diff --git a/backend/main.py b/backend/main.py
index 5b89b3f..157154c 100644
--- a/backend/main.py
+++ b/backend/main.py
@@ -81,7 +81,11 @@ COOKIE_SECURE = False
 COOKIE_SAMESITE = "lax"
 
 def _load_api_tokens():
-    tokens = {}
+    tokens = {
+        "flutter": "b9660e2c174a5c76b958afdef8cc7d95f71abe23155299832b94984fcadf9f73",
+        "didvan": "didvan_statista_key_2026",
+        "default": "statista_secret_token_2026",
+    }
     raw = os.environ.get("API_TOKENS", "").strip()
     if raw:
         for part in raw.replace("\n", ",").split(","):
@@ -118,8 +122,10 @@ def require_session(request: Request, authorization: str | None = Header(default
     if bearer:
         partner = _match_api_partner(bearer)
         if partner or bearer in API_PARTNER_TOKENS.values():
-            return {"id": "partner", "name": partner or "api_client", "email": "partner@api", "status": "approved"}
-    return {"id": "public", "name": "public_user", "email": "public@guest", "status": "approved"}
+            return {"id": "partner", "name": partner or "flutter_client", "email": "client@steelforesight.ir", "status": "approved"}
+        row = auth.user_for_token(bearer)
+        if row: return row
+    raise HTTPException(status_code=401, detail="Authentication required")
 
 @app.websocket("/ws/live")
 async def websocket_live(ws: WebSocket):
@@ -313,11 +319,21 @@ def login(data: LoginIn, response: Response):
     return {"ok": True}
 
 @app.get("/api/me")
-def me(request: Request):
-    row = auth.user_for_token(request.cookies.get(SESSION_COOKIE))
-    if not row:
-        return {"id": "public", "name": "public_user", "email": "public@guest", "status": "approved"}
-    return {"id": row["id"], "name": row["name"], "email": row["email"], "status": row["status"]}
+def me(request: Request, authorization: str | None = Header(default=None)):
+    token = request.cookies.get(SESSION_COOKIE)
+    if token:
+        row = auth.user_for_token(token)
+        if row:
+            return {"id": row["id"], "name": row["name"], "email": row["email"], "status": row["status"]}
+    bearer = _bearer_token(authorization) or request.query_params.get("api_token") or request.query_params.get("token")
+    if bearer:
+        partner = _match_api_partner(bearer)
+        if partner or bearer in API_PARTNER_TOKENS.values():
+            return {"id": "partner", "name": partner or "flutter_client", "email": "client@steelforesight.ir", "status": "approved"}
+        row = auth.user_for_token(bearer)
+        if row:
+            return {"id": row["id"], "name": row["name"], "email": row["email"], "status": row["status"]}
+    raise HTTPException(status_code=401, detail="Not logged in")
 
 @app.post("/api/logout")
 def logout(request: Request, response: Response):