API Authentication using HMAC - authentication

Question

I am looking for a decent method of authentication to use when writing a simple API for use within our internal systems. Other questions on Stack Overflow have suggested HMAC along with links to tutorials, which I went ahead and decided to implement.
After setting this up, I realized I am not exactly sure how significant this is for actual authentication. The tutorial used Here lists a public hash on the client which is never used in the server side code. It just hashes the content and privateHash values together and compares them on the server. As this is all being passed through the headers, I am wondering how secure this actually is? What is the publicHash value for as it does not even seem to be used?
Client:
<?php
$publicHash = '3441df0babc2a2dda551d7cd39fb235bc4e09cd1e4556bf261bb49188f548348';
$privateHash = 'e249c439ed7697df2a4b045d97d4b9b7e1854c3ff8dd668c779013653913572e';
$content = json_encode( array( 'test' => 'content' ) );
$hash = hash_hmac('sha256', $content, $privateHash);
$headers = array(
'X-Public: '.$publicHash,
'X-Hash: '.$hash
);
$ch = curl_init('http://domain.com/api2/core/device/auth');
curl_setopt($ch,CURLOPT_HTTPHEADER,$headers);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
curl_setopt($ch,CURLOPT_POSTFIELDS,$content);
$result = curl_exec($ch);
curl_close($ch);
echo "RESULT\n======\n".print_r($result, true)."\n\n";
?>
Server
function auth()
{
$app = \Slim\Slim::getInstance();
$request = $app->request();
$publicHash = $request->headers('X-Public');
$contentHash = $request->headers('X-Hash');
$privateHash = 'e249c439ed7697df2a4b045d97d4b9b7e1854c3ff8dd668c779013653913572e';
$content = $request->getBody();
$hash = hash_hmac('sha256', $content, $privateHash);
if ($hash == $combinedHash)
{
$data = array('status' => "success");
response($data);
}
else
{
$data = array('status' => "failed");
response($data);
}
}

Answer 1

I think the article you posted uses the term hash in confusing way. In the article $publicHash is an username and $privateHash is secret key used to sign the payload.
In other words, like the article says the value of X-Public header is supposed to be used for querying the user specific secret key from database. This secret key is then used to to create an hash from the payload. This hash is then compared to value of X-Hash header.
If the values match then you can be sure the payload has not been tampered and/or the sender of the payload knows the secret key.
This approach is not stateless. It requires you to hit database for each request to find out the secret key for current user. It is also bit problematic if your client is untrusted (ie. JavaScript enabled browser). Works well for machine to machine communication though.
Alternative
You might want to check article called Using JSON Web Tokens as API Keys. JSON Web Tokens provide stateless solution. They are also tamper proof because tokens are signed / hashed with HMAC.