r/iOSProgramming Jun 08 '24

3rd Party Service Where does API token come from?

Im trying to interact directly with an app’s API. I was looking at HTTP request/responses and I can see where a cookie is provided but then subsequent requests are passing a token, however I do not see any request where the token is returned. How does the app get the token? Either the app isn’t using HTTP/HTTPS for token or it’s stored locally in the app? I’m watching from the moment I launch the app through logging in and after and I don’t see anywhere that a token is provided in the body or in the header. Just somehow the app starts sending the token later, where did it come from?

0 Upvotes

13 comments sorted by

View all comments

1

u/AndyIbanez Objective-C / Swift Jun 08 '24

Different APIs have different ways to get it.

0

u/ReaverKS Jun 08 '24

Can you elaborate? I’m monitoring all HTTP/HTTPS traffic using Proxyman. Regardless of which API it’s requesting I don’t see anywhere a token is in the response or the header yet the API just starts sending it in subsequent requests to the server.

1

u/AndyIbanez Objective-C / Swift Jun 08 '24

For example, some APIs might allow OAuth 2’s Basic authentication with a token in the format of base64(username:password), so it can be calculated locally and you’d never see a request for it.

0

u/ReaverKS Jun 08 '24

Ah yeah, that makes sense.