```html
```
### Backend requirement
The important part is that `/api/symbi/authorize` must be a **real protected endpoint**. It should validate the user's Firebase session/token and determine whether that account has the required role/claim.
The browser should receive something equivalent to:
```json
{
"authorized": true
}
```
only after the backend has independently verified authorization.
**Do not put the old `727777` PIN anywhere in the replacement.** If you want a secret executive code as an additional factor, make it a server-side verification mechanism—not JavaScript.
Also, if this is going into **Firebase Studio's Customer Code box**, the `/api/...` endpoints must actually exist in your deployed application. If they don't, the UI portion will work, but the authorization/telemetry portions will correctly fail closed rather than pretending Symbi has authenticated anyone.