MyCalcs login server code to generate a token

MyCalcsLogin.php

<?php

define('IN_PHPBB', true);
$phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './';
$phpEx = substr(strrchr(__FILE__, '.'), 1);
include($phpbb_root_path . 'common.' . $phpEx);
include($phpbb_root_path . 'includes/functions_user.' . $phpEx);

// Start session management
$user->session_begin();
$auth->acl($user->data);
$user->setup();

$userID = (int)($user->data['user_id']);
if (!($userID > 0 && $user->data['is_registered'] && !$user->data['is_bot']))
    login_box();

date_default_timezone_set('UTC');

function mycalcs_token_encrypt(string $token) {
    $cipher = 'AES-256-CBC';
    $ivLen = openssl_cipher_iv_length($cipher);
    $key = hash('sha256', '___secret_here___', true);
    $iv = openssl_random_pseudo_bytes($ivLen);
    $ciphertext = openssl_encrypt($token, $cipher, $key, OPENSSL_RAW_DATA, $iv);
    $hash = hash_hmac('sha256', $ciphertext . $iv, $key, true);
    return bin2hex($iv . $hash . $ciphertext);
}

$token = [ 'uid' => $userID, 'avatar' => $user->data['user_avatar'], 'username' => $user->data['username'], 'email' => $user->data['email'], 'ts' => time() ];

$token_for_url = mycalcs_token_encrypt(json_encode($token));

$resyncOnly = (int)($_GET['resyncOnly'] ?? 0);
header("Location: https://my.calcs.quest/login_handler.php?fromtip=1&resyncOnly={$resyncOnly}&token={$token_for_url}");