diff --git a/public/js/api.js b/public/js/api.js
index 95a1ac0..ab10d6e 100644
--- a/public/js/api.js
+++ b/public/js/api.js
@@ -43,9 +43,16 @@ const Store = {
 async function api(path, opts = {}, _retry = 0) {
   // rebuild opts on every retry (body may be already stringified)
   const o = { ...opts, headers: { ...(opts.headers || {}) } };
-  if (Store.access && !o.headers.Authorization) {
+  // для GET — передаём токен через query (избегаем CORS preflight на Authorization)
+  // для POST/PUT/DELETE — оставляем в headers
+  const isGet = !o.method || o.method === 'GET' || o.method === 'HEAD';
+  if (Store.access && !o.headers.Authorization && !isGet) {
     o.headers.Authorization = `Bearer ${Store.access}`;
   }
+  if (Store.access && isGet) {
+    const sep = path.includes('?') ? '&' : '?';
+    path = path + sep + '_t=' + encodeURIComponent(Store.access);
+  }
   if (o.body && typeof o.body === 'object' && !(o.body instanceof FormData)) {
     o.headers['Content-Type'] = 'application/json';
     o.body = JSON.stringify(o.body);