[Python] Unable to fetch data from Dutch Bros app API using Python or inspect traffic with...

Perfect! Here's a Stack Overflow question where you're using Python to try and fetch data from the Dutch Bros API, but it's not working — and you're also trying to inspect the API using Wireshark, but facing issues.

Body:
Hi all,

I'm trying to learn how mobile app APIs work, and for that, I picked the Dutch Bros mobile app. I'm attempting to fetch data (like locations or menu items) via Python by guessing their API endpoint. At the same time, I tried using Wireshark to analyze the traffic from the app directly — but I'm not able to capture anything useful or get a proper response from Python.

1. Python Fetch Attempt


Here’s a simple script I tried:

import requests

url = "https://api.dutchbros.com/stores" # Assumed endpoint
headers = {
"User-Agent": "Mozilla/5.0",
"Accept": "application/json",
}

try:
response = requests.get(url, headers=headers)
print("Status Code:", response.status_code)
print("Response:", response.text)
except Exception as e:
print("Error:", e)

Problem:

• I always get 403 Forbidden or sometimes just a timeout.
• I tried modifying headers (User-Agent, Referer, etc.) but still no luck.
• I assume the API is restricted to the mobile app or behind authentication.

2. Wireshark Traffic Capture


To figure out the exact endpoint and how the app communicates, I used Wireshark:

• My phone and PC are on the same Wi-Fi.
• I applied filters like ip.addr == <phone-ip>, http, tcp.port == 443.
• I opened and used the Dutch Bros app while capturing packets.

Wireshark Problem:

• I can't see any obvious API calls.
• Most of the traffic is encrypted (HTTPS) and I can't decrypt it.
• Possibly the app uses certificate pinning or a secure channel that can't be inspected easily.

What I’m Looking For:

1. How can I fetch API data from the Dutch Bros app using Python, or is there a way to bypass 403 or auth (for learning only)?
2. Any way to see decrypted app traffic from Android using Wireshark or some better tool?
3. Is the API using certificate pinning, and if yes, how to bypass it (rooted Android or with mitmproxy maybe)?

I’m not trying to exploit or misuse anything — just want to understand how mobile apps structure and secure their APIs. Any insights or suggestions would be super helpful!

Thanks

Continue reading...