This is also the first thought I had. I checked, the obs-websocket plugin allows to set a password:

> It is highly recommended to protect obs-websocket with a password against unauthorized control. To do this, open the "Websocket server settings" dialog under OBS' "Tools" menu. In the settings dialogs, you can enable or disable authentication and set a password for it.

(from https://github.com/Palakis/obs-websocket).

That obs-websocket plugin seems to have some auth support. From their Readme:

> It is highly recommended to protect obs-websocket with a password against unauthorized control. To do this, open the "Websocket server settings" dialog under OBS' "Tools" menu. In the settings dialogs, you can enable or disable authentication and set a password for it.

You need to install the obs-websocket plugin first. You can set up a password there, and to expose the instance remotely you need a tunnel service like ngrok or pagekite.

looks like there's a password on the plugin it uses (it's optional though, and it resommends it specifically when putting the API online, which is probably slightly more secure)