 +25,7 @@
 import httpx
 import psutil
 
+from .aio import spawn
 from .config import EngineManifest, HubConfig
 from .events import Broadcaster
 
@@ -363,7 +364,7 @@ def rescan(self, manifests: dict[str, EngineManifest]):
                     cur.m.idle_unload_min = m.idle_unload_min
                     cur.m.enabled = m.enabled
                     if not m.enabled:
-                        asyncio.create_task(cur.stop())
+                        spawn(cur.stop(), name=f"rescan-disable:{mid}")
                 self.events.publish("engine", cur.snapshot())
             else:
                 self.engines[mid] = EngineProc(m, self.cfg, self.events)
@@ -411,7 +412,7 @@ async def startup(self):
         self._bg = asyncio.create_task(self._housekeeping())
         for e in self.engines.values():
             if e.m.autostart:
-                asyncio.create_task(e.start())
+                spawn(e.start(), name=f"autostart:{e.m.id}")
 
     async def shutdown(self):
         if self._bg:
@@ -432,7 +433,7 @@ async def _housekeeping(self):
                 if (e.status == "ready" and idle_min > 0
                         and now - e.last_used > idle_min * 60):
                     e._log_line(f"[hub] idle for {idle_min} min; unloading")
-                    asyncio.create_task(e.stop())
+                    spawn(e.stop(), name=f"idle-unload:{e.m.id}")
 
