diff --git a/cli/src/routes.rs b/cli/src/routes.rs
index b5e5172..31aac8f 100644
--- a/cli/src/routes.rs
+++ b/cli/src/routes.rs
@@ -138,22 +138,32 @@ fn check_auth(req: &HttpRequest, state: &State) -> Result<Option<String>, actix_
         return Ok(None);
     }
 
-    let key = if let Some(value) = req.headers().get("Authorization") {
-        let value = value.to_str().map_err(|err| {
-            ErrorBadRequest(format!("Invalid value in Authorization header: {err:?}"))
-        })?;
-        if !value.starts_with("Bearer ") {
-            return Err(ErrorUnauthorized("Invalid token type."));
-        }
-        Some(value.trim_start_matches("Bearer ").to_string())
-    } else if let Ok(cookies) = req.cookies() {
+    let header_key = req.headers().get("Authorization").and_then(|value| {
+        value.to_str().ok().and_then(|value| {
+            if value.starts_with("Bearer ") {
+                Some(value.trim_start_matches("Bearer ").to_string())
+            } else {
+                None
+            }
+        })
+    });
+
+    let cookie_key = req.cookies().ok().and_then(|cookies| {
         cookies
             .iter()
             .find(|c| c.name() == "key")
             .map(|cookie| cookie.value().to_string())
-    } else {
-        None
-    };
+    });
+
+    let query_key = req.query_string().split('&').find_map(|pair| {
+        let parts = pair.split('=').collect::<Vec<&str>>();
+        match parts[..] {
+            ["auth_key", value] => Some(value.to_string()),
+            _ => None,
+        }
+    });
+
+    let key = header_key.or(cookie_key).or(query_key);
 
     if let Some(key) = key {
         let token = jsonwebtoken::decode::<JwtClaims>(