Great question! The metrics plug that comes with PromEx has no authorization configuration available since I have another library that I maintain that deals with things like that. I will probably pull in authorization into the builtin plug since it is a common request in the near future. But for now I recommend people use Unplug which can unhook plugs from your plug pipeline.
PromEx is currently capturing metrics for The Changelog and you can look at how they secure the metrics endpoint using Unplug:
https://github.com/thechangelog/changelog.com/blob/master/lib/changelog_web/endpoint.ex#L53-L55
https://github.com/thechangelog/changelog.com/blob/master/lib/changelog_web/plugs/metrics_predicate.ex