     def snapshots(self, with_caps: bool = True) -> list[dict]:
         return [e.snapshot(with_caps) for e in self.engines.values()]
diff --git a/hub/web-tests/auth.test.mjs b/hub/web-tests/auth.test.mjs
new file mode 100644
index 0000000..9fb091d
--- /dev/null
+++ b/hub/web-tests/auth.test.mjs
@@ -0,0 +1,105 @@
+import assert from "node:assert/strict";
+import test, { beforeEach } from "node:test";
+
+import { authHeaders, authUrl, ensureAuthenticated, promptForToken, setToken,
+         submitToken, withAuthRetry, __testing } from "../tts_hub/static/js/auth.js";
+import { withDownload, withParam } from "../tts_hub/static/js/urls.js";
+
+beforeEach(() => __testing.reset());
+
+test("a hub without a token is untouched by every helper", () => {
+  assert.deepEqual(authHeaders(), {});
+  assert.equal(authUrl("/api/events"), "/api/events");
+  assert.equal(authUrl("/api/history/x/audio?download=true"),
+    "/api/history/x/audio?download=true");
+});
+
+test("a stored token travels as a header and as a query fallback", () => {
+  setToken("  s3cret  ");
+  assert.deepEqual(authHeaders(), { Authorization: "Bearer s3cret" });
+  assert.equal(authUrl("/api/events"), "/api/events?token=s3cret");
+  // EventSource URLs that already carry a query keep it intact.
+  assert.equal(authUrl("/api/history?limit=50"), "/api/history?limit=50&token=s3cret");
+});
+
+test("tokens needing escaping stay valid in a URL", () => {
+  setToken("a b&c=d");
+  assert.equal(authUrl("/api/events"), "/api/events?token=a%20b%26c%3Dd");
+});
+
+test("download links append cleanly to a tokenised audio URL", () => {
+  setToken("s3cret");
+  assert.equal(withDownload(authUrl("/api/jobs/j1/audio")),
+    "/api/jobs/j1/audio?token=s3cret&download=true");
+  assert.equal(withParam("/api/x", "q", "a b"), "/api/x?q=a%20b");
+});
+
+test("a 401 opens the prompt once and replays the request with the new token", async () => {
+  const sent = [];
+  const send = () => {
+    sent.push(authHeaders().Authorization);
+    return { status: sent.length === 1 ? 401 : 200 };
+  };
+
+  const inFlight = withAuthRetry(send);
+  await Promise.resolve();
+  submitToken("late-token");
+
+  assert.equal((await inFlight).status, 200);
+  assert.deepEqual(sent, [undefined, "Bearer late-token"]);
+});
+
+test("a wrong token re-opens the prompt instead of failing the request", async () => {
+  const sent = [];
+  const send = () => {
+    sent.push(authHeaders().Authorization);
+    return { status: sent.length < 3 ? 401 : 200 };
+  };
+
+  const inFlight = withAuthRetry(send);
+  await Promise.resolve();
+  submitToken("wrong");
+  await Promise.resolve();
+  await Promise.resolve();
+  submitToken("right");
+
+  assert.equal((await inFlight).status, 200);
+  assert.deepEqual(sent, [undefined, "Bearer wrong", "Bearer right"]);
+});
+
+test("a non-401 response never opens the prompt", async () => {
+  let prompted = false;
+  const stop = (await import("../tts_hub/static/js/auth.js"))
+    .onPromptChange(() => { prompted = true; });
+  const response = await withAuthRetry(() => ({ status: 422 }));
+  stop();
+  assert.equal(response.status, 422);
+  assert.equal(prompted, false);
+});
+
+test("every waiter resumes from a single token submission", async () => {
+  const first = promptForToken();
+  const second = promptForToken();
+  submitToken("shared");
+  assert.deepEqual(await Promise.all([first, second]), ["shared", "shared"]);
+});
+
+test("startup retries until the hub stops answering 401", async () => {
+  const calls = [];
+  const fetchImpl = async (url) => {
+    calls.push(url);
+    return { status: calls.length === 1 ? 401 : 200 };
+  };
+
+  const booted = ensureAuthenticated(fetchImpl);
+  await Promise.resolve();
+  submitToken("good");
+
+  assert.equal(await booted, true);
+  assert.deepEqual(calls, ["/api/config", "/api/config?token=good"]);
+});
+
+test("an unreachable hub resolves instead of hanging the boot", async () => {
+  const failing = async () => { throw new Error("connection refused"); };
+  assert.equal(await ensureAuthenticated(failing), false);
+});
diff --git a/hub/web-tests/history-data.test.mjs b/hub/web-tests/history-data.test.mjs
new file mode 100644
index 0000000..bcbf129
--- /dev/null
+++ b/hub/web-tests/history-data.test.mjs
@@ -0,0 +1,38 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { appendPage, mergeNewest, remaining }
+  from "../tts_hub/static/js/history-data.js";
+
+const row = (id, extra = {}) => ({ id, engine: "fake", ...extra });
+
+test("the next page appends below what is already on screen", () => {
+  const loaded = [row("c"), row("b")];
+  assert.deepEqual(appendPage(loaded, [row("a")]).map(r => r.id), ["c", "b", "a"]);
+});
+
+test("a page overlapping the list cannot duplicate rows", () => {
+  const loaded = [row("c"), row("b")];
+  const merged = appendPage(loaded, [row("b"), row("a")]);
+  assert.deepEqual(merged.map(r => r.id), ["c", "b", "a"]);
+});
+
+test("new generations land on top without dropping loaded pages", () => {
+  const loaded = [row("c"), row("b"), row("a")];
+  const merged = mergeNewest(loaded, [row("d"), row("c"), row("b")]);
+  assert.deepEqual(merged.map(r => r.id), ["d", "c", "b", "a"]);
+});
+
+test("a refreshed row is replaced by its newer copy", () => {
+  const loaded = [row("c", { rtf: null }), row("b")];
+  const merged = mergeNewest(loaded, [row("c", { rtf: 0.4 })]);
+  assert.equal(merged.length, 2);
+  assert.equal(merged[0].rtf, 0.4);
+});
+
+test("the load-more count reflects rows still on the server", () => {
+  assert.equal(remaining(130, 100), 30);
