Authentication

Every /api/* route requires a bearer token, checked against the API_TOKEN environment variable on the server:

Authorization: Bearer <API_TOKEN>

Requests without a valid token get a 401:

json

{ "error": "Unauthorized" }

The redirect route itself (GET /<slug>) is public and unauthenticated, since anyone clicking a short link needs to be able to reach it.