BossHub Auth Gateway

{
  "app_id": "string",
  "name": "string",
  "domains": "string (comma separated)",
  "type": "web",
  "next": "url"
}

{
  "token": "jwt_token_string",
  "app_id": "string (optional)"
}

?php
error_reporting(0);
header("Access-Control-Allow-Origin: *");
date_default_timezone_set("Asia/Bangkok");
$app_id = 'app_test';
function BossHubAuth(){
    global $_REQUEST,$_SESSION,$app_id;
    if(!$_REQUEST['token'] || !$_REQUEST['app_id']){
        header('location: https://authentication.bosshub.io/login/google?app_id='.$app_id.'&next=https://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
        return false;
    }
    header('Content-Type:application/json');
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL,'https://authentication.bosshub.io/api/auth/verify_token');
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST,"POST");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS ,json_encode($_REQUEST));
    $headers = array();
    $headers[] = 'Content-Type: application/json';
    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
    $result = curl_exec($ch);
    curl_close($ch);
    $json = json_decode($result,true);
    if($json['status'] == 'valid'){
        $_SESSION = $_REQUEST;
        // สำเร็จ
    }else{
        // ไม่สำเร็จ
        session_destroy();
    }
    return $result;
}

print_r(BossHubAuth());