diff --git a/.env.example b/.env.example
index 9ec6ae8..eacb068 100644
--- a/.env.example
+++ b/.env.example
@@ -6,9 +6,9 @@ POSTGRES_DB=prode_db
 # JWT - CAMBIAR en producción
 JWT_SECRET=un_secret_muy_largo_y_seguro_aqui
 
-# URL del sitio externo de resultados (se configura cuando esté disponible)
-RESULTS_API_URL=
-RESULTS_API_KEY=
+# API de resultados (football-data.org)
+RESULTS_API_URL=https://api.football-data.org/v4/competitions/WC/matches
+RESULTS_API_KEY=tu_token_de_football_data_org_aqui
 
-# Secret para proteger el endpoint de sync
+# Secret para proteger el endpoint de sync (cron)
 ADMIN_SYNC_SECRET=sync_secret_cambialo
diff --git a/app/src/app/admin/page.tsx b/app/src/app/admin/page.tsx
index 3faceba..2b8517f 100644
--- a/app/src/app/admin/page.tsx
+++ b/app/src/app/admin/page.tsx
@@ -56,7 +56,7 @@ export default function AdminPage() {
           <button
             onClick={async () => {
               setSyncing(true)
-              await fetch(`/api/admin/sync?secret=${process.env.NEXT_PUBLIC_SYNC_SECRET ?? ''}`, { method: 'POST' })
+              await fetch('/api/admin/sync', { method: 'POST' })
               setSyncing(false)
             }}
             className="bg-blue-600 text-white text-xs font-bold px-3 py-1.5 rounded-full disabled:opacity-60"
diff --git a/app/src/app/api/admin/sync/route.ts b/app/src/app/api/admin/sync/route.ts
index 0577d2d..0cd8e21 100644
--- a/app/src/app/api/admin/sync/route.ts
+++ b/app/src/app/api/admin/sync/route.ts
@@ -29,8 +29,13 @@ export async function POST(req: Request) {
   const { searchParams } = new URL(req.url)
   const secret = searchParams.get('secret')
 
+  // Acepta secret (para cron) o sesión de admin (para el panel)
   if (secret !== process.env.ADMIN_SYNC_SECRET) {
-    return NextResponse.json({ error: 'No autorizado' }, { status: 401 })
+    const { getSession } = await import('@/lib/auth')
+    const session = await getSession()
+    if (!session || session.role !== 'ADMIN') {
+      return NextResponse.json({ error: 'No autorizado' }, { status: 401 })
+    }
   }
 
   const apiUrl = process.env.RESULTS_API_URL
diff --git a/sync-cron.sh b/sync-cron.sh
new file mode 100644
index 0000000..b49deb2
--- /dev/null
+++ b/sync-cron.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# Cron: */5 * * * * /ruta/a/sync-cron.sh >> /var/log/prode-sync.log 2>&1
+curl -s -X POST "https://prode.beldo.duckdns.org/api/admin/sync?secret=${ADMIN_SYNC_SECRET}" \
+  -o /dev/null -w "%{http_code}" \
+  && echo " [$(date '+%Y-%m-%d %H:%M')] sync ok" \
+  || echo " [$(date '+%Y-%m-%d %H:%M')] sync error"