CBRT EVDS API Security Update: Implementing Header-Based EVDS-KEY Authentication in PHP

Legacy integration scripts for the Central Bank of the Republic of Turkey (CBRT) EVDS platform often passed the secret API key as a raw URL parameter (&key=YOUR_API_KEY). Following security audits, this practice has been deprecated. Modern EVDS endpoints require the API key to be passed strictly within the HTTP Request Headers using the key or EVDS-KEY header field.

Building a Robust PHP cURL Helper Class

<?php
class EvdsClient {
    private string $apiKey;
    private string $baseUrl = "https://evds2.tcmb.gov.tr/service/evds/";

    public function __construct(string $apiKey) {
        $this->apiKey = $apiKey;
    }

    public function getSeriesData(string $series, string $startDate, string $endDate): ?array {
        $params = http_build_query([
            'series'    => $series,
            'startDate' => $startDate,
            'endDate'   => $endDate,
            'type'      => 'json'
        ]);

        $ch = curl_init($this->baseUrl . '?' . $params);
        curl_setopt_array($ch, [
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_TIMEOUT        => 15,
            CURLOPT_HTTPHEADER     => [
                "key: " . $this->apiKey,
                "Accept: application/json"
            ]
        ]);

        $response = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);

        if ($httpCode === 200 && $response) {
            return json_decode($response, true);
        }
        return null;
    }
}

// Example usage:
$client = new EvdsClient("YOUR_SECRET_API_KEY");
$data = $client->getSeriesData("TP.DK.USD.A.YTL", "01-11-2024", "10-11-2024");
print_r($data['items'] ?? []);
?>