Dear Community,

as you know we just released our API Hashing Service.

Getting started with something that is new is always difficult. We give our best to make it as easy as possible for you. If you're using a public API, just wait for them to update. All API Maintainers are currently working on implementing the Hashing Service.

In case you have some questions - read our F.A.Q thread first.

Implementing the API

This API is RESTful and is easily implementable in every language.

Endpoints
We have different endpoints that you can use to access our service. Choose whatever you like here as base endpoint for your implementation. All these Endpoints hit the same servers.
1. http://hashing.pogodev.io/
2. https://hashing.pogodev.io/ // This end-point currently does not support SSL (work in progress)
3. http://pokehash.buddyauth.com/
4. https://pokehash.buddyauth.com/

As mentioned above this is the base endpoint.

Supported Pokemon GO API Versions
This hashing service supports multiple API versions. All current supported endpoints are listed here as Json object.

{"1.19":"api/v119/hash","1.21":"api/v121/hash","1.22":"api/v122/hash"}

How does the final endpoint look like?
This is easy. Using the Pokemon GO 1.22 API would require this endpoint:

https://pokehash.buddyauth.com/api/v122/hash

Example
We already have a fully working .NET example that should give you the hint to get started as developer. This code is well documentated and should be self explanatory.

For a full list of currently implemented open APIs where you just need to insert your hashing license I refer to this.

List of working Pokemon GO APIs

The latest available protocol messages are here:

https://docs.pogodev.org/

As a site note: We're still working on setting up Docs, F.A.Q's and all that stuff. But this should give at least developers an overview to get started.

Code Example

using System;
using System.Collections.Generic;
using System.IO;
using System.Net;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;
using System.Threading.Tasks;
using Google.Protobuf;
using Newtonsoft.Json;
using Niantic.Rpc;

namespace HashServer.Tests
{
	public class HashResponseContent
	{
		public uint LocationAuthHash { get; set; }
		public uint LocationHash { get; set; }

		// Note: These are actually "unsigned" values. They are sent as signed values simply due to JSON format specifications. 
		//       You should re-cast these to unsigned variants (or leave them as-is in their byte form)
		public List<long> RequestHashes { get; set; }
	}

	public class HashRequestContent
	{
		/// <summary>
		///     The timestamp for the packet being sent to Niantic. This much match what you use in the SignalLog and RpcRequest
		///     protos! (EpochTimestampMS)
		/// </summary>
		public ulong Timestamp { get; set; }

		/// <summary>
		/// The Latitude field from your ClientRpc request envelope. (The one you will be sending to Niantic)
		/// For safety reasons, this should also match your last LocationUpdate entry in the SignalLog
		/// </summary>
		public double Latitude { get; set; }
		/// <summary>
		/// The Longitude field from your ClientRpc request envelope. (The one you will be sending to Niantic)
		/// For safety reasons, this should also match your last LocationUpdate entry in the SignalLog
		/// </summary>
		public double Longitude { get; set; }
		/// <summary>
		/// The Altitude field from your ClientRpc request envelope. (The one you will be sending to Niantic)
		/// For safety reasons, this should also match your last LocationUpdate entry in the SignalLog
		/// </summary>
		public double Altitude { get; set; }

		/// <summary>
		///     The Niantic-specific auth ticket data.
		/// </summary>
		public byte[] AuthTicket { get; set; }

		/// <summary>
		///     Also known as the "replay check" field. (Field 22 in SignalLog)
		/// </summary>
		public byte[] SessionData { get; set; }

		/// <summary>
		///     A collection of the request data to be hashed.
		/// </summary>
		public List<byte[]> Requests { get; set; } = new List<byte[]>();
	}

	internal class Program
	{
		/// <summary>
		/// This method is an example of the API usage. Please note that it has zero useful handling for errors other than returning null.
		/// Callers do not know what the error is. You will need to modify this to fit your needs.
		/// </summary>
		public static async Task<HashResponseContent> RequestHashesAsync(HashRequestContent request)
		{
			// This value will determine which version of hashing you receive.
			// Currently supported versions:
			// v119 -> Pogo iOS 1.19
			// v121 -> Pogo iOS 1.21
			const string endpoint = "api/v119/hash";

