authMemberByUuid = async function authMemberByUuid(req, res, next) {
    try {
        const uuid = req.query.uuid;
        if (!uuid) {
            if (res.locals.member && req.member) {
                // Already authenticated via session
                return next();
            }

            throw new errors.UnauthorizedError({
                message: tpl(messages.missingUuid)
            });
        }

        const key = req.query.key;
        if (!key) {
            throw new errors.UnauthorizedError({
                message: tpl(messages.invalidKey)
            });
        }

        // the request key is a hashed value from the member uuid and the members validation key so we can verify the source
        //  (only Ghost should be able to generate the key)
        const memberHmac = crypto.createHmac('sha256', settingsHelpers.getMembersValidationKey()).update(uuid).digest('hex');
        if (memberHmac !== key) {
            throw new errors.UnauthorizedError({
                message: tpl(messages.invalidKey)
            });
        }

        const member = await membersService.api.memberBREADService.read({uuid});
        if (!member) {
            throw new errors.UnauthorizedError({
                message: tpl(messages.invalidUuid)
            });
        }
        Object.assign(req, {member});
        res.locals.member = req.member;
        next();
    } catch (err) {
        next(err);
    }
}
Require member authentication, and make it possible to authenticate via uuid + hashed key.
You can chain this after loadMemberSession to make it possible to authenticate via both the uuid and the session.