Back to Genius hub

Plain-English technical explainer

What "server-side PHP cURL calls a REST API over HTTPS" actually means

The phrase sounds more complicated than the architecture is. The public browser page does not talk to Genius directly. It asks HandiRamp's own server for an answer. HandiRamp's server privately calls Genius, receives structured data, removes anything sensitive, and sends the browser only the finished result.

Public side The browser can see HTML, CSS, JavaScript, and the final safe JSON response.
Private side PHP runs on WPEngine. It can hold credentials and call Genius without exposing them to the browser.
Transport HTTPS encrypts the traffic between HandiRamp's server and Genius.
Result The browser gets order status, invoice, shipping, and tracking fields, not tokens or passwords.

The core idea

Think of the public page as the counter at a service desk. The customer can ask a question at the counter, but they are not handed the keys to the back office. PHP is the back-office worker. cURL is the phone or web client that worker uses to call Genius. Genius answers in JSON. PHP translates that answer into the clean result shown on the page.

The important security boundary: the Genius username, password, and session token stay on the WPEngine server. They are never embedded in order-lookup-poc.html, never sent to the browser, and never required from the user.

What each term means

PHP

Server-side code

PHP is the language running on the HandiRamp web server. It executes after the browser asks for /genius/order-lookup.php. Because PHP runs on the server, it can safely use server-held credentials.

cURL

The request-making tool

cURL is not a database and not a vendor. It is a common tool/library for making web requests from code. PHP cURL lets order-lookup.php send HTTPS requests to Genius and read the response.

REST API

A structured web interface

A REST API is a set of predictable URLs that accept requests and return structured data, usually JSON. For Genius, examples are /api/auth and /api/data/fetch/SalesOrderHeaderEntity.

HTTPS

The encrypted channel

HTTPS is HTTP with encryption and server identity verification. It protects the login request, token, filters, and returned order data while they travel between WPEngine and Genius.

Detailed flow diagram

There are two different conversations. The browser talks to HandiRamp. HandiRamp's PHP endpoint talks to Genius. Keeping those conversations separate is why the browser never sees Genius credentials.

Public browser Customer service page HTML page order-lookup-poc.html Safe result status, invoice, shipping, tracking HandiRamp WPEngine server Private server-side execution PHP endpoint /genius/order-lookup.php Runs only on server PHP cURL Builds HTTPS request Method, URL, headers, body Private values credentials and token Never returned to browser Genius ERP cloud REST API over HTTPS Auth endpoint POST /api/auth Data endpoint GET /api/data/fetch/ {Entity} Logout DELETE /api/auth 1. Browser fetches our PHP URL 2. PHP uses cURL 3. HTTPS POST login 4. Genius returns token 5. HTTPS GET data 6. JSON records return 7. Logout token 8. Safe JSON only Can inspect page code Can use credentials privately Knows nothing about browser

What happens when someone searches an order

The user enters an order reference. Example: HR263803 in the public Order Lookup page.
The browser calls HandiRamp, not Genius. JavaScript runs fetch("order-lookup.php?q=HR263803"). This is a request to HandiRamp's own website.
WPEngine runs the PHP file. The PHP code normalizes the input. For a WooCommerce-style order, it knows to also try WEB-263803.
PHP cURL logs into Genius. cURL sends an encrypted HTTPS POST request to /api/auth. Genius returns a temporary token.
PHP cURL asks Genius for records. It sends HTTPS GET requests to entity URLs like /api/data/fetch/SalesOrderHeaderEntity.
PHP shapes the answer. It keeps the useful business fields and leaves out credentials, token values, raw internal noise, and unnecessary data.
The browser receives safe JSON. The page renders the result: Genius SO, invoice, shipping header, tracking, delivery, and customer fields.

What the browser asks

This is the public request. It contains only the user's lookup value. 

GET /genius/order-lookup.php?q=HR263803
Host: handiramp.com
Accept: application/json
The browser does not know the Genius API URL, Genius username, Genius password, or Genius token.

What PHP asks Genius

This request is created server-side by PHP cURL after login. The token is private and temporary. 

GET /api/data/fetch/SalesOrderHeaderEntity
Host: handiproducts.geniuserpcloud.com:53215
TOKEN=<temporary server-side token>
fields=Code,PoNumber,BillToCustomerCode,ShipToCustomerCode
filter=PoNumber="WEB-263803"
In the live system, the token is never printed on the page and never sent back to the browser.

What a REST API call is

A REST API call is just a structured web request. The method says the action, the URL says the resource, the query/body carries parameters, and the response returns structured data.

Part Plain meaning Genius example
Method The action being requested. POST for login, GET for data, DELETE for logout.
URL path The thing being called. /api/data/fetch/SalesOrderHeaderEntity
Parameters The specifics of the request. fields, filter, limit, page, TOKEN
Response The structured answer. JSON containing a Result array of Genius records.

What HTTPS protects

HTTPS encrypts the conversation between WPEngine and Genius. Someone watching network traffic should not be able to read the Genius password, token, filter, or returned order data. HTTPS also verifies that the server is the Genius ERP cloud endpoint we intended to reach.

HTTPS does not decide who is allowed to see data. Authentication and server-side code do that. HTTPS protects the data while it is moving.

Why this design is the right shape

Decision Why it matters
Browser talks only to HandiRamp's PHP endpoint. The public page stays simple and never needs Genius credentials.
PHP cURL talks to Genius from the server. Credentials and tokens stay in a private server context.
Genius data returns to PHP first. We can normalize, combine, filter, and label the data before any user sees it.
PHP returns sanitized JSON. The UI gets exactly what it needs to render the order lookup, and nothing sensitive.
PHP logs out of Genius. The temporary Genius token is closed after each lookup cycle.

The same idea in one sentence

The browser asks HandiRamp's server a simple question; HandiRamp's server privately uses PHP cURL to ask Genius over encrypted HTTPS; Genius returns JSON; HandiRamp's server sends the browser only the safe, finished answer.

Zapier uses the same boundary differently

The shipping Zaps do not use PHP cURL. They use a private Zapier app action as the server-side Genius connector. See How Zapier Uses the Genius API for Shipping Updates.