# Forward the HTTP Authorization header to PHP.
# Many Apache/LiteSpeed + PHP-FCGI setups strip "Authorization" by default,
# which breaks Bearer-token auth used by the MCP SSE endpoint (api.php).

# Apache 2.4.13+ / most cPanel hosts
<IfModule mod_setenvif.c>
    SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
</IfModule>

# Fallback via mod_rewrite (sets REDIRECT_HTTP_AUTHORIZATION, which api.php also reads)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP:Authorization} ^(.+)$
    RewriteRule ^ - [E=HTTP_AUTHORIZATION:%1]
</IfModule>
