Secure every API call.
Control every license.

# Example contract — replace with your production endpoint
curl -X POST https://api.trangpc.vn/v1/request \
  -H "Content-Type: application/json" \
  -H "X-License-Key: $TRANGPC_LICENSE_KEY" \
  -H "X-Client-Id: $TRANGPC_CLIENT_ID" \
  -d '{
    "service": "trangpc-ai",
    "action": "generate",
    "payload": { "prompt": "Hello TrangPC" }
  }'

// Inside your plugin — no upstream provider key required.
$response = wp_remote_post( 'https://api.trangpc.vn/v1/request', [
    'timeout' => 20,
    'headers' => [
        'Content-Type'  => 'application/json',
        'X-License-Key' => $license_key,
        'X-Client-Id'   => $client_id,
    ],
    'body' => wp_json_encode( [
        'service' => 'trangpc-ai',
        'action'  => 'generate',
        'payload' => [ 'prompt' => $prompt ],
    ] ),
] );

if ( is_wp_error( $response ) ) {
    return $response;
}

$body = json_decode( wp_remote_retrieve_body( $response ), true );

// Server-side only. Never ship a license key to the browser.
const res = await fetch('https://api.trangpc.vn/v1/request', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-License-Key': process.env.TRANGPC_LICENSE_KEY,
    'X-Client-Id': process.env.TRANGPC_CLIENT_ID,
  },
  body: JSON.stringify({
    service: 'trangpc-ai',
    action: 'generate',
    payload: { prompt },
  }),
});

if (!res.ok) {
  // 401 license, 403 entitlement, 429 quota — handle each distinctly.
  throw new Error(`Gateway rejected: ${res.status}`);
}

const data = await res.json();

# Load credentials from the environment, not from source control.
import os, requests

resp = requests.post(
    "https://api.trangpc.vn/v1/request",
    headers={
        "X-License-Key": os.environ["TRANGPC_LICENSE_KEY"],
        "X-Client-Id": os.environ["TRANGPC_CLIENT_ID"],
    },
    json={
        "service": "trangpc-ai",
        "action": "generate",
        "payload": {"prompt": prompt},
    },
    timeout=20,
)

resp.raise_for_status()
data = resp.json()