diff --git a/src/core/auth/ApiKeyAuthFactory.ts b/src/core/auth/ApiKeyAuthFactory.ts
index 6f8e2605..719fad00 100644
--- a/src/core/auth/ApiKeyAuthFactory.ts
+++ b/src/core/auth/ApiKeyAuthFactory.ts
@@ -13,6 +13,20 @@ export function ApiKeyAuthFactory(
 ): IApiKeyAuth {
   const apiKey = config.getApiKey();
   if (!apiKey) {
+    setTimeout(() => {
+      logger.warn('🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫');
+      logger.warn('WARNING: No API key detected. This is a security risk.');
+      logger.warn(
+        'Your API is publicly accessible without any authentication.',
+      );
+      logger.warn(
+        'To secure your API, set environment variable: WAHA_API_KEY=your_api_key',
+      );
+      logger.warn(
+        'For better security, use WAHA_API_KEY=sha512:{SHA512_HASH_FOR_YOUR_API_KEY}',
+      );
+      logger.warn('🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫');
+    }, 3000);
     return new NoAuth();
   }