Controller/Agent Authentication

I need to protect any API I have in our network and it seems the agent does not provide any authentication currently.

Is there any mechanisms to make the agent API not publicly available? If not, I am imagining something like the following:
`crank-agent --api-key MYAPIKEY`
`crank --myjob.options.apiKey MYAPIKEY`

It could also be something fancier like JWT but having a proper OAuth/OIDC identity server may be too much for many users.