NintendoSwitchRESTAPI VS splatnet2statink

You can learn a lot more here: https://github.com/ZekeSnider/NintendoSwitchRESTAPI

There's nothing officially documented, but people have made some strides to reverse engineer how the companion app works and can pull some data from it.

(me & others have been doing reverse engineering work to build stuff like s3s/splatnet2statink for the past 5+ years. the official API is all locked down in the app and it's not as easy as just spoofing the user agent. trust me, don't re-invent the wheel!)

It’s understandable that you’re concerned about your session_token being sent to other APIs that are not Nintendo. The client_id is a static id that is unrelated to anything about your account security-wise. Unfortunately, there is no other way to do this. Some major release of the NSO mobile app introduced a requirement for making requests: The f token. The f token is terrible and probably stands for “f*** you”, but it’s Nintendo’s method of making sure requests sent from the app are legitimate. The guy that pioneered most of the app’s API documentation (https://github.com/frozenpandaman) mentions that the f token is only generable by some annoying method that includes a very confidential key ‘hidden and encrypted’ in NSO app. Supposedly, he obtained this through some methods, and although he is not at liberty to share it, he provides an API that will use it. After that 3rd party API call, we send it to Flapg API (both of these are mentioned in the README, by the way) to properly get the f token and other related goodies. You can read more about exactly what happens here: https://github.com/frozenpandaman/splatnet2statink/wiki/api-docs