diff --git a/apps/api/src/controllers/v0/admin/validate-api-key.ts b/apps/api/src/controllers/v0/admin/validate-api-key.ts
index 709337876..83d08cc69 100644
--- a/apps/api/src/controllers/v0/admin/validate-api-key.ts
+++ b/apps/api/src/controllers/v0/admin/validate-api-key.ts
@@ -3,6 +3,7 @@ import { Request, Response } from "express";
 import { supabase_service } from "../../../services/supabase";
 import crypto from "crypto";
 import { z } from "zod";
+import { validate as isUuid } from "uuid";
 
 export async function integValidateApiKeyController(
   req: Request,
@@ -54,6 +55,10 @@ export async function integValidateApiKeyController(
 
     const normalizedApiKey = body.apiKey.replace(/^fc-/, "");
 
+    if (!isUuid(normalizedApiKey)) {
+      return res.status(400).json({ error: "API key is invalid" });
+    }
+
     const { data: apiKeyData, error: apiKeyError } = await supabase_service
       .from("api_keys")
       .select("*")