<?php

$apiToken = '2fce';

$headers = getallheaders();
$authHeader = $headers['Authorization'] ?? '';

if (!preg_match('/Bearer\s(\S+)/', $authHeader, $matches) || $apiToken !== $matches[1])  {

   // ❌ Unauthorized
   http_response_code(401);
   header('Content-Type: application/json');
   echo json_encode(['error' => 'Unauthorized']);
   exit;

}