Client API

Base URL: /v1/client

Headers on every request:

X-PA-App-Id: pa_...
X-PA-Timestamp: unix seconds
X-PA-Nonce: unique string
X-PA-Signature: hex(hmac_sha256(secret, timestamp.nonce.METHOD.path.sha256(body)))
X-PA-Session: session_id  (after init)

1. POST /v1/client/init — create an unvalidated session
2. POST /v1/client/login or /register
3. POST /v1/client/validate on a heartbeat
4. GET /v1/client/variables/:key

Login body may include username+password, license_key, and hwid.