diff --git a/backend/config/db.php b/backend/config/db.php
index d185f8b..8ba9ea1 100644
--- a/backend/config/db.php
+++ b/backend/config/db.php
@@ -66,8 +66,10 @@ if (!$envLoaded) {
 
 // Security: API Key Validation
 $expectedApiKey = $_SERVER['API_KEY'] ?? (getenv('API_KEY') ?: ($_ENV['API_KEY'] ?? 'JORDAN_BOT_SECRET_2026'));
-$headers = getallheaders();
-$providedKey = $headers['X-API-Key'] ?? ($headers['x-api-key'] ?? null);
+
+// Safe header extraction for NGINX/PHP-FPM
+$headers = function_exists('getallheaders') ? getallheaders() : [];
+$providedKey = $headers['X-API-Key'] ?? ($headers['x-api-key'] ?? $_SERVER['HTTP_X_API_KEY'] ?? null);
 
 // Enhanced Debug Logging
 error_log("JordanBot API Check: Provided: [$providedKey], Expected: [$expectedApiKey], EnvLoaded: [" . ($envLoaded ? "YES" : "NO") . "]");