diff --git a/api.php b/api.php
index 390d1cf..bf99d09 100644
--- a/api.php
+++ b/api.php
@@ -18,7 +18,10 @@ if (!in_array($clientIp, ALLOWED_IPS, true)) {
 }
 
 $params = ($requestMethod === 'POST') ? $_POST : $_GET;
-$token = $params['token'] ?? '';
+$headerToken = $_SERVER['HTTP_X_CAR_TOKEN'] ?? '';
+$token = is_string($headerToken) && $headerToken !== ''
+    ? $headerToken
+    : ($params['token'] ?? '');
 
 if (!hash_equals(AUTH_TOKEN, $token)) {
     json_exit([