getHeaderLine('AUTHORIZATION'); if(empty($authHeader)) { $authHeader = $_SERVER['REDIRECT_HTTP_AUTHORIZATION']; } // $requestHeaders = getallheaders(); // // $authHeader = $_SERVER['REDIRECT_HTTP_AUTHORIZATION']; // // $authHeader = $_SERVER['Authorization']; // print_r($authHeader); // print_r($_SERVER);die(); if (empty($authHeader)) { return service('response')->setJSON([ 'success' => false, 'error' => 'Authorization header missing' ])->setStatusCode(403); } // Expected format: Bearer YOUR_API_KEY if (stripos($authHeader, 'Bearer ') !== 0) { return service('response')->setJSON([ 'success' => false, 'error' => 'Invalid Authorization format. Expected: Bearer ' ])->setStatusCode(403); } $apiKey = trim(substr($authHeader, 7)); // extract token after 'Bearer ' $envKeys = getenv('ALLOWED_COMMISSION_API_KEYS'); // Convert CSV -> Array $allowedKeys = array_map('trim', explode(',', $envKeys)); // print_r($allowedKeys);die(); // Validate if (!in_array($apiKey, $allowedKeys, true)) { return service('response')->setJSON([ 'success' => false, 'error' => 'Invalid API Key' ])->setStatusCode(403); } // Allow request to proceed return null; } public function after(RequestInterface $request, ResponseInterface $response, $arguments = null) { // Not needed } }