Building appsIntermediate · about 30 minFree · no signup

Turn an authorised website into an API client

Explore the official tool, use it only on systems you’re allowed to inspect, and review captured traffic and generated code before running anything.

By Alan Brown · Works with Claude Code

Video cover: Turn an authorised website into an API client

Watch on Instagram ↗

Jump to the prompt ↓

🧰 Reverse API Engineer aims to turn observed website traffic into a reusable client. Try the idea on a site you own or have clear permission to inspect.

🔗 Official open-source project: github.com/kalil0321/reverse-api-engineer
📖 Official documentation: reverseapi.dev/docs/ — check the current install steps, supported capture tools and data flow before setup.
🧪 The project documents browser-traffic capture and AI-assisted client generation. The exact workflow and supported tools can change, so verify the current docs rather than relying only on the reel.
🔐 Network captures can include cookies, authorisation headers and request or response data. Use a test account and synthetic data; redact secrets and keep captures private.
⚖️ Seeing a request in browser traffic does not grant permission to use it. Follow site terms and applicable rules; stop if access controls, rate limits or anti-bot protections block you.
🧾 Treat generated code as untrusted until reviewed. Inspect its network calls, dependencies and secret handling before running it.

Context & limitations

Use the prompt below to plan a narrow, read-only experiment on a site you’re authorised to inspect, protect captured data and review the generated client before running it.

Do this yourself

I want to explore Reverse API Engineer, an open-source tool for analysing browser traffic and generating an API client: https://github.com/kalil0321/reverse-api-engineer My goal is ___ . The website is ___ . I own it or have explicit permission to inspect it: ___ . I want to retrieve only this public or test data: ___ . My development environment is ___ .

VERIFY THE TOOL FIRST

Read the project's current official documentation, installation instructions, source code, licence and data-handling notes. Check the current release and date. Explain what the tool captures, where captured traffic and generated code are sent or stored, which AI provider is involved, and any limitations. Link to the official project and its docs. Separate what the Instagram video claims from what you verify in the current documentation. Do not install or run anything until I approve the specific plan.

SCOPE AND PERMISSION

Proceed only if I own the website/account or have explicit permission to inspect it. Check the site's terms and the scope of that permission. Prefer my own staging site and synthetic data. If authorisation is unclear, stop and ask me to clarify. Use only the specific pages and read-only requests needed for my stated goal. Do not collect other people's personal or sensitive data, submit forms, make purchases, change records, or access unrelated accounts. Do not bypass authentication, paywalls, access controls, rate limits, CAPTCHA, or anti-bot protections. If the site blocks capture or asks for a challenge, stop rather than evade it.

PROTECT CAPTURED DATA

Before opening a browser session or recording traffic, explain that HAR captures may contain cookies, authorisation headers, request/response bodies and personal data. Use a test account with synthetic data, remove secrets and identifiers, and keep files private and local. Never commit cookies, tokens, HAR files, personal data or credentials to a repository. Do not send captures to an AI provider until I have reviewed what will be shared and its data-handling terms; pause if sensitive information cannot be removed.

BUILD AND REVIEW

Show me the exact read-only requests and fields you propose to use. After I approve the plan, create a small typed client for only those permitted requests. Before running generated code, inspect it for unexpected network calls, writes, secret handling, dependencies and data collection. Keep credentials out of source code and logs. Test with synthetic or staging data, check response schemas and error handling, and report what you tested, what may break if the undocumented site interface changes, and anything you could not verify. Do not claim this is an official API or that access is allowed merely because a request is visible in browser traffic.

A scoped, read-only experiment can help you build a client for data on a site you own or are authorised to inspect. Browser captures can contain cookies and personal information, so decide what may be captured and shared before starting.

Watch on Instagram Source

Want to build this with a teacher?

Pathwise Academy runs small, hands-on AI classes in Singapore for ages 10–17 and adults.

Young Builders Adults