From 5a234f2f0decb88b4b99ffb561614ff1c45ea31b Mon Sep 17 00:00:00 2001
From: seo <seo@chaegeon.com>
Date: Fri, 30 Oct 2026 22:18:24 +0900
Subject: [PATCH] fix: accept vehicle API token via header

---
 api.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/api.php b/api.php
index 390d1cf..bf99d09 100644
--- a/api.php
+++ b/api.php
@@ -18,7 +18,10 @@ if (!in_array($clientIp, ALLOWED_IPS, true)) {
 }
 
 $params = ($requestMethod === 'POST') ? $_POST : $_GET;
-$token = $params['token'] ?? '';
+$headerToken = $_SERVER['HTTP_X_CAR_TOKEN'] ?? '';
+$token = is_string($headerToken) && $headerToken !== ''
+    ? $headerToken
+    : ($params['token'] ?? '');
 
 if (!hash_equals(AUTH_TOKEN, $token)) {
     json_exit([