fix: remove hardcoded credentials from source code

- Move PayPal live/sandbox API keys to env variables
- Move hardcoded API token in isAuthorized middleware to env variable
- Add api_token key to config/app.php
- Update .env.example with new required env vars
- Fix isAuthorized response code from 503 to 401

app/Http/Middleware/isAuthorized.php

@@ -13,11 +13,11 @@ class isAuthorized {
 	 */
 	public function handle($request, Closure $next)
 	{
-		if(isset(getallheaders()['token']) && getallheaders()['token']=="1HHIaIsT4pvO2S39vMzlVfGWi3AhAz6F5xGBNKil") {
+		$token = $request->header('token') ?? (getallheaders()['token'] ?? null);
+		if ($token && $token === config('app.api_token')) {
 			return $next($request);
-		}else{
-				return response()->json(['status' => false,'error' => "Invalid request"], 503);
 		}
+		return response()->json(['status' => false, 'error' => 'Invalid request'], 401);
 	}
 
 }