diff --git a/src/controllers/StatsController.ts b/src/controllers/StatsController.ts
index ea402e5..f6d9a15 100644
--- a/src/controllers/StatsController.ts
+++ b/src/controllers/StatsController.ts
@@ -35,7 +35,7 @@ export class StatsController {
 
     @Get("/authorized")
     @UseBefore(StatsAuth)
-    @OpenAPI({ description: "A demo endpoint for authorized stats." })
+    @OpenAPI({ description: "A demo endpoint for authorized stats.", security: [{ "StatsApiToken": [] }] })
     async getAuthorized() {
         let connection = getConnection();
         let runners = await connection.getRepository(Runner).find({ relations: ["scans"] });
diff --git a/src/loaders/openapi.ts b/src/loaders/openapi.ts
index afe2165..5ab892c 100644
--- a/src/loaders/openapi.ts
+++ b/src/loaders/openapi.ts
@@ -35,6 +35,11 @@ export default async (app: Application) => {
             "in": "cookie",
             "name": "lfk_backend__refresh_token",
             description: "A cookie containing a JWT based refreh token. Attention: Doesn't work in swagger-ui. Use /api/auth/login or /api/auth/refresh to get one."
+          },
+          "StatsApiToken": {
+            "type": "http",
+            "scheme": "bearer",
+            description: "Api token that can be obtained by creating a new stats client (post to /api/statsclients)."
           }
         }
       },
diff --git a/src/openapi_export.ts b/src/openapi_export.ts
index d5465a7..e6f2a3c 100644
--- a/src/openapi_export.ts
+++ b/src/openapi_export.ts
@@ -44,6 +44,11 @@ const spec = routingControllersToSpec(
                     "in": "cookie",
                     "name": "lfk_backend__refresh_token",
                     description: "A cookie containing a JWT based refreh token. Attention: Doesn't work in swagger-ui. Use /api/auth/login or /api/auth/refresh to get one."
+                },
+                "StatsApiToken": {
+                    "type": "http",
+                    "scheme": "bearer",
+                    description: "Api token that can be obtained by creating a new stats client (post to /api/statsclients)."
                 }
             }
         },