diff --git a/app/settings/co2-galvo/[id]/co2-galvo.tsx b/app/settings/co2-galvo/[id]/co2-galvo.tsx
index ab4f6518..e63b686a 100644
--- a/app/settings/co2-galvo/[id]/co2-galvo.tsx
+++ b/app/settings/co2-galvo/[id]/co2-galvo.tsx
@@ -5,22 +5,6 @@ import { useParams } from "next/navigation";
 import Image from "next/image";
 import Markdown from "react-markdown";
 
-function getMaToken(): string | null {
-  if (typeof window === "undefined") return null;
-  // cookie first
-  const c = document.cookie
-  .split("; ")
-  .find((x) => x.startsWith("ma_at="))
-  ?.split("=")[1];
-  if (c) return decodeURIComponent(c);
-  // localStorage fallback (if you ever store it there)
-  try {
-    const ls = window.localStorage.getItem("ma_at");
-    if (ls) return ls;
-  } catch {}
-  return null;
-}
-
 export default function CO2GalvoSettingDetailPage() {
   const { id } = useParams<{ id: string }>();
   const [setting, setSetting] = useState<any>(null);
@@ -36,7 +20,7 @@ export default function CO2GalvoSettingDetailPage() {
       "submission_id",
       "setting_title",
       "uploader",
-      // need username explicitly for M2O
+      // make sure owner expands
       "owner.id",
       "owner.username",
       "setting_notes",
@@ -57,7 +41,7 @@ export default function CO2GalvoSettingDetailPage() {
       "lens_apt.name",
       "lens_exp.name",
       "focus",
-      // laser_soft may be string OR relation
+      // string-or-relation
       "laser_soft",
       "laser_soft.name",
       "repeat_all",
@@ -66,21 +50,11 @@ export default function CO2GalvoSettingDetailPage() {
       "raster_settings",
     ].join(",");
 
-    const url =
-    `${process.env.NEXT_PUBLIC_API_BASE_URL}/items/settings_co2gal/` +
-    encodeURIComponent(String(id)) +
+    const url = `/api/dx/items/settings_co2gal/${encodeURIComponent(String(id))}` +
     `?fields=${encodeURIComponent(fields)}`;
 
-    const token = getMaToken();
     setLoading(true);
-
-    fetch(url, {
-      method: "GET",
-      headers: token ? { Authorization: `Bearer ${token}` } : {},
-      cache: "no-store",
-      // do NOT rely on cross-site cookies; we send the bearer explicitly
-      credentials: "omit",
-    })
+    fetch(url, { cache: "no-store", credentials: "include" })
     .then(async (res) => {
       if (!res.ok) {
         const j = await res.json().catch(() => ({}));
@@ -99,7 +73,7 @@ export default function CO2GalvoSettingDetailPage() {
   if (loading) return <p className="p-6">Loading setting...</p>;
   if (!setting) return <p className="p-6">Setting not found.</p>;
 
-  // ----- presentation helpers -----
+  // ---- display helpers ----
   const ownerDisplay: string =
   typeof setting?.owner === "object"
   ? (setting.owner?.username ?? setting.owner?.id ?? "—")