Skip to content

http-api.md

Latest commit

 

History

History
55 lines (36 loc) · 2.31 KB

http-api.md

File metadata and controls

55 lines (36 loc) · 2.31 KB
Raw

HTTPS API: login and instance reservation

Photon never runs at login. A login capture is 100% TLS to api.vrchat.cloud (Cloudflare). The PhotonToken is produced later, at join, by the reservation call, then relayed into UDP Init.

Base: https://api.vrchat.cloud/api/1.

Headers

From VRC.Core.API.PopulateHTTPRequestHeaders:

User-Agent
X-MacAddress
X-Client-Version
X-Platform
X-Unity-Version
X-GameServer-Version
X-VRC-Auth-Allow-Roaming
X-VRC-Client-Framework
X-SDK-Version

AuthenticateHTTPRequest attaches the session cookie. Certificate pinning: VRC.Core.ApiCertificateVerifier.

Login

VRC.Core.ApiCredentials persists auth / 2FA tokens.

  1. GET /auth/user with Basic username:password or a saved auth cookie → user object, or 401 + OTP challenge.
  2. 2FA: POST /auth/twofactorauth/totp/verify (email/SMS variants exist). Sets auth.
  3. Steam: session ticket (ticket invalid, retrying ({0}/{1})).
  4. auth/user/eos/token — EOS token for voice / services.
  5. OAuth: auth/discord/v…, auth/google/v…, auth/{provider}/v{version}/link|unlink.

VRC.Core.API2FA exposes TOTP / email / SMS support flags. State machine: APIUser.<ProcessAuthentication>d__48.

Config is fetched first (api/1 version prefix, apiKey query).

These paths are from decrypted string literals and the PC/Android API types. Login-time pcaps are TLS, so request lines are not on the wire.

Instance join (HTTPS)

VRC.Core.ApiWorldInstance:

  • ExtractInfoFromLocation parses worldId:instanceId~region(xx)~nonce, ParseTags, NetworkRegionExtensions.ToNetworkRegion.
  • CreateOrFetch / BuildRequest / MakeRequestEndpoint.
  • Endpoint literal instances/reservation. Failure logs: Failed to get join token:, token is not a valid….

The reservation response is the join token / travel JWE later placed in JoinGame game-properties key 2 and (as PhotonToken) in UDP Init. Discovery literals: instances/groups/…, instances/publicsByPopulation, instances/discover.

PhotonToken

Not produced by login. Join-time HTTPS → token → PhotonPeer.Connect(..., photonToken, ...) → PeerBase.WriteInitRequest serializes it as a GpBinaryV18 String.

On the wire (after base64): 0x02 ‖ N×16 opaque bytes. The client cannot read it. See handshake.md and world-join.md.