diff --git a/app.py b/app.py
index a424d5e..477554a 100644
--- a/app.py
+++ b/app.py
@@ -1860,7 +1860,6 @@ def api_me():
         }
     )
 
-
 @app.route("/api/register", methods=["POST"])
 def register():
     limited = rate_limited("register")
@@ -1875,6 +1874,10 @@ def register():
     except ValueError as error:
         return jsonify({"error": str(error)}), 400
 
+    access_key = data.get("access_key", "")
+    if not PRIVATE_ACCESS_KEY or not isinstance(access_key, str) or access_key.strip() != PRIVATE_ACCESS_KEY:
+        return jsonify({"error": "Invalid private access key."}), 403
+
     username = normalize_username(data.get("username"))
     password = data.get("password", "")
 
@@ -1917,12 +1920,13 @@ def register():
         INSERT OR IGNORE INTO user_profiles (
             user_id,
             display_name,
+            badge_text,
             bio,
             bio_mode,
             website,
             location,
             updated_at
-        ) VALUES (?, ?, '', 'txt', '', '', ?)
+        ) VALUES (?, ?, '', '', 'txt', '', '', ?)
         """,
         (user["id"], username, now_iso()),
     )
@@ -1952,7 +1956,6 @@ def register():
         }
     ), 201
 
-
 @app.route("/api/login", methods=["POST"])
 def login():
     limited = rate_limited("login")
@@ -1967,6 +1970,10 @@ def login():
     except ValueError as error:
         return jsonify({"error": str(error)}), 400
 
+    access_key = data.get("access_key", "")
+    if not PRIVATE_ACCESS_KEY or not isinstance(access_key, str) or access_key.strip() != PRIVATE_ACCESS_KEY:
+        return jsonify({"error": "Invalid private access key."}), 403
+
     username = normalize_username(data.get("username"))
     password = data.get("password", "")
 
@@ -2004,7 +2011,6 @@ def login():
         }
     )
 
-
 @app.route("/api/logout", methods=["POST"])
 def logout():
     if not csrf_valid():