+  assert.equal(remaining(100, 100), 0);
+  // A row deleted elsewhere must not produce a negative button label.
+  assert.equal(remaining(99, 100), 0);
+});
diff --git a/hub/web-tests/i18n.test.mjs b/hub/web-tests/i18n.test.mjs
new file mode 100644
index 0000000..62df1f0
--- /dev/null
+++ b/hub/web-tests/i18n.test.mjs
@@ -0,0 +1,47 @@
+import assert from "node:assert/strict";
+import { readFileSync, readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+const STATIC = join(dirname(fileURLToPath(import.meta.url)), "..", "tts_hub", "static");
+const LANGS = ["en", "fr", "zh"];
+
+const dict = (lang) =>
+  JSON.parse(readFileSync(join(STATIC, "locales", `${lang}.json`), "utf8"));
+
+function jsFiles(dir) {
+  return readdirSync(dir, { withFileTypes: true }).flatMap(entry =>
+    entry.isDirectory() ? jsFiles(join(dir, entry.name))
+      : entry.name.endsWith(".js") ? [join(dir, entry.name)] : []);
+}
+
+test("every locale defines exactly the same keys", () => {
+  const [en, ...others] = LANGS.map(dict);
+  const expected = Object.keys(en).sort();
+  for (const [index, other] of others.entries()) {
+    assert.deepEqual(Object.keys(other).sort(), expected,
+      `${LANGS[index + 1]}.json drifted from en.json`);
+  }
+});
+
+test("no locale leaves a string untranslated by accident", () => {
+  for (const lang of LANGS) {
+    for (const [key, value] of Object.entries(dict(lang))) {
+      assert.equal(typeof value, "string", `${lang}:${key} is not a string`);
+      assert.notEqual(value.trim(), "", `${lang}:${key} is empty`);
+    }
+  }
+});
+
+test("every t(\"key\") used by the WebUI exists in the dictionaries", () => {
+  const en = dict("en");
+  const missing = new Set();
+  for (const file of jsFiles(join(STATIC, "js"))) {
+    const source = readFileSync(file, "utf8");
+    for (const [, key] of source.matchAll(/\bt\(\s*"([\w.]+)"/g)) {
+      if (!(key in en)) missing.add(`${file.split("/static/")[1]}: ${key}`);
+    }
+  }
+  assert.deepEqual([...missing], []);
+});
diff --git a/scripts/export_openapi.py b/scripts/export_openapi.py
new file mode 100644
index 0000000..45b6a64
--- /dev/null
+++ b/scripts/export_openapi.py
@@ -0,0 +1,89 @@
+"""Regenerate (or drift-check) the worker OpenAPI documents in docs/api/.
+
+    python scripts/export_openapi.py            # rewrite docs/api/*.openapi.json
+    python scripts/export_openapi.py --check    # fail if the committed docs are stale
+
+Adapters import their model libraries lazily inside ``load()``, so building a
+worker app only needs the SDK's own dependencies — no engine venv required.
+"""
+from __future__ import annotations
+
+import argparse
+import importlib
+import json
+import sys
+import tomllib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+ENGINES_DIR = ROOT / "engines"
+DEFAULT_OUT = ROOT / "docs" / "api"
+
+sys.path.insert(0, str(ROOT / "sdk"))
+
+
+def render(engine_dir: Path) -> dict:
+    """Build one worker app off its adapter and return its OpenAPI document."""
+    manifest = tomllib.loads((engine_dir / "engine.toml").read_text())
+    spec = manifest.get("engine", {}).get("module", "adapter:Engine")
+    mod_name, _, cls_name = spec.partition(":")
+
+    sys.path.insert(0, str(engine_dir))
+    try:
+        # Every engine names its module "adapter"; drop the previous one so
+        # each directory is imported fresh instead of hitting the cache.
+        for cached in [m for m in sys.modules
+                       if m == mod_name or m.startswith(mod_name + ".")]:
+            del sys.modules[cached]
+        module = importlib.import_module(mod_name)
+        engine = getattr(module, cls_name)()
+
+        from tts_hub_sdk.server import build_app
+        dialects = getattr(module, "DIALECTS", None)
+        app = build_app(engine, dialects=list(dialects) if dialects else None)
+        return app.openapi()
+    finally:
+        sys.path.remove(str(engine_dir))
+
+
+def serialize(doc: dict) -> str:
+    return json.dumps(doc, indent=2, ensure_ascii=False) + "\n"
+
+
+def engine_dirs() -> list[Path]:
+    return [d for d in sorted(ENGINES_DIR.iterdir())
+            if d.is_dir() and (d / "engine.toml").exists()]
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--out", type=Path, default=DEFAULT_OUT,
+                        help="output directory (default: docs/api)")
+    parser.add_argument("--check", action="store_true",
+                        help="compare only; exit 1 when the docs are stale")
+    args = parser.parse_args()
+    args.out.mkdir(parents=True, exist_ok=True)
+
+    stale: list[str] = []
+    for engine_dir in engine_dirs():
+        payload = serialize(render(engine_dir))
+        target = args.out / f"{engine_dir.name}.openapi.json"
+        current = target.read_text() if target.exists() else None
+        if args.check:
+            if current != payload:
+                stale.append(target.name)
+            continue
+        if current != payload:
+            target.write_text(payload)
+            print(f"updated {target.relative_to(ROOT)}")
+
+    if stale:
+        print("OpenAPI docs are stale: " + ", ".join(stale), file=sys.stderr)
+        print("Run: python scripts/export_openapi.py", file=sys.stderr)
+        return 1
+    print("OpenAPI docs are up to date" if args.check else "done")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/sdk/tts_hub_sdk/server.py b/sdk/tts_hub_sdk/server.py
index 55dbbb5..0369f96 100644
--- a/sdk/tts_hub_sdk/server.py
+++ b/sdk/tts_hub_sdk/server.py
@@ -17,10 +17,12 @@
 from __future__ import annotations
 
