title: API with secret hash
body: <p>I'm creating a APi on my server to reset passwords for users.</p>
  
  <p>I want to make it secure, so that someone could not simply POST the data to the php script and it would reset someone elses password.  So in order to do this, i've created a hash with <code>sha256</code>.  The hash has two salts, and looks similar to this:</p>
  
  <p><code>hash("sha256","salt1".date("jS M Y H")."salt2")</code></p>
  
  <p>So, in order to validate it I hash it on the page and take the last 32 characters, and in the API scripts I have the first 32 characters.  I join them together to validate, and if it matches the full hash, it allows the script to execute.</p>
  
  <p>This works fine, expect if the user happens to load the public page at 59 minutes past the hour, and submit it after the hour changes.  Same goes for month, and year.</p>
  
  <p>I dont want to simply set a static hash, I want it to change.  Is there a better method or way I could achieve the results I want?</p>