diff --git a/app/api/debug/whoami/route.ts b/app/api/debug/whoami/route.ts
new file mode 100644
index 00000000..72fb8970
--- /dev/null
+++ b/app/api/debug/whoami/route.ts
@@ -0,0 +1,14 @@
+// app/api/debug/whoami/route.ts
+import { NextResponse } from "next/server";
+import { dxGET } from "@/lib/directus";
+import { requireBearer } from "@/app/api/_lib/auth";
+
+export async function GET(req: Request) {
+    try {
+        const bearer = requireBearer(req);
+        const me = await dxGET<any>("/users/me?fields=id,username", bearer);
+        return NextResponse.json(me, { status: 200 });
+    } catch (e: any) {
+        return NextResponse.json({ error: e?.message || "err" }, { status: e?.status ?? 500 });
+    }
+}
diff --git a/app/api/dx/[...path]/route.ts b/app/api/dx/[...path]/route.ts
index ac842cbb..91530049 100644
--- a/app/api/dx/[...path]/route.ts
+++ b/app/api/dx/[...path]/route.ts
@@ -1,23 +1,27 @@
 // app/api/dx/[...path]/route.ts
 import { NextResponse } from "next/server";
+import { dxGET } from "@/lib/directus";
 import { requireBearer } from "@/app/api/_lib/auth";
 
-const BASE = (process.env.DIRECTUS_URL || "").replace(/\/$/, "");
+export const runtime = "nodejs";
 
-export async function GET(req: Request, { params }: { params: { path: string[] } }) {
-    const bearer = requireBearer(req);
-    const search = new URL(req.url).search || "";
-    const path = params.path.join("/");
-    const url = `${BASE}/${path}${search}`;
-
-    const res = await fetch(url, {
-        headers: { Accept: "application/json", Authorization: `Bearer ${bearer}` },
-        cache: "no-store",
-    });
-
-    const body = await res.text();
-    return new NextResponse(body, {
-        status: res.status,
-        headers: { "content-type": res.headers.get("content-type") || "application/json" },
-    });
+// GET /api/dx/<anything...>?<query>
+// Proxies to Directus using the user's ma_at, no caching.
+export async function GET(
+    req: Request,
+    { params }: { params: { path: string[] } }
+) {
+    try {
+        const bearer = requireBearer(req); // <-- pulls ma_at from Cookie
+        const search = new URL(req.url).search; // keep original query
+        const p = `/${(params.path || []).join("/")}${search || ""}`;
+        const json = await dxGET<any>(p, bearer);
+        return NextResponse.json(json, { status: 200 });
+    } catch (e: any) {
+        const status = e?.status ?? 500;
+        return NextResponse.json(
+            { errors: [{ message: e?.message || "Directus proxy error", detail: e?.detail }] },
+            { status }
+        );
+    }
 }
diff --git a/app/settings/co2-galvo/[id]/co2-galvo.tsx b/app/settings/co2-galvo/[id]/co2-galvo.tsx
index f32a2169..e9fadba4 100644
--- a/app/settings/co2-galvo/[id]/co2-galvo.tsx
+++ b/app/settings/co2-galvo/[id]/co2-galvo.tsx
@@ -170,6 +170,12 @@ export default function CO2GalvoSettingDetailPage() {
     <div>
     <h1 className="text-3xl font-bold mb-1">{setting.setting_title}</h1>
 
+    {/* DEBUG: remove after verifying */}
+    <pre className="text-xs whitespace-pre-wrap bg-muted/30 p-2 rounded">
+    {JSON.stringify({ owner: setting?.owner }, null, 2)}
+    </pre>
+
+
     <div className="space-y-1 text-sm text-muted-foreground mb-3">
     <p><strong>Owner:</strong> <span>{ownerDisplay}</span></p>
     <p><strong>Uploader:</strong> {setting.uploader || "—"}</p>