Index: docs/importing_data.rst
===================================================================
--- docs/importing_data.rst
+++ docs/importing_data.rst
@@ -23,6 +23,9 @@
     lnt importreport --machine=my-machine-name --order=1234 --testsuite=nts results.txt report.json
     lnt submit http://mylnt.com/db_default/submitRun report.json
 
+LNT server can request authentization when ``secret_key`` is set in LNT config file.
+Auth token can be set via ``--secret-key=mykey`` option.
+
 .. _json_format:
 
 LNT Report File Format
Index: lnt/lnttool/common.py
===================================================================
--- lnt/lnttool/common.py
+++ lnt/lnttool/common.py
@@ -12,6 +12,9 @@
     func = click.option("--merge", default="replace", show_default=True,
                         type=click.Choice(['reject', 'replace', 'append']),
                         help="Merge strategy when run already exists")(func)
+    func = click.option("--secret-key",
+                        help="Secret key of the LNT server if secret_key is " \
+                                "set in LNT config")(func)
     return func
 
 
Index: lnt/lnttool/main.py
===================================================================
--- lnt/lnttool/main.py
+++ lnt/lnttool/main.py
@@ -182,14 +182,14 @@
 @submit_options
 @click.option("--verbose", "-v", is_flag=True,
               help="show verbose test results")
-def action_submit(url, files, select_machine, merge, verbose):
+def action_submit(url, files, select_machine, merge, secret_key, verbose):
     """submit a test report to the server"""
     from lnt.util import ServerUtil
     import lnt.util.ImportData
 
     results = ServerUtil.submitFiles(url, files, verbose,
                                      select_machine=select_machine,
-                                     merge_run=merge)
+                                     merge_run=merge, secret_key=secret_key)
     for submitted_file in results:
         if verbose:
             lnt.util.ImportData.print_report_result(
Index: lnt/server/ui/views.py
===================================================================
--- lnt/server/ui/views.py
+++ lnt/server/ui/views.py
@@ -102,6 +102,13 @@
 # Database Actions
 def _do_submit():
     assert request.method == 'POST'
+
+    token = request.headers.get("AuthToken", None)
+    if current_app.old_config.secretKey \
+            and token != current_app.old_config.secretKey:
+                abort(401, "Auth Token must be passed in AuthToken header, "
+                        "and must match secret_key in LNT config.")
+
     input_file = request.files.get('file')
     input_data = request.form.get('input_data')
     if 'select_machine' not in request.form and \
Index: lnt/util/ServerUtil.py
===================================================================
--- lnt/util/ServerUtil.py
+++ lnt/util/ServerUtil.py
@@ -29,7 +29,8 @@
         sys.stderr.write(message + '\n')
 
 
-def submitFileToServer(url, file, select_machine=None, merge_run=None):
+def submitFileToServer(url, file, select_machine=None, merge_run=None,
+        secret_key=None):
     with open(file, 'rb') as f:
         values = {
             'input_data': f.read(),
@@ -40,6 +41,8 @@
         if merge_run is not None:
             values['merge'] = merge_run
     headers = {'Accept': 'application/json'}
+    if secret_key:
+        headers['AuthToken'] = secret_key
     data = urllib.urlencode(values)
     try:
         response = urllib2.urlopen(urllib2.Request(url, data, headers=headers))
@@ -82,20 +85,23 @@
             select_machine=select_machine, merge_run=merge_run)
 
 
-def submitFile(url, file, verbose, select_machine=None, merge_run=None):
+def submitFile(url, file, verbose, select_machine=None, merge_run=None,
+        secret_key=None):
     # If this is a real url, submit it using urllib.
     if '://' in url:
-        result = submitFileToServer(url, file, select_machine, merge_run)
+        result = submitFileToServer(url, file, select_machine, merge_run,
+                secret_key)
     else:
         result = submitFileToInstance(url, file, select_machine, merge_run)
     return result
 
 
-def submitFiles(url, files, verbose, select_machine=None, merge_run=None):
+def submitFiles(url, files, verbose, select_machine=None, merge_run=None,
+        secret_key=None):
     results = []
     for file in files:
         result = submitFile(url, file, verbose, select_machine=select_machine,
-                            merge_run=merge_run)
+                            merge_run=merge_run, secret_key=secret_key)
         if result:
             results.append(result)
     return results