If you look at the `network` tab in developer tools, you'll see every http request made by your browser, and the headers that are sent along with the request.

If you look at the `network` tab in developer tools, you'll see every http request made by your browser, and the headers that are sent along with the request. e.g. when you hit the `reply` button in HN, it'll make some HTTP request, with a cookie in the header that identifies your user session. You can right-click on the request and click "copy request as curl", and then paste it into a terminal to duplicate the request locally. Fore example, Stripe has some API endpoints that are only available to logged-in dashboard.stripe.com users. They are not documented in the public API spec, and they have more powers than the public API. If you do the actions in the dashboard and record the requests, you can use those undocumented APIs: all you need it a session token! This leads down an unstable path, where you write a browser-emulating script to login to $service, scrape the cookie, and then use the cookie to make requests against the $service's undocumented API. Not a good idea to build companies on this logic, but it's fine and fun for personal projects.