[Bundschuh]

I assume you didn't call the login()-method properly. Your api-init is probably correct otherwise you weren't able to call any other api methods.

What is your repsone of the login()-method?
It should contains something like this:

PHP Code:

Array
(
    [session] => Array
        (
            [dbsessionhash] => a123....
            [userid] => 1
        )
    [response] => Array
        (
            [errormessage] => Array
                (
                    [0] => redirect_login
                    [1] => admin
                )
        )
) 


Response from buddy()-method look like this:

PHP Code:

{"response":{"buddies":"0"},"show":{"playsound":0}} 


Because of technical limits, this method is unable to return a new securitytoken. So after this API call (login_login), client should call api_init (get new session as well as new common $show variables) or api_getsecuritytoken to get the new securitytoken. Once the client gains both the new sessionhash and the securitytoken, please save them in application session vars. After this the login process is done. You need to pass the new sessionhash to the API and use the new securitytoken to sign the requests in future API method calls.

But I do not know how to do it.

I also tried this sequence of method calls but won't work for me.
Just calling api_init, extracting the vars for being able to create the signature etc., call login and then call any further method. You will be logged in until you call logout. There is no need to use the db_sessionhash from the login response, or manually call api_getsecuritytoken. If I do that, I will get only "invalid access token" error messages.

Hope this helps.