diff --git a/client/src/cart_item.c b/client/src/cart_item.c
index e7047f9..8a0ceb1 100644
--- a/client/src/cart_item.c
+++ b/client/src/cart_item.c
@@ -18,6 +18,7 @@ typedef struct _YacosCartItemPriv {
 
 	struct api {
 		gchar *url_base;
+		gchar *token;
 
 		SoupSession *soup_session_meta;
 	} api;
@@ -48,6 +49,7 @@ static void yacos_cart_item_finalize(GObject *gobject)
 	YacosCartItem *self = yacos_cart_item_get_instance_private(YACOS_CART_ITEM(gobject));
 
 	g_free(self->priv.api.url_base);
+	g_free(self->priv.api.token);
 
 	G_OBJECT_CLASS(yacos_cart_item_parent_class)->constructed(gobject);
 }
@@ -80,6 +82,7 @@ static void yacos_cart_item_init(YacosCartItem *self)
 	self->priv.stack_image_loader = GTK_STACK(gtk_builder_get_object(builder, "stack_image_loader"));
 
 	self->priv.api.url_base = g_strdup("http://localhost:8080/api.php");
+	self->priv.api.token = g_strdup("123456");
 
 	self->priv.api.soup_session_meta = soup_session_new();
 
@@ -163,6 +166,8 @@ void yacos_cart_item_fetch_meta(YacosCartItem *self)
 
 	url = g_strdup_printf("%s?meta&id=%s", self->priv.api.url_base, id_str);
 	msg = soup_message_new("GET", url);
+	soup_message_headers_append (msg->request_headers, "x-token", self->priv.api.token);
+
 	g_free(url);
 	g_free(id_str);
 
diff --git a/server/api.php b/server/api.php
index f3aac33..b87c659 100644
--- a/server/api.php
+++ b/server/api.php
@@ -1,6 +1,9 @@
 <?php
 	// This is just a dummy implementation during the development of the GTK+3 GUI
 
+
+if ($_SERVER['HTTP_X_TOKEN'] != "123456") die("Invalid token.\n");
+
 if (isset($_GET['meta'])) {
 	if ($_GET['id'] == "BF09CE") {
 		?>