PHP Backend + JS SDK: Auth Token Login

<?php
// Runs after your app has verified the user. $uid is the user's CometChat UID,
// taken from your own user record, never from the request.
function cometchatAuthToken(string $uid): string
{
    $appId     = getenv('COMETCHAT_APP_ID');
    $region    = getenv('COMETCHAT_REGION');       // us, eu or in
    $restApiKey = getenv('COMETCHAT_REST_API_KEY'); // server-side only

    $ch = curl_init(sprintf('https://%s.api-%s.cometchat.io/v3/users/%s/auth_tokens', $appId, $region, rawurlencode($uid)));
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_POSTFIELDS     => '{}', // the only body field, force, is optional
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 10,
        CURLOPT_HTTPHEADER     => ['apikey: ' . $restApiKey, 'Content-Type: application/json', 'Accept: application/json'],
    ]);
    $body   = curl_exec($ch);
    $status = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    // No curl_close(): deprecated as of PHP 8.5. The handle is released when the script ends.

    $json = json_decode((string) $body, true);
    if ($status < 200 || $status >= 300) {
        // Surface CometChat's error, for example ERR_UID_NOT_FOUND, instead of returning null.
        throw new RuntimeException($json['error']['code'] ?? 'ERR_UNEXPECTED_RESPONSE');
    }
    return $json['data']['authToken'];
}

// ... your login handler, after verification:
header('Content-Type: application/json');
echo json_encode([
    'user' => [
        'id'            => $user->id,
        'name'          => $user->name,
        'email'         => $user->email,
        'chatAuthToken' => cometchatAuthToken($user->cometchatUid),
    ],
]);

// After CometChat.init() has run once at app start.
async function loginToApp(credentials) {
  const response = await fetch("/login", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(credentials),
  });
  const data = await response.json();
  if (!response.ok) {
    throw new Error(data.error ?? "Login failed");
  }

  // Your app's own post-login work with data.user goes here.

  const user = await CometChat.login(data.user.chatAuthToken);
  await onLoggedIn(user);
}

// Runs after a fresh login AND when the SDK restores the session on reload.
async function onLoggedIn(user) {
  console.log("CometChat ready for", user.getUid());
}

// On page load: reuse the SDK's cached session if there is one.
CometChat.getLoggedinUser().then((user) => {
  if (user) return onLoggedIn(user);
});