PHP: Secure a Rest Service with a Token mixed with Timestamp -

i have rest service website calls , want secure calling outside of website as possible.

i want create token mixed timestamp, user can call service in 10 minutes (for example) token generated in server.

let me explain pseudo codes:

1) server: token generated in server using private key , timestamp:

// token valid 10 minutes after 'time' $token = encrypt($pkey, timestamp); // server time 

2) client: put token in javascript variable , use in our request timestamp of client:

var token = '<?= $token ?>'; var params = {   token : token,   time  : timestamp, // client time   data  : mydata } 

3) server: if time parameter mixed token not equal 10 minutes token, request invalid:

// i'm stuck here $something = decrypt($pkey, $_post['token'], $_post['time']); if ($something != $tenminutes) { // invalid request } 

the question:

1) senario o.k? if yes, exact solution? if no, solution?

2) there senario secure requests i've seen in aws: http://docs.aws.amazon.com/amazons3/latest/dev/s3_authentication2.html
how can implement in php?

after you've got token client need check 2 things: validity of token , timestamp.

there 2 scenarios:

1. make timestamp part of token:

   function gettoken($timestamp) {     return $timestamp . encrypt(getpkey(), $timestamp); }  $token = gentoken(time()); 

and validate it:

$token = $_post['token'];   function validate($token) {     $timestamp = substr($token, 0, 10);     return          (gentoken($timestamp) == $token)         && ($timestamp >= time() - 600); } 

2. save generated token in database along timestamp , after getting token client check corresponding timestamp.