diff --git a/app/Core/Request.php b/app/Core/Request.php
index 35d6f91..6c65884 100644
--- a/app/Core/Request.php
+++ b/app/Core/Request.php
@@ -19,14 +19,8 @@ final class Request
     {
         $this->method = $_SERVER['REQUEST_METHOD'];
         
-        // Normalize path: extract /api/v1/... portion from any subdirectory structure
-        $rawPath = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
-        $apiPos = strpos($rawPath, '/api/v1/');
-        if ($apiPos !== false) {
-            $this->path = substr($rawPath, $apiPos); // e.g. /api/v1/auth/login
-        } else {
-            $this->path = $rawPath;
-        }
+        // Read API path from query string: index.php?route=/api/v1/auth/login
+        $this->path = $_GET['route'] ?? parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
         $this->headers = getallheaders();
         $this->queryParams = $_GET;
         $this->files = $_FILES;
diff --git a/public/index.php b/public/index.php
index 2747686..2789654 100644
--- a/public/index.php
+++ b/public/index.php
@@ -64,11 +64,11 @@ $router->addRoute('GET', '/api/v1/health', function($request) {
     ]);
 });
 
-// ══ SPA Shell ═══════════════════════════════════════════════
-$fullPath = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
+// ══ Determine if this is an API request ═════════════════════════════
+$apiRoute = $_GET['route'] ?? null;
 
-// Check if this is an API request (works regardless of subdirectory)
-if (!str_contains($fullPath, '/api/v1/')) {
+if (!$apiRoute) {
+    // Not an API call — serve the SPA shell
     include __DIR__ . '/shell.php';
     exit;
 }
diff --git a/public/shell.php b/public/shell.php
index f23781d..d4cbd03 100644
--- a/public/shell.php
+++ b/public/shell.php
@@ -76,7 +76,7 @@
         // مُصادَق — API Client (Inlined for reliability)
         // ══════════════════════════════════════════════════════════
         const API = {
-            baseUrl: 'index.php/api/v1', // Correct entry point and prefix
+            baseUrl: 'index.php?route=/api/v1',
             accessToken: localStorage.getItem('access_token'),
             async post(path, body) {
                 const headers = { 'Accept': 'application/json', 'Content-Type': 'application/json' };