Protecting my API

Hi guys,

Im trying to build a small API with Lumen, and I want to protect it so that people from the outside cannot access it's data. At a later stage I also want to authorize each user, but for now it's only the API itself.

I watched Jeffreys tutorial here: https://laracasts.com/series/whats-new-in-laravel-5-2/episodes/5, but this is only for the individual users of the application.

I tried to build my own version of this, but I want to know if there is a better way to do this? It works, but it feels kinda wrong :P

routes.php

// Im passing in the api_key with each request
$app->group(['prefix' => 'api/{api_key}'], function () use ($app) {
    $app->get('/programmes', [
        'as' => 'allProgrammes',
        'uses' => 'App\Http\Controllers\ProgrammesController@index'
    ]);
});

ProgrammesController.php

public function index($api_key) {
       // If the API key matches, return the values
     if($api_key == env('API_KEY')) {
            $programmes = ['Full Body', 'Two Split', 'Three Split'];

            return $programmes;
    // Otherwise abort the program
        } else {
            abort(401);
        }
    }