Full APK to Python client

What arrives in the Python package

The client includes named methods, request and response models, configuration, dependencies and setup instructions. Session handling covers login, refresh, cookies and expiry. API errors preserve the status and useful response fields so your code can decide what to retry.

For each request we recover the method, path, query encoding, body bytes and generated headers. Signed bodies are serialized once; the same bytes are signed and sent. Uploads, downloads and multi-step workflows include their state and error paths.

A runnable signing example

This example shows HMAC-SHA-256 and a fixed request format. It is an illustration, not code recovered from a customer APK. The actual algorithm, key source and signed fields come from the app being rebuilt.

Run this offline example: download signing.py. It uses a public test key and does not contact an app or backend.

"""Offline HMAC example. Public test key; not an extracted app secret."""
import hashlib
import hmac
import json


def sign(key: bytes, message: bytes) -> str:
    return hmac.new(key, message, hashlib.sha256).hexdigest()


def prepare(key: bytes, timestamp: str, payload: dict) -> tuple[bytes, str]:
    # Illustrative format. A real client's byte order comes from its APK.
    body = json.dumps(payload, separators=(",", ":"), ensure_ascii=False).encode()
    message = timestamp.encode() + b"\nPOST\n/v1/lookup\n" + body
    return body, sign(key, message)


if __name__ == "__main__":
    # RFC 4231, test case 1.
    assert sign(bytes([0x0b]) * 20, b"Hi There") == (
        "b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7"
    )
    body, signature = prepare(b"public-demo-key", "1700000000", {"reference": "ABC123"})
    print(body.decode())
    print(signature)

Tests cover more than one successful call

The example checks the published HMAC test vector from RFC 4231. Project tests also cover the app’s own generated values, token refresh, rejected requests and repeated workflows. Cipher tests check encryption and decryption against the same byte format, including IVs, padding and tags.

Android Keystore keys can be non-exportable and bound to secure hardware. A server that requires proof from that hardware has a runtime dependency that copied code cannot remove. We check this during the APK review and state the deployment requirements before the quote. Android Keystore documentation.

See all delivery formats and the matching TypeScript example.

The full APK is the project

You receive Python, JavaScript/TypeScript, Postman and API documentation for the full application. The work covers endpoints, authentication, request signatures, encryption, decryption, sessions and backend workflows.

Run the complete public demonstration to inspect one matching workflow in every format.

Send the APK on WhatsApp or email. The 24–72 hour delivery window starts after we receive the APK and any account access needed to run it. The fixed quote states the deadline. Most projects finish sooner.