API call "Search" returns "please login first"

user_686576360607949

I am trying to implement the "search" call in PHP.
My quick hack code is:

<?php
        // Login ==============================
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_POSTFIELDS,     '[{"cmd":"Login","param":{"User":{"userName":"admin","pa*sword":"pa*sword"}}}]' );
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_URL, "http://192.168.1.1/cgi-bin/api.cgi?cmd=Login");
        $output = curl_exec($ch);
        $jsonobj = substr($output,1,-2);
        $obj = json_decode($jsonobj);
        echo "Token: ".$obj->value->Token->name."<br>";
        $tokenName = $obj->value->Token->name;
        // Login ==============================
        
        $toSearch = '[{ "cmd": "Search", "action":0, "param": { "Search": { "channel": 0, "onlyStatus": 1, "streamType": "main", "StartTime": { "year": 2023, "mon": 04, "day": 21, "hour": 12, "min": 26, "sec": 1  }, "EndTime": { "year": 2023, "mon": 04, "day": 24, "hour": 12, "min": 34, "sec": 1 }]';
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_URL, "http://192.168.1.1/api.cgi?cmd=Search&token=".$tokenName);
        curl_setopt($ch, CURLOPT_POSTFIELDS,  $toSearch );
        $output = curl_exec($ch);
        echo $output;
?>

Response is:

Token: 423e78c93350582
[ { "cmd" : "Search", "code" : 1, "error" : { "detail" : "please login first", "rspCode" : -6 } } ]

Other calls seem to work fine.
Any Ideas?
Cam is a Reolink TrackMix WiFi with latest firmware.