[Python] How to Calculate the Signature for Forge of Empires HTTP Requests?

I'm developing a tool to interact with the Forge of Empires backend and need to generate the correct Signature for HTTP requests. I understand that each request must include a Signature header, which is computed based on certain parameters.

From my research, including resources like m3talstorm/foe-decryption, the process involves:

Concatenating the user_key, a secret, and the JSON-formatted request body.

Computing the MD5 hash of the concatenated string.

Taking the first 10 characters of the hexadecimal representation of the hash as the Signature.

However, I'm uncertain about the exact steps, especially regarding the formatting of the JSON payload and the source of the secret.

Here's what I have:

User Key

Secret: 6q01Zd9YKTSEVjhtqqGEYjBGr3pUTRFojYL+m2/6GorQ892bVcY4QMoqLbc6A+DhXQEaMtZfkczMgiHt3tVJ4w==

JSON Payload:

[{"__class__":"ServerRequest","requestData":[[24997]],"requestClass":"CityProductionService","requestMethod":"pickupProduction","requestId":91}]


I attempted to compute the Signature using Python:

import json
import hashlib
from collections import OrderedDict

user_key =
secret = "6q01Zd9YKTSEVjhtqqGEYjBGr3pUTRFojYL+m2/6GorQ892bVcY4QMoqLbc6A+DhXQEaMtZfkczMgiHt3tVJ4w=="

payload = [OrderedDict([
("__class__", "ServerRequest"),
("requestData", [[24997]]),
("requestClass", "CityProductionService"),
("requestMethod", "pickupProduction"),
("requestId", 91)
])]

encoded = json.dumps(payload, separators=(',', ':'))
data = user_key + secret + encoded
signature = hashlib.md5(data.encode()).hexdigest()[:10]

print("Signature:", signature)


But the resulting Signature doesn't match the expected value.

Continue reading...