diff --git a/public/js/api.js b/public/js/api.js
index dca2f0b..68bc4cc 100644
--- a/public/js/api.js
+++ b/public/js/api.js
@@ -63,7 +63,8 @@ async function api(path, opts = {}, _retry = 0) {
   const tid = setTimeout(() => controller.abort(), 15000);
   const t0 = Date.now();
   try {
-    r = await fetch(API_BASE + path, { ...o, signal: controller.signal });
+    // credentials:'include' — браузер шлёт cookies (HttpOnly buhapp_at)
+    r = await fetch(API_BASE + path, { ...o, credentials: 'include', signal: controller.signal });
   } catch (networkErr) {
     clearTimeout(tid);
     const ms = Date.now() - t0;