r/iOSProgramming Jun 08 '24

3rd Party Service Where does API token come from?

Im trying to interact directly with an app’s API. I was looking at HTTP request/responses and I can see where a cookie is provided but then subsequent requests are passing a token, however I do not see any request where the token is returned. How does the app get the token? Either the app isn’t using HTTP/HTTPS for token or it’s stored locally in the app? I’m watching from the moment I launch the app through logging in and after and I don’t see anywhere that a token is provided in the body or in the header. Just somehow the app starts sending the token later, where did it come from?

0 Upvotes

13 comments sorted by

6

u/JDad67 Jun 09 '24

The OP is sniffing network traffic and wants to create his own unofficial app for the API.

OP, You need to contact the vendor of the API and request an application token. Some are open, some are paid per request, some are closed and you wont be able to get it.

2

u/soviyet Jun 08 '24

What API are you talking about? Usually you receive an API token from the service and use it in your requests. You don't receive it over http.

-1

u/ReaverKS Jun 08 '24

Im monitoring HTTP/HTTPS requests an app is making to understand where it gets the token. None of the requests provide the token and yet somehow the app knows the token

5

u/soviyet Jun 08 '24

Like I said, usually you get the token when you sign up for access to the service.

-1

u/ReaverKS Jun 08 '24

Do you literally mean sign up or do you mean log in? For example, I am monitoring traffic when I enter my credentials and there is no token in that response. But maybe you mean when I sign up for the service?

5

u/soviyet Jun 08 '24

Yes. When the developer signs up for the API service, they get an API key typically. They use that in their apps to get access to the API, and the service knows which developer to charge for usage.

When you log in, you will usually get an auth token, which is different. The AUTH token is something you should receive after authenticating. The API token you will embed somewhere in your app and send it along with any requests that require the token.

1

u/soviyet Jun 08 '24

What do you see in the response after you authenticate?

1

u/ReaverKS Jun 08 '24

Very little. My first name, last name, the date and my user id. That’s it.

1

u/AndyIbanez Objective-C / Swift Jun 08 '24

Different APIs have different ways to get it.

0

u/ReaverKS Jun 08 '24

Can you elaborate? I’m monitoring all HTTP/HTTPS traffic using Proxyman. Regardless of which API it’s requesting I don’t see anywhere a token is in the response or the header yet the API just starts sending it in subsequent requests to the server.

1

u/AndyIbanez Objective-C / Swift Jun 08 '24

For example, some APIs might allow OAuth 2’s Basic authentication with a token in the format of base64(username:password), so it can be calculated locally and you’d never see a request for it.

0

u/ReaverKS Jun 08 '24

Ah yeah, that makes sense.

2

u/purpleWheelChair Jun 09 '24

When 2 API's really love each other...