			// NOTE: This is really bad. Don't create new HttpClient's all the time.
			// Use a single client per-thread if you need one.
			using (var client = new HttpClient())
			{
				// The URL to the hashing server.
				// Do not include "api/v1/hash" unless you know why you're doing it, and want to modify this code.
				client.BaseAddress = new Uri(Config.EndpointUrl);

				// By default, all requests (and this example) are in JSON.
				client.DefaultRequestHeaders.Accept.Clear();
				client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

				// Set the X-AuthToken to the key you purchased from Bossland GmbH
				client.DefaultRequestHeaders.Add("X-AuthToken", Config.AuthToken);

				
				var content = new StringContent(JsonConvert.SerializeObject(request), Encoding.ASCII, "application/json");
				// An odd bug with HttpClient. You need to set the content type again.
				content.Headers.ContentType = new MediaTypeHeaderValue("application/json");

				var response = await client.PostAsync(endpoint, content);

				// TODO: Fix this up with proper retry-after when we get rate limited.
				switch (response.StatusCode)
				{
						// All good. Return the hashes back to the caller. :D
					case HttpStatusCode.OK:
						return JsonConvert.DeserializeObject<HashResponseContent>(await response.Content.ReadAsStringAsync());

						// Returned when something in your request is "invalid". Also when X-AuthToken is not set.
						// See the error message for why it is bad.
					case HttpStatusCode.BadRequest:
						Console.WriteLine($"Bad request sent to the hashing server! {await response.Content.ReadAsStringAsync()}");
						break;

						// This error code is returned when your "key" is not in a valid state. (Expired, invalid, etc)
					case HttpStatusCode.Unauthorized:
						Console.WriteLine("You are not authorized to use this service.");
						break;

						// This error code is returned when you have exhausted your current "hashes per second" value
						// You should queue up your requests, and retry in a second.
					case (HttpStatusCode) 429:
						Console.WriteLine($"Your request has been limited. {await response.Content.ReadAsStringAsync()}");
						break;
				}
			}

			return null;
		}
		
		private static async Task DoTest()
		{
			// You would feed these values in via your normal API.
			// In this example, we are reading data from a file stored on disk.
			var rpc = RequestEnvelope.Parser.ParseFrom(File.ReadAllBytes(@"F:\pogo-requests\1.19\139977279143977.request"));
			var signal = SignalLog.Parser.ParseFrom(File.ReadAllBytes(@"F:\pogo-requests\1.19\139977279143977.signal"));

			var requestContent = new HashRequestContent
			{
				AuthTicket = rpc.AuthTicket.ToByteArray(),
				Latitude = rpc.Latitude,
				Longitude = rpc.Longitude,
				Altitude = rpc.Altitude,
				Timestamp = signal.EpochTimestampMs,
				SessionData = signal.ReplayCheck.ToByteArray()
			};

			foreach (var rq in rpc.Requests)
				requestContent.Requests.Add(rq.ToByteArray());
			
			// This code is temporary while testing rate limiting.
			// You should NOT be doing requests like this. Ever.
			HashResponseContent response;
			do
			{
				response = await RequestHashesAsync(requestContent);

				if (response == null)
					await Task.Delay(1000);
			} while (response == null);

			//VerifyMatch(response.LocationAuthHash, signal.LocationHashByTokenSeed, "LocationAuthHash");
			//VerifyMatch(response.LocationHash, signal.LocationHash, "LocationHash");

			//for (int i = 0; i < signal.RequestHashes.Count; i++)
			//{
			//	VerifyMatch(response.RequestHashes[i], signal.RequestHashes[i], $"RequestHash[{i}]");
			//}
		}

		private static long Count = 0;
		private static void VerifyMatch(uint a1, uint a2, string field)
		{
			Console.Write($"{field} A1: {a1:X}, A2: {a2:X} - ");
			if (a1 != a2)
				Console.WriteLine($"{field} does not match!");
			else
				Console.WriteLine($"{field} matches!");
		}

		private static void VerifyMatch(long a1, long a2, string field)
		{
			Console.Write($"{field} A1: {a1:X}, A2: {a2:X} - ");
			if (a1 != a2)
				Console.WriteLine($"{field} does not match!");
			else
				Console.WriteLine($"{field} matches!");
		}


		public static void Main(string[] args)
		{
			// 100 -> test temporary 1h/s rate limiter
			for (int i = 0; i < 1; i++)
			{
				Task.Run(DoTest);
			}
			Console.ReadLine();
		}

	}
}