 import asyncio
+import contextlib
 import hashlib
 import logging
 import os
 import tempfile
+import time
 from concurrent.futures import ThreadPoolExecutor
 from contextlib import asynccontextmanager
 from typing import Optional
@@ -53,17 +55,46 @@ async def synthesize(self, text: str, params: dict,
                 text, params, ref_audio=ref_audio, ref_text=ref_text))
 
 
+REF_CACHE_TTL_S = 7 * 24 * 3600
+
+
 def _cache_ref_audio(ref_dir: str, data: bytes, ext: str) -> str:
     """Persist reference-audio bytes to a stable temp path keyed by hash,
     so re-sending the same voice for every chunk of a book is free."""
     digest = hashlib.sha256(data).hexdigest()[:16]
     path = os.path.join(ref_dir, f"{digest}.{ext.lstrip('.') or 'wav'}")
-    if not os.path.exists(path):
+    if os.path.exists(path):
+        # Mark it as still in use so the next startup keeps it.
+        with contextlib.suppress(OSError):
+            os.utime(path, None)
+    else:
         with open(path, "wb") as f:
             f.write(data)
     return path
 
 
+def _prune_ref_cache(ref_dir: str, ttl: float = REF_CACHE_TTL_S) -> int:
+    """Drop reference clips untouched for `ttl` seconds.
+
+    The cache is content-addressed and never expires on its own, so without
+    this a worker leaves every voice it has ever cloned in the temp dir.
+    """
+    cutoff = time.time() - ttl
+    removed = 0
+    try:
+        entries = list(os.scandir(ref_dir))
+    except OSError:
+        return 0
+    for entry in entries:
+        try:
+            if entry.is_file() and entry.stat().st_mtime < cutoff:
+                os.unlink(entry.path)
+                removed += 1
+        except OSError:
+            continue    # vanished or not ours: never block startup over it
+    return removed
+
+
 def build_app(engine, *, name: str | None = None,
               dialects: list[APIRouter] | None = None) -> FastAPI:
     initial_caps = dict(engine.capabilities)
@@ -72,6 +103,9 @@ def build_app(engine, *, name: str | None = None,
     param_schema = initial_caps.get("params", [])
     ref_dir = os.path.join(tempfile.gettempdir(), f"tts-hub-refs-{name}")
     os.makedirs(ref_dir, exist_ok=True)
+    pruned = _prune_ref_cache(ref_dir)
+    if pruned:
+        log.info("dropped %d stale reference clip(s) from %s", pruned, ref_dir)
 
     @asynccontextmanager
     async def lifespan(app: FastAPI):