> I can't think of a scenario where you'd need to deconstruct their front-end to mimic the calls. The article mentioned that important API calls are signed. So

> I can't think of a scenario where you'd need to deconstruct their front-end to mimic the calls. The article mentioned that important API calls are signed. So you would need at least partially to deconstruct their front-end to invoke the calls. Any other nefarious purposes aside, this seems explicitly anti-bot because you can change the obfuscation whenever you like, forcing another RE effort.