token image , api key header

controllers/qualificationController.js

@@ -4,6 +4,7 @@ const Department = require('../models/department');
 const Level = require('../models/level');
 const writeAuditLog = require('../audit/writeAuditLog');
 const AUDIT_ACTIONS = require('../constants/auditAction');
+const { generateSignedUrl } = require('../utils/signedUrl');
 
 function normalizePath(filePath) {
   if (!filePath) return undefined;
@@ -141,7 +142,7 @@ exports.apiVerify = async (req, res) => {
     if (qual.status === 'revoked') return res.status(404).json({ error: 'Degree has been revoked' });
 
     const baseUrl = `${req.protocol}://${req.get('host')}`;
-    const buildUrl = (f) => f ? [`${baseUrl}/secure-files/${path.basename(f)}?api_key=${req.query.api_key}`] : undefined;
+    const buildUrl = (f) => f ? [generateSignedUrl(baseUrl, path.basename(f))] : undefined;
 
     const response = {
       full_name: qual.student_name,