diff --git a/app.py b/app.py
index 39965b0..1338b7e 100644
--- a/app.py
+++ b/app.py
@@ -1,25 +1,70 @@
-from flask import Flask, request, render_template, jsonify
+from flask import Flask, request, render_template, Response
 import os
+import base64
 
 app = Flask(__name__)
 
+USERNAME = "admin"
+PASSWORD = "changeme"
+
 KEYBOARD = "/dev/hidg0"
 MOUSE = "/dev/hidg1"
 
+# -------------------------
+# Authentication
+# -------------------------
+def check_auth(auth_header):
+    if not auth_header:
+        return False
+    try:
+        scheme, encoded = auth_header.split()
+        if scheme.lower() != "basic":
+            return False
+        decoded = base64.b64decode(encoded).decode()
+        user, pw = decoded.split(":", 1)
+        return user == USERNAME and pw == PASSWORD
+    except:
+        return False
+
+def require_auth():
+    return Response(
+        "Authentication required",
+        401,
+        {"WWW-Authenticate": 'Basic realm="Pi Zero HID"'}
+    )
+
+@app.before_request
+def before_request():
+    if request.path.startswith("/static"):
+        return
+    auth = request.headers.get("Authorization")
+    if not check_auth(auth):
+        return require_auth()
+
+# -------------------------
+# HID functions
+# -------------------------
 def send_keyboard(code):
-    # 8-byte HID keyboard report: [mod, 0, key, 0, 0, 0, 0, 0]
     report = bytes([0, 0, code, 0, 0, 0, 0, 0])
     release = bytes([0] * 8)
     with open(KEYBOARD, "wb") as f:
         f.write(report)
         f.write(release)
 
-def send_mouse(dx, dy, buttons):
+def send_mouse(dx, dy, buttons, wheel):
     # 4-byte HID mouse report: [buttons, dx, dy, wheel]
-    report = bytes([buttons & 0x07, dx & 0xFF, dy & 0xFF, 0])
+    report = bytes([
+        buttons & 0x07,
+        dx & 0xFF,
+        dy & 0xFF,
+        wheel & 0xFF
+    ])
     with open(MOUSE, "wb") as f:
         f.write(report)
 
+# -------------------------
+# Routes
+# -------------------------
 @app.route("/")
 def index():
     return render_template("index.html")
@@ -35,7 +80,8 @@ def mouse():
     dx = int(request.form.get("dx", 0))
     dy = int(request.form.get("dy", 0))
     buttons = int(request.form.get("buttons", 0))
-    send_mouse(dx, dy, buttons)
+    wheel = int(request.form.get("wheel", 0))
+    send_mouse(dx, dy, buttons, wheel)
     return "OK"
 
 if __name__ == "__main__":