I would expect a 403 header if authentication fails
Exit the program with a 403 is an invalid exit status.
According to http://php.net/manual/en/function.exit.php exit statuses should be in the range 0 to 254.
Because exit does not throw a header, you can not redirect users to a login page, when trying to call the api.php script