Securing an API with shared secret - php

Question

I'm starting a REST API, and have begun researching hashing and shared salts/secrets.
I have successfully been able to generate a sha256 hash, sent it to my server via json and matched it to the stored hash.
Thats great and all, but i'm thinking, now that ive done this with json, the actual hash generated is still visible to everyone that wants it. I was under the impression that these hashes changed everytime you re-hashed a string using hash_hmac.
So how do i make sure that a random user wont find that little json snippet, grap the hashed key and start making API calls?
I might have misunderstood the concept completely, so any bumps is greatly appreciated.
Heres my "Client" page:
<?php
$key= hash_hmac('sha256', '66c74620db28603fe4bec7b0f3a8e53b', 'gwerganaevawe21_3faseghbamoirvQWD');
?>
<script>
$.getJSON( "domain.com/api/publicCourseSession.php?key=<?php echo $key;?>", function( data ) {
$.each( data, function( key, val ) {
console.log(val);
});
});
</script>
And here is my publicCourseSession.php:
header("Content-Type: application/json");
header('Access-Control-Allow-Origin: *');
$apikey =$_GET['key'];
session_start();
function hash_compare($a, $b) {
if (!is_string($a) || !is_string($b)) {
return false;
}
$len = strlen($a);
if ($len !== strlen($b)) {
return false;
}
$status = 0;
for ($i = 0; $i < $len; $i++) {
$status |= ord($a[$i]) ^ ord($b[$i]);
}
return $status === 0;
}
$currentnetwork = getCurrentNetwork();
$currentkey = getNetworkApiKey(getNetworkId($currentnetwork));
$currentsecret = getNetworkApiSecret(getNetworkId($currentnetwork));
$currentkey= hash_hmac('sha256', $currentkey, $currentsecret);
if (hash_compare($apikey,$currentkey)) {
$status='correct';
} else {
$status='not correct';
}
$arr[] = ["key"=>$apikey, "currentkey"=>$currentkey, "correctkeys"=>$status];
echo json_encode($arr);

Answer 1

You did well, that's step 1.
Thing is, you can't do security on the browser only - you should be providing the user with the secret key once he successfully authenticates himself using his credentials (like username/password). Once he has the secret key then he can use it to authenticate his requests and he no longer needs to send his username/password back and forth across the interwebs..
Goal of the secret key is to simplify authenticated requests once user started a session. To start a session you need to authenticate yourself first though, otherwise you'll be providing anyone with the secret key which defeats the purpose.
Also, key should be generated per user and expire after x amount of time so it can't be used indefinitely.
Hope this helps!