diff --git a/src/routes/index.js b/src/routes/index.js
index ef75988e..41ed6cf9 100644
--- a/src/routes/index.js
+++ b/src/routes/index.js
@@ -17,6 +17,7 @@ app.use(express.json());
 app.use(bodyParser.urlencoded({ extended: false }));
 app.use(fileUpload());
 
+// Add optional API key if set in .env file
 app.use(function (req, res, next) {
   if (process.env.API_KEY) {
     const apikey = req.header('x-api-key');
@@ -30,6 +31,15 @@ app.use(function (req, res, next) {
   }
 });
 
+// Add readonly header if set in .env file
+app.use(function (req, res, next) {
+  if (process.env.READ_ONLY) {
+    res.setHeader('cw-read-only', process.env.READ_ONLY);
+  }
+
+  next();
+});
+
 app.use('/v1', V1Router);
 
 sequelize.authenticate().then(() => console.log('Connected to database'));