<?php

use ParagonIE\ConstantTime\Base64UrlSafe;
use ParagonIE\Sapient\Sapient;
use ParagonIE\Sapient\CryptographyKeys\SigningSecretKey;
use ParagonIE\Sapient\CryptographyKeys\SigningPublicKey;
use ParagonIE\Sapient\Exception\HeaderMissingException;
use ParagonIE\Sapient\Exception\InvalidMessageException;

/* Load keys */
$clientSigningKey = new SigningSecretKey(
    Base64UrlSafe::decode(
        'AHxoibWhTylBMgFzJp6GGgYto24PVbQ-ognw9SPnvKppfti72R8By8XnIMTJ8HbDTks7jK5GmAnvtzaj3rbcTA=='
    )
);
$serverPublicKey = new SigningPublicKey(
    Base64UrlSafe::decode(
        'NvwsINZ-1y0F11xxed_FEUaL_MVewhdgF9tMYf5qEEw='
    )    
);

/* Initiate Sapient */
$sapient = new Sapient([
    'base_url' => 'https://api-provider.example.com'
]);

/** @var RequestInterface */
$request = $yourApp->getRequestToSend();

/* Create a signed request */
$signedRequest = $sapient->createSignedRequest(
    $request,
    $clientSigningKey
);

/* Get send the request to the server, grab the response */
$response = $sapient->send($signedRequest);
try {
    /* Verify the signature */
    $trustedApiResponse = $sapient->verifySignedResponse(
        $response,
        $serverPublicKey
    );
} catch (HeaderMissingException $exception) {
    /* No header added. */
    exit;
} catch (InvalidMessageException $exception) {
    /* Invalid signature */
    exit;
}

$response = $sapient->send(
    $sapient->sealRequest($request, $serverX25519PublicKey)
);
$decrypted = $sapient->unsealResponse($response, $clientX25519SecretKey);