You can access the Planet API using a PHP library such as the cURL library. Take extra care when handling binary data such as GeoTIFFs or thumbnails.

For example, to request a scene using the Planet API, you might write a block of code like the following:

<?php
  $url = "https://api.planet.com/v0/scenes/ortho/20150823_225309_0b09/full";
  $api_key = "..."; // fill in real key here

  $auth = "Basic " . base64_encode($api_key . ":");
  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $url);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  curl_setopt($ch, CURLOPT_HEADER, true);
  curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Authorization: ' . $auth
  ));
  $a = curl_exec($ch);
?>

The response header includes a redirect, similar to the following:

HTTP/1.1 302 FOUND
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Type: text/html; charset=utf-8
Date: Fri, 23 Oct 2015 19:58:58 GMT
Location: https://planet-imagery.s3.amazonaws.com/...?Signature=...&Expires=...&response-content-disposition=attachment%3B%20filename%3D%2220150823_225309_0b09_visual.tif%22&response-content-type=image/tiff

The Location line indicates that the Planet server redirects the call to a new URL from which the downloadable bundle is available.

When performing these operations in PHP, you might be tempted to add the following cURL option so that the library follows redirects automatically:

curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

However, this returns the following error:

Only one auth mechanism allowed; only the X-Amz-Algorithm query parameter, Signature query string parameter or the Authorization header should be specified

The redirect URL already includes authentication, so the Authorization header is not needed. cURL automatically reuses the header from the initial request, and including both the Authorization header and authentication in the URL causes the server error.

To resolve this, configure cURL to not follow the redirect automatically. Instead, extract the redirect URL from the response and make a second cURL request without authentication in the header:

<?php
  $url = "https://api.planet.com/v0/scenes/ortho/20150823_225309_0b09/full";
  $api_key = "..."; // fill in real key here

  $auth = "Basic " . base64_encode($api_key . ":");
  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $url);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  curl_setopt($ch, CURLOPT_HEADER, true);
  curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Authorization: ' . $auth
  ));
  $a = curl_exec($ch);
  $redirect_url = curl_getinfo($ch)["redirect_url"];
?>