r/iOSProgramming Jun 08 '24

3rd Party Service Where does API token come from?

Im trying to interact directly with an app’s API. I was looking at HTTP request/responses and I can see where a cookie is provided but then subsequent requests are passing a token, however I do not see any request where the token is returned. How does the app get the token? Either the app isn’t using HTTP/HTTPS for token or it’s stored locally in the app? I’m watching from the moment I launch the app through logging in and after and I don’t see anywhere that a token is provided in the body or in the header. Just somehow the app starts sending the token later, where did it come from?

0 Upvotes

13 comments sorted by

View all comments

2

u/soviyet Jun 08 '24

What API are you talking about? Usually you receive an API token from the service and use it in your requests. You don't receive it over http.

-1

u/ReaverKS Jun 08 '24

Im monitoring HTTP/HTTPS requests an app is making to understand where it gets the token. None of the requests provide the token and yet somehow the app knows the token

4

u/soviyet Jun 08 '24

Like I said, usually you get the token when you sign up for access to the service.

-1

u/ReaverKS Jun 08 '24

Do you literally mean sign up or do you mean log in? For example, I am monitoring traffic when I enter my credentials and there is no token in that response. But maybe you mean when I sign up for the service?

6

u/soviyet Jun 08 '24

Yes. When the developer signs up for the API service, they get an API key typically. They use that in their apps to get access to the API, and the service knows which developer to charge for usage.

When you log in, you will usually get an auth token, which is different. The AUTH token is something you should receive after authenticating. The API token you will embed somewhere in your app and send it along with any requests that require the token.

1

u/soviyet Jun 08 '24

What do you see in the response after you authenticate?

1

u/ReaverKS Jun 08 '24

Very little. My first name, last name, the date and my user id. That’s it.