How can I authorize users on my OpenAI route so that not everyone can call the API? When I worked with getserversesseion I got the message that the crypto library was not found.

api/completion/route.ts

import { createOpenAI } from "@ai-sdk/openai";
import { Ratelimit } from "@upstash/ratelimit";
import { Redis } from "@upstash/redis";
import { streamText } from "ai";
import { NextResponse } from "next/server";
import { env } from "process";

const ratelimit = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(1, "0 s"),
});

export const runtime = "edge";

const openai = createOpenAI({
  apiKey: env.OPEN_AI_API_KEY,
});

export async function POST(req: Request) {
  const ip = req.headers.get("x-forwarded-for") ?? "";
  const { success, reset } = await ratelimit.limit(ip);

  const { prompt }: { prompt: string } = (await req.json()) as {
    prompt: string;
  };

  if (!success) {
    console.log("Rate limited");
    const now = Date.now();
    const retryAfter = Math.floor((reset - now) / 1000);
    return new NextResponse(
      "Du hast zu viele Anfragen gestellt, KI Anfragen sind alle 60 Sekunden möglich.",
      {
        status: 420,
        headers: {
          ["retry-after"]: `${retryAfter}`,
        },
      },
    );
  }

  const result = await streamText({
    model: openai("gpt-4o"),
    system: "You are a helpful assistant.",
    prompt,
  });

  return result.toDataStreamResponse();
}

This is my route – works well bot not really secure – I think.

Calling the endpoint with vercels AI Sdk

 const { completion, complete, error } = useCompletion({
    api: "/api/completion",
  });

  return (
    <Card>
      <CardHeader>
        <Button onClick={async () => await complete("test")}>test</Button>
        {completion}

How can I protect this endpoint? Or is there a better way to integrate this?