Update main.py

main.py

@@ -286,16 +286,19 @@ async def search_database(
 # ══════════════════════════════════════════════════════════════════
 @app.post("/api/categories")
 async def get_categories(user_cloudinary_url: str = Form("")):
-    actual_cld_url = user_cloudinary_url or os.getenv("DEFAULT_CLOUDINARY_URL", "")
+    # Priority:
+    #   1. Logged-in user sends their own URL → use it, fetch THEIR folders
+    #   2. Guest (no URL sent) → use DEFAULT_CLOUDINARY_URL (server owner's demo cloud)
+    #   3. No URL anywhere → return empty list, never error
+    actual_cld_url = user_cloudinary_url.strip() or os.getenv("DEFAULT_CLOUDINARY_URL", "")
     if not actual_cld_url:
         return {"categories": []}
 
     creds = get_cloudinary_creds(actual_cld_url)
-    if not creds.get("cloud_name"):
+    if not creds.get("cloud_name") or not creds.get("api_key"):
         return {"categories": []}
 
     try:
-        # Uses THIS request's credentials — never touches another user's cloud
         result = await asyncio.to_thread(_cld_root_folders, creds)
         return {"categories": [f["name"] for f in result.get("folders", [])]}
     except Exception as e: