<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Pass Authorization and custom headers to PHP
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
    RewriteRule .* - [E=HTTP_X_API_KEY:%{HTTP:X-API-KEY}]
    RewriteRule .* - [E=HTTP_X_ADMIN_TOKEN:%{HTTP:X-ADMIN-TOKEN}]

    # Do not rewrite real files or directories
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d

    # Route everything else to index.php
    RewriteRule ^(.*)$ index.php [QSA,L]
</IfModule>

<IfModule mod_headers.c>
    Header always set Access-Control-Allow-Origin "*"
    Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
    Header always set Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, X-API-KEY, X-ADMIN-TOKEN, Authorization"
</IfModule>

