How to allow access by certain URI parameters in htaccess?

Question

Apache HTTP Server

Hello,
I have a task to allow access to a folder only using some list of tokens, for example
domain.com/?token=111
I can list tokens in a similar way

RewriteCond %{QUERY_STRING} \.png
RewriteCond %{QUERY_STRING} token=1 [OR]
RewriteCond %{QUERY_STRING} token=2 [OR]
RewriteRule .+ $0

(yes, you need to open access to pictures), the last rule is allowing, but how to put ELSE and a prohibiting rule in htaccess? Is it possible?
OK, I went the other way - using variables. As it turns out, SetEnv/SetEnvIf is processed after mod_rewrite and I started trying to set variables with mod_rewrite

RewriteCond %(QUERY_STRING) .
RewriteRule .+ $0 [env=ALLOW_IT:no]

RewriteCond %{ENV:ALLOW_IT} no
RewriteRule ^(.*) - [F]

there is a ban

RewriteCond %(QUERY_STRING) .
RewriteRule .+ $0 [env=ALLOW_IT:no]

RewriteCond %{QUERY_STRING} .
RewriteRule .+ $0 [env=ALLOW_IT:yes]

RewriteCond %{ENV:ALLOW_IT} no
RewriteRule ^(.*) - [F]

there is still a ban. Can a set variable be overridden?
In general, I have reached complete frustration and will be grateful for help.

Answer 1

all in all, problem solved.

RewriteCond %(REQUEST_URI) .*
RewriteRule .+ $0 [env=ALLOW_IT:no]

RewriteCond %{REQUEST_URI} \.png
RewriteRule .+ $0 [env=ALLOW_IT:yes]

RewriteCond %{QUERY_STRING} token=1
RewriteRule .+ $0 [env=ALLOW_IT:yes]

RewriteCond %{QUERY_STRING} token=2
RewriteRule .+ $0 [env=ALLOW_IT:yes]

RewriteCond %{ENV:ALLOW_IT} no
RewriteRule ^(.*) - [F]

First of all, there was a confusion between QUERY_STRING and REQUEST_URI, well, to match any REQUEST_URI, one dot is not enough, you need .* to match an empty string.