-
Notifications
You must be signed in to change notification settings - Fork 3
How Conch Bay Works
People may ask how Conch Bay works and why a 3rd party app can access SplatNet 3 and download results. This article will talk thoroughly about the mechanism of Conch Bay.
Token generation is the first step of logging in in Conch Bay, and it is also the most important part of Conch Bay. You can check the login flow of imink. Conch Bay works similarly to imink except for the final part.
Conch Bay will try to get the session token at the very beginning. The session token is valid for 2 years and can only be revoked by changing the security option (e.g., password) of the Nintendo Account. The session token is the entry of the Nintendo Account logging in process. Then from the session token, Conch Bay will acquire the web service token, country, and preferred language. The web service token is valid for about 2.5 hours, it is the entry of the Nintendo Switch Online service. Last, Conch Bay will get the bullet token, which is the entry of SplatNet 3, valid for only 2 hours.
For security reasons, Conch Bay will generate a web service token and a bullet token each time it is launched. The session token will never be refreshed, and a relogging in should be taken place if it is expired.
Conch Bay leverages the imink f API and nxapi znca API for f generation in web service token generation.
Conch Bay can also acquire tokens using Mudmouth. Mudmouth is a network diagnostic tool on iOS, it can capturing requests securely and trigger workflows before and after capturing. To acquire web service token, it asks Mudmouth to listen on Nintendo Switch Online in the MitM way. Then, Mudmouth requests VPN and root certificate to inject traffic, and send back to Conch Bay by the given URL Scheme.
When tokens are ready, Conch Bay can then access SplatNet 3. Conch Bay will mimic the behavior of SplatNet 3, send structured requests to the server, and get necessary data in responses, including friends, results, and gears.
For security concerns, Conch Bay will limit the rate and add random delays in sending requests to the server to avoid potential account restrictions.