API call "Search" returns "please login first"

[user_686576360607949_686576360607949]

I am trying to implement the "search" call in PHP.
My quick hack code is:

<?php
        // Login ==============================
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_POSTFIELDS,     '[{"cmd":"Login","param":{"User":{"userName":"admin","password":"password"}}}]' );
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_URL, "http://192.168.1.1/cgi-bin/api.cgi?cmd=Login");
        $output = curl_exec($ch);
        $jsonobj = substr($output,1,-2);
        $obj = json_decode($jsonobj);
        echo "Token: ".$obj->value->Token->name."<br>";
        $tokenName = $obj->value->Token->name;
        // Login ==============================
        
        $toSearch = '[{ "cmd": "Search", "action":0, "param": { "Search": { "channel": 0, "onlyStatus": 1, "streamType": "main", "StartTime": { "year": 2023, "mon": 04, "day": 21, "hour": 12, "min": 26, "sec": 1  }, "EndTime": { "year": 2023, "mon": 04, "day": 24, "hour": 12, "min": 34, "sec": 1 }]';
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_URL, "http://192.168.1.1/api.cgi?cmd=Search&token=".$tokenName);
        curl_setopt($ch, CURLOPT_POSTFIELDS,  $toSearch );
        $output = curl_exec($ch);
        echo $output;
?>

Response is:

Token: 423e78c93350582
[ { "cmd" : "Search", "code" : 1, "error" : { "detail" : "please login first", "rspCode" : -6 } } ]

Other calls seem to work fine.
Any Ideas?
Cam is a Reolink TrackMix WiFi with latest firmware.

[joseph_1979]

@user_686576360607949_686576360607949 Enable HTTPS from Network menu and run the following curl command. Just replace the CameraIP with the private IP of the camera.

curl -s -k -X POST -H "Content-Type : application/json" -d "[{"cmd": "Search", "action":0, "param": { "Search": { "channel": 0, "onlyStatus": 1, "streamType": "main", "StartTime": { "year": 2023, "mon": 04, "day": 21, "hour": 12, "min": 26, "sec": 1},"EndTime": { "year": 2023,"mon": 04, "day": 21, "hour": 21, "min": 34, "sec": 1}}}}]" "https://CameraIP/cgi-bin/api.cgi?user=#username#&password=#password#"

[user_686576360607949_686576360607949]

@joseph-chircop_497308027822318 so do you think using a token is not supported? It is described in the API spec, though.