Available Now

Self-Hosted Source Code

Three server-side codebases covering the RedNote app, RedNote web and the Dandelion (PGY) platform. Compile and self-host them yourself — intended for protocol and algorithm study.

RedNote App

API wrapper service for the mobile client, including a server-side implementation of the client request signing.

· 100+ wrapped endpoints
· Device registration · guest and logged-in states
· Targets a specific RedNote 9.x client version
· Auto challenge fetch and response decoding, solving not included

RedNote Web

Server-side implementation of the web request signing and the security-verification flow. A completely separate algorithm from the app side.

· The signing implementation is the core asset
· Anonymous cookies generated from scratch
· Extend to more endpoints yourself
· Auto challenge fetch and response decoding, solving not included

Dandelion (PGY)

API wrapper for the Dandelion commercial platform. Requires your own logged-in account cookie at runtime.

· Creator data and audience breakdowns
· Reuses the web signing stack
· Bring your own account cookie
· Accounts not provided

Included With Each

All three share the same project layout, deployment and auth model

Full source

Compiles as-is, with very few third-party dependencies

Containerised deployment

Dockerfile and compose orchestration — one command to bring it up

Documentation

Product overview, deployment guide and usage tutorial (in Chinese)

Built-in API docs and auth

Swagger UI for direct testing, multi-tenant API key system; the app package also ships a visual console

Algorithms and Capabilities Covered

The parameters each package can generate and the key flows already implemented, so you can tell whether it covers what you want to study

RedNote App

a completely separate algorithm from the web side

Request parameters it can generate

shield x-mini-mua x-mini-sig x-mini-nsig x-mini-s1 x-mini-gid xy-common-params xy-platform-info x-legacy-did x-legacy-fid x-legacy-sid x-legacy-smid x-b3-traceid

Device fingerprint generation

Produces a self-consistent hardware and OS snapshot for one device: model, OS version, build number and kernel version, with the fields matching each other rather than randomly stitched together.

Device registration

The seven upstream registration steps are wrapped into a single call, producing a reusable device profile. Registration alone yields a guest state that can already call a handful of public endpoints; after the SMS and login steps you write the logged-in state back into the same profile and use it for anything that requires being signed in. Device profiles persist and come with full CRUD.

Security-verification response decoding

Decrypts the ciphertext returned by the verification endpoint to recover the pick-2-of-6 images and prompt text, then encrypts the answer with the same algorithm when submitting.

Business coverage

Note collection, interactions, publishing and media upload, account profile, comments and direct messages, cold-start config, and more — over a hundred endpoints in total.

RedNote Web

the signing layer is the core; extend endpoints on top of it

Request parameters it can generate

X-S X-T X-S-Common a1 webId xsecappid

Anonymous cookie derivation

Generates the cookie-derived values an anonymous web session needs, without having to run a browser first.

Security-verification flow

Fetches the challenge and submits the answer automatically, with decoded fields attached to the response. Solving is not included — the answer is yours to work out.

Dandelion (PGY)

reuses the web signing stack

Request parameters it can generate

X-S X-T X-S-Common

Data coverage

Creator listing and filtering, creator detail and rate cards, note breakdowns and conversion metrics, audience summary / profile / growth history, core metrics and data overview. Requires your own logged-in cookie at runtime.

Scope of Use and Limitations

Study material only. The source is provided for protocol analysis, security research and technical study, and is not offered for any other purpose.
No accounts or data. No platform accounts, cookies or platform data are provided; you supply the credentials it needs to run.
No captcha solving. The challenge is fetched and decoded automatically, but the answer is yours to solve (manually or via a third-party service). Recognition is outside the delivery scope.
No proxy resources. Residential proxies are recommended for device registration and SMS sending; proxies are yours to supply.
No availability guarantee. Upstream may change at any time. The source is delivered as-is, with no warranty of availability, timeliness or fitness for a particular purpose.
Compliance is your responsibility. You must assess and comply with the laws of your jurisdiction and the target platform's terms of service. All consequences arising from use of this source rest with you.

Enquiries

For versions, delivery and licensing terms, reach us on Telegram.

Other channels are listed on the contact page