token image , api key header

middleware/apiKey.js

@@ -1,11 +1,10 @@
 /**
  * API Key middleware
- * Validates the api_key query parameter against process.env.API_KEY
- * Spec: GET /api/verify-degree/{id}?api_key={API_KEY}
+ * Reads key from X-API-Key header (preferred) or ?api_key= query param (fallback)
  */
 
 function validateApiKey(req, res, next) {
-  const apiKey = req.query.api_key;
+  const apiKey = req.headers['x-api-key'] || req.query.api_key;
 
   if (!apiKey || apiKey !== process.env.API_KEY) {
     return res.status(401).json({ error: 'Unauthorized - Invalid API key' });