Signing and encryption solve different problems
A signature helps a server check a request’s authenticity or integrity. Encryption hides the payload from readers who do not hold the needed key. An app can use both.
Keep the two flows separate while tracing them. The encrypted body can also be an input to a signature, so the order matters.
Find every input to the signature
Trace the method, path, query, headers, body, time, nonce, and session values used by the app. Record the exact order and encoding.
Do not assume the algorithm from a header name. Compare the code path with controlled runtime requests. A constant found in a file is not proof that it is the active key.
Track changing values to their source
Dynamic headers can come from login, a device session, a clock, stored state, or a server challenge. Name the source and lifetime of each value.
A client needs a way to obtain or refresh required state. Hard-coded values hide expiry problems until the first real use.
Keep sensitive data out of examples
Use environment variables or a suitable secret store for credentials. Redact tokens, cookies, keys, and personal data in public requests and logs.
Provide safe examples that preserve the shape of the request. Make missing credentials fail clearly rather than silently using a sample account.
Make the request construction testable
Keep a redacted request fixture with the method, path, query, headers, and body. Give changing inputs explicit names. Test the builder with fixed synthetic inputs before testing a live session.
Use a fresh-session test for the complete flow. A fixture proves deterministic construction for its inputs; it does not prove that a live key or integrity response is valid. Record both kinds of checks separately.
An integrity verdict is issued and evaluated as part of an app and backend flow. Google’s Play Integrity documentation describes app, account, and device signals. Treat those dependencies as part of the tested environment, not as a generic header to copy.
Test a fresh flow
Start from a fresh allowed session, build the request, send it, parse the response, then repeat with changed inputs. Test refresh and error paths that belong to the scope.
Saved traffic is useful evidence. A fresh successful client run is the proof that the rebuilt flow works in the tested environment.
Build what you need.
Upload your app. We extract its APIs and build your client.
Upload your app