<?php
// Server-side GET example. Credentials come from your secret manager.
$base = getenv('XEOTEC_BASE_URL') ?: 'https://sandbox-api.xeotec.in';
$key = getenv('XEOTEC_API_KEY');
$secret = getenv('XEOTEC_API_SECRET');
if (!$key || !$secret) { throw new RuntimeException('Configure server-side credentials'); }
$path = '/api/v1/auth/ping';
$timestamp = (string) time();
$nonce = bin2hex(random_bytes(24));
$canonical = implode("\n", ['GET', $path, $timestamp, $nonce, hash('sha256', '')]);
$signature = hash_hmac('sha256', $canonical, $secret);
$curl = curl_init($base . $path);
curl_setopt_array($curl, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTPHEADER => [
        'x-api-key: ' . $key, 'x-timestamp: ' . $timestamp,
        'x-nonce: ' . $nonce, 'x-signature: ' . $signature
    ]
]);
curl_exec($curl);
echo 'HTTP ' . curl_getinfo($curl, CURLINFO_RESPONSE_CODE) . PHP_EOL;
curl_close($curl);