diff --git a/packages/content-fetch/app.js b/packages/content-fetch/app.js
index c0b6b5bf6..60f3031c5 100644
--- a/packages/content-fetch/app.js
+++ b/packages/content-fetch/app.js
@@ -1,5 +1,3 @@
-
-
 const express = require('express');
 
 const app = express();
@@ -8,12 +6,25 @@ const fetchContent = require('./fetch-content');
 app.use(express.json());
 app.use(express.urlencoded({ extended: true }));
 
+if (!process.env.VERIFICATION_TOKEN) {
+  throw new Error('VERIFICATION_TOKEN environment variable is not set');
+}
 
 app.get('/', (req, res) => {
+  if (req.query.token !== process.env.VERIFICATION_TOKEN) {
+    console.log('query does not include valid token')
+    res.send(403)
+    return
+  }
   fetchContent(req, res)
 });
 
 app.post('/', (req, res) => {
+  if (req.query.token !== process.env.VERIFICATION_TOKEN) {
+    console.log('query does not include valid token')
+    res.send(403)
+    return
+  }
   fetchContent(req, res)
 });