// Created on savesnippets.com · https://savesnippets.com/k4ijIFeKgDKFKf
<?php
function safeCompare(string $expected, string $actual): bool {
    // hash_equals: O(strlen($expected)) regardless of where the strings differ.
    return hash_equals($expected, $actual);
}

// Don't do this (timing leak):
//   if ($_GET['api_key'] === $secret) { ... }   ❌

// Do this:
if (safeCompare($secret, $_GET['api_key'] ?? '')) {
    // authorized
} else {
    http_response_code(401);
    exit('Unauthorized');
}