diff --git a/public/js/api.js b/public/js/api.js
index 78d5321..1cfce87 100644
--- a/public/js/api.js
+++ b/public/js/api.js
@@ -42,14 +42,16 @@ const Store = {
 
 async function api(path, opts = {}) {
   opts.headers = opts.headers || {};
-  if (Store.access && !opts.headers.Authorization) {
+  // для GET используем cookie (без CORS preflight), для мутаций — Authorization
+  const isGet = !opts.method || opts.method === 'GET' || opts.method === 'HEAD';
+  if (Store.access && !opts.headers.Authorization && !isGet) {
     opts.headers.Authorization = `Bearer ${Store.access}`;
   }
   if (opts.body && typeof opts.body === 'object' && !(opts.body instanceof FormData)) {
     opts.headers['Content-Type'] = 'application/json';
     opts.body = JSON.stringify(opts.body);
   }
-  let r = await fetch(API_BASE + path, opts);
+  let r = await fetch(API_BASE + path, { ...opts, credentials: 'include' });
   if (r.status === 401 && Store.refresh) {
     // refresh
     const r2 = await fetch(API_BASE + '/api/v1/auth/refresh', {