diff --git a/.gitea/workflows/build-apk.yaml b/.gitea/workflows/build-apk.yaml
new file mode 100644
index 00000000..6f21db3c
--- /dev/null
+++ b/.gitea/workflows/build-apk.yaml
@@ -0,0 +1,72 @@
+name: Build & Release Android APK
+
+on:
+  push:
+    tags:
+      - 'v*'
+      - 'V*' # Se déclenche quand vous poussez un tag comme v1.0.0, v1.0.1...
+  workflow_dispatch: # Permet aussi de lancer la compilation manuellement depuis l'interface Gitea
+
+jobs:
+  build-apk:
+    # Utilise votre runner hôte avec Docker
+    runs-on: docker
+    steps:
+      - name: 📥 Récupération du code
+        run: |
+          echo "📥 Clonage du code source..."
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git clone --depth 1 "https://${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}@git.kevlar.cloud/${{ github.repository }}.git" .
+
+      - name: 🔨 Compilation de l'APK (Conteneur Flutter / Android SDK)
+        run: |
+          echo "🚀 Démarrage de la compilation Flutter dans Docker..."
+          # Conteneur officiel CirrusLabs (Flutter stable + Android SDK préinstallés)
+          docker run --rm \
+            -v "$PWD":/workspace \
+            -w /workspace \
+            ghcr.io/cirruslabs/flutter:stable \
+            sh -c "flutter pub get && flutter build apk --release"
+          
+          echo "✅ APK généré avec succès dans build/app/outputs/flutter-apk/app-release.apk"
+
+      - name: 📦 Publication de la Release sur Gitea & Upload de l'APK
+        run: |
+          TAG_NAME="${{ github.ref_name }}"
+          if [ -z "$TAG_NAME" ] || [ "$TAG_NAME" = "main" ]; then
+            TAG_NAME="build-$(date +'%Y%m%d-%H%M%S')"
+          fi
+          
+          APK_PATH="build/app/outputs/flutter-apk/app-release.apk"
+          APK_NAME="bully-impact-${TAG_NAME}.apk"
+
+          echo "🚀 Création de la release $TAG_NAME sur Gitea..."
+          
+          # 1. Création de la Release via l'API REST de Gitea
+          RELEASE_RESPONSE=$(curl -s -X POST "https://git.kevlar.cloud/api/v1/repos/${{ github.repository }}/releases" \
+            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{
+              \"tag_name\": \"${TAG_NAME}\",
+              \"name\": \"Version ${TAG_NAME}\",
+              \"body\": \"Nouvelle version de l'application Bully Impact générée automatiquement par CI/CD.\",
+              \"draft\": false,
+              \"prerelease\": false
+            }")
+
+          RELEASE_ID=$(echo "$RELEASE_RESPONSE" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
+
+          if [ -z "$RELEASE_ID" ]; then
+            echo "❌ Erreur lors de la création de la release: $RELEASE_RESPONSE"
+            exit 1
+          fi
+
+          echo "📦 Upload du fichier APK (Release ID: $RELEASE_ID)..."
+
+          # 2. Upload de l'APK en tant qu'asset téléchargeable
+          curl -s -X POST "https://git.kevlar.cloud/api/v1/repos/${{ github.repository }}/releases/${RELEASE_ID}/assets?name=${APK_NAME}" \
+            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+            -H "Content-Type: application/vnd.android.package-archive" \
+            --data-binary @"$APK_PATH"
+
+          echo "🎉 Release terminée avec succès ! APK téléchargeable sur Gitea."
diff --git a/lib/features/settings/settings_screen.dart b/lib/features/settings/settings_screen.dart
index bbe3c9f4..2f840ac3 100644
--- a/lib/features/settings/settings_screen.dart
+++ b/lib/features/settings/settings_screen.dart
@@ -59,7 +59,10 @@ class _SettingsScreenState extends State<SettingsScreen> {
       final walletHash = sha256.convert(phraseBytes).toString();
       final baseUrl = await _walletService.getServerBaseUrl();
           
-      final response = await http.get(Uri.parse('$baseUrl/api/stats/$walletHash')).timeout(
+      final response = await http.get(
+        Uri.parse('$baseUrl/api/stats/$walletHash'),
+        headers: {'X-API-KEY': WalletIdentityService.apiKey},
+      ).timeout(
         const Duration(seconds: 4),
       );
       
diff --git a/lib/services/ai_export_service.dart b/lib/services/ai_export_service.dart
index dff65bd1..c16929d4 100644
--- a/lib/services/ai_export_service.dart
+++ b/lib/services/ai_export_service.dart
@@ -109,6 +109,7 @@ class AiExportService {
       final effectiveUrl = apiUrl ?? '$baseUrl/api/upload';
       final url = Uri.parse(effectiveUrl);
       final request = http.MultipartRequest('POST', url);
+      request.headers['X-API-KEY'] = WalletIdentityService.apiKey;
 
       // 1. Prepare image
       final file = File(imagePath);
diff --git a/lib/services/wallet_identity_service.dart b/lib/services/wallet_identity_service.dart
index 0b6b3ab3..bbe84950 100644
--- a/lib/services/wallet_identity_service.dart
+++ b/lib/services/wallet_identity_service.dart
@@ -47,6 +47,9 @@ class WalletIdentityService {
   /// URL par défaut du serveur de production
   static const String defaultServerUrl = 'https://backendia.kevlar.cloud';
 
+  /// Clé d'authentification API secrète pour le backend
+  static const String apiKey = 'bully_secret_api_key_2026_x89';
+
   /// Retourne l'URL de base du serveur configuré (par défaut: https://backendia.kevlar.cloud)
   Future<String> getServerBaseUrl() async {
     final prefs = await SharedPreferences.getInstance();
@@ -115,7 +118,10 @@ class WalletIdentityService {
       final walletHash = sha256.convert(phraseBytes).toString();
       final baseUrl = await getServerBaseUrl();
       
-      final res = await http.get(Uri.parse('$baseUrl/api/stats/$walletHash')).timeout(
+      final res = await http.get(
+        Uri.parse('$baseUrl/api/stats/$walletHash'),
+        headers: {'X-API-KEY': apiKey},
+      ).timeout(
         const Duration(seconds: 4),
       );
       if (res.statusCode == 200) {