diff --git a/src/components/checkout/CommentCard.svelte b/src/components/checkout/CommentCard.svelte
index 32e72019..db384f45 100644
--- a/src/components/checkout/CommentCard.svelte
+++ b/src/components/checkout/CommentCard.svelte
@@ -11,12 +11,10 @@
     interface Props {
         project: Project;
         support: ProjectSupport | undefined;
-        index: number;
-        token: string;
         onUpdate?: (support: ProjectSupport) => void;
     }
 
-    let { project, support, index, token, onUpdate }: Props = $props();
+    let { project, support, onUpdate }: Props = $props();
     let open = $state(false);
     let isAnonymous = $state(false);
 </script>
@@ -60,7 +58,6 @@
     bind:open
     bind:isAnonymous
     {support}
-    {token}
     onSubmit={(message, anonymous) => {
         onUpdate?.({
             ...support,
diff --git a/src/components/checkout/CommentModal.svelte b/src/components/checkout/CommentModal.svelte
index 9bd37948..c2a6bb77 100644
--- a/src/components/checkout/CommentModal.svelte
+++ b/src/components/checkout/CommentModal.svelte
@@ -8,16 +8,16 @@
         open: boolean;
         isAnonymous: boolean;
         support: ProjectSupport | undefined;
-        token: string;
         onSubmit?: (message: string, anonymous: boolean) => void;
     }
+
     let {
         open = $bindable(false),
         isAnonymous = $bindable(false),
         support,
-        token,
         onSubmit,
     }: Props = $props();
+
     let message = $state("");
 
     async function handleSubmit() {
@@ -28,9 +28,9 @@
 
         try {
             await apiProjectSupportsIdPatch({
+                baseUrl: "/api/relay",
                 path: { id: projectSupportPath },
                 headers: {
-                    Authorization: `Bearer ${token}`,
                     "Content-Type": "application/merge-patch+json",
                 },
                 body: {
diff --git a/src/components/checkout/FeedbackForm.svelte b/src/components/checkout/FeedbackForm.svelte
index 0785dae5..086cb1f6 100644
--- a/src/components/checkout/FeedbackForm.svelte
+++ b/src/components/checkout/FeedbackForm.svelte
@@ -9,14 +9,13 @@
         paymentMethod?: string;
         projects: Project[];
         projectSupports: ProjectSupport[];
-        token: string;
     }
 
-    let { paymentMethod = undefined, projects, projectSupports, token }: Props = $props();
+    let { paymentMethod = undefined, projects, projectSupports }: Props = $props();
 
     let type = $state<"organization" | "individual">("organization");
 
-    let supports = $state<ProjectSupport[]>(projectSupports);
+    let supports = $derived(projectSupports);
 
     let feedbackItems = $derived(() =>
         projects.map((project) => {
@@ -79,8 +78,6 @@
                         <CommentCard
                             {project}
                             {support}
-                            {index}
-                            {token}
                             onUpdate={(updatedSupport) => {
                                 supports = supports.map((s) =>
                                     s.id === updatedSupport.id ? updatedSupport : s,
diff --git a/src/pages/[...locale]/checkout/verify.astro b/src/pages/[...locale]/checkout/verify.astro
index e173b709..ac725b7a 100644
--- a/src/pages/[...locale]/checkout/verify.astro
+++ b/src/pages/[...locale]/checkout/verify.astro
@@ -14,8 +14,8 @@ import { apiGatewaysGetCollection } from "../../../openapi/client/index";
 import Card from "../../../components/library/cards/Card.svelte";
 import { extractId } from "../../../utils/extractId.ts";
 import { sumMoney } from "../../../utils/money";
-import { goto } from "../../../utils/navigation";
 import type { Money, Project, ProjectSupport } from "../../../openapi/client";
+import { goto } from "../../../utils/navigation";
 
 const { t, lang, session } = Astro.locals;
 
@@ -29,9 +29,7 @@ const { token, user } = session;
 
 const { data: accounting } = await apiAccountingsIdGet({
     path: { id: extractId(user.accounting)! },
-    headers: {
-        Authorization: `${token.token_type} ${token.access_token}`,
-    },
+    headers: token.asHttpHeaders,
 });
 
 let error = null;
@@ -50,9 +48,7 @@ try {
 
     const response = await apiGatewayCheckoutsIdGet({
         path: { id: checkoutId },
-        headers: {
-            Authorization: `${token.token_type} ${token.access_token}`,
-        },
+        headers: token.asHttpHeaders,
     });
 
     if (!response.data) {
@@ -73,10 +69,6 @@ try {
         ...new Set(response.data.charges.map((charge) => charge.target).filter(Boolean)),
     ] as string[];
 
-    const authHeaders = {
-        Authorization: `${token.token_type} ${token.access_token}`,
-    };
-
     const donatedProjects = (
         await Promise.all(
             targetAccountingUrls.map(async (accountingUrl) => {
@@ -86,7 +78,7 @@ try {
 
                     const { data: targetAccounting } = await apiAccountingsIdGet({
                         path: { id: accountingId },
-                        headers: authHeaders,
+                        headers: token.asHttpHeaders,
                     });
 
                     if (!targetAccounting?.owner?.includes("/v4/projects/")) return null;
@@ -96,7 +88,7 @@ try {
 
                     const { data: project } = await apiProjectsIdOrSlugGet({
                         path: { idOrSlug: projectId },
-                        headers: authHeaders,
+                        headers: token.asHttpHeaders,
                     });
 
                     return project;
@@ -112,7 +104,7 @@ try {
 
     const { data: supports } = await apiProjectSupportsGetCollection({
         query: { origin: user.accounting },
-        headers: authHeaders,
+        headers: token.asHttpHeaders,
     });
 
     projectSupports =
@@ -217,7 +209,6 @@ const postPaymentUrl = checkoutId
                                                     paymentMethod={selectedGateway}
                                                     {projects}
                                                     {projectSupports}
-                                                    token={token.access_token}
                                                 />
                                             </div>
                                         </div>