diff --git a/api/config.php b/api/config.php
index 4341d44..3b91bc8 100644
--- a/api/config.php
+++ b/api/config.php
@@ -27,7 +27,6 @@ if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
 // Connexion à la base de données
 function getDB() {
     static $pdo = null;
-    
     if ($pdo === null) {
         try {
             $dsn = "mysql:host=" . DB_HOST . ";dbname=" . DB_NAME . ";charset=" . DB_CHARSET;
@@ -43,18 +42,26 @@ function getDB() {
             exit();
         }
     }
-    
     return $pdo;
 }
 
+// Encodage Base64url pour JWT conformes
+function base64url_encode($data) {
+    return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
+}
+
+function base64url_decode($data) {
+    return base64_decode(strtr($data, '-_', '+/'));
+}
+
 // Fonction pour générer un token JWT simple
 function generateToken($userId) {
-    $header = base64_encode(json_encode(['alg' => 'HS256', 'typ' => 'JWT']));
-    $payload = base64_encode(json_encode([
+    $header = base64url_encode(json_encode(['alg' => 'HS256', 'typ' => 'JWT']));
+    $payload = base64url_encode(json_encode([
         'user_id' => $userId,
         'exp' => time() + JWT_EXPIRY
     ]));
-    $signature = hash_hmac('sha256', "$header.$payload", JWT_SECRET);
+    $signature = base64url_encode(hash_hmac('sha256', "$header.$payload", JWT_SECRET, true));
     return "$header.$payload.$signature";
 }
 
@@ -62,23 +69,17 @@ function generateToken($userId) {
 function verifyToken($token) {
     $parts = explode('.', $token);
     if (count($parts) !== 3) return false;
-    
     list($header, $payload, $signature) = $parts;
-    
-    $expectedSignature = hash_hmac('sha256', "$header.$payload", JWT_SECRET);
+    $expectedSignature = base64url_encode(hash_hmac('sha256', "$header.$payload", JWT_SECRET, true));
     if (!hash_equals($expectedSignature, $signature)) return false;
-    
-    $data = json_decode(base64_decode($payload), true);
+    $data = json_decode(base64url_decode($payload), true);
     if (!$data || !isset($data['exp']) || $data['exp'] < time()) return false;
-    
     return $data['user_id'];
 }
 
 // Fonction pour obtenir l'utilisateur actuel
 function getCurrentUser() {
     $authHeader = '';
-    
-    // Détection universelle des headers d'autorisation
     if (isset($_SERVER['HTTP_AUTHORIZATION'])) {
         $authHeader = $_SERVER['HTTP_AUTHORIZATION'];
     } elseif (isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION'])) {
@@ -87,11 +88,9 @@ function getCurrentUser() {
         $headers = getallheaders();
         $authHeader = $headers['Authorization'] ?? '';
     }
-    
     if (preg_match('/Bearer\s+(.*)$/i', $authHeader, $matches)) {
         $token = $matches[1];
         $userId = verifyToken($token);
-        
         if ($userId) {
             $db = getDB();
             $stmt = $db->prepare("SELECT id, username, email, role, points FROM users WHERE id = ?");
@@ -99,7 +98,6 @@ function getCurrentUser() {
             return $stmt->fetch();
         }
     }
-    
     return null;
 }