📱 How to Capture x-device-code

A comprehensive guide for mobile app developers and security researchers

🔍 What is x-device-code?

x-device-code is a unique identifier sent in HTTP headers by mobile applications. This identifier is typically used for:

• Device-level authentication
• Request validation
• User tracking
• API communication security

When you see this in request headers (as shown in the image), it represents a device-specific signature that APIs use to verify legitimate requests.

📱 iOS Devices — Using Reqable

Requirements

• Reqable installed on Windows/Mac
• iPhone connected to same Wi-Fi network
• SSL Proxying configured in Reqable
• Trust certificate installed on iPhone

Step-by-Step Instructions

1. 1
   Install & Configure Reqable
   • Download and install Reqable on your computer
   • Enable SSL Proxying: Settings → SSL Proxying → Enable it
   • Add :* to capture all traffic
2. 2
   Setup iPhone Proxy
   • On your iPhone: Settings → Wi-Fi → [Your Network] → ⓘ
   • Set HTTP Proxy to Manual
   • Enter your computer's IP address
   • Port: 8888 (default Reqable port)
3. 3
   Install Certificate
   • On iPhone, open Safari
   • Navigate to: http://reqable.com/cert
   • Tap to download the certificate
   • Install the profile: Settings → General → Profiles
   • Trust the certificate: Settings → General → About → Certificate Trust Settings → Enable full trust
4. 4
   Capture Traffic
   • Launch the target app on your iPhone
   • In Reqable, filter requests by domain (optional)
   • Locate requests to the target API
   • Examine headers for x-device-code value

🤖 Android Devices — Using Reqable + ADB

Requirements

• Reqable installed on your computer
• Android Debug Bridge (ADB)
• Android device with USB Debugging enabled

Step-by-Step Instructions

1. 1
   Prepare Android Device
   • Enable Developer Options (tap Build Number 7 times)
   • Enable USB Debugging in Developer Options
   • Connect device via USB to your computer
2. 2
   Configure Reqable
   • Enable HTTPS decryption in Reqable
   • In Reqable, go to Device tab → click Install Certificate to Android
3. 3
   Setup Certificate on Android
   • Follow the prompts in Reqable
   • Reqable will install its SSL certificate and configure the proxy automatically
4. 4
   Capture x-device-code
   • Launch the target app
   • Monitor traffic in Reqable
   • Look for the x-device-code header in API requests

💻 Android Emulator (Nox) — Rooted Method

Requirements

• Rooted Nox emulator
• Reqable configured for HTTPS inspection
• Root Explorer (or similar file manager with root access)

Step-by-Step Instructions

1. 1
   Setup Nox
   • Enable Root access in Nox settings
   • Install a file manager with root capabilities (e.g., Root Explorer)
2. 2
   Prepare Certificate
   • Export Reqable's certificate:
   • In Reqable: Settings → SSL Proxying → Export Certificate (.crt)
   • Rename to reqable.pem (lowercase, no spaces)
3. 3
   Install Certificate
   • Copy certificate to Nox's shared folder
   • Using Root Explorer, navigate to /system/etc/security/cacerts/
   • Copy reqable.pem to this location
   • Set permissions to 644 (rw-r--r--)
4. 4
   Configure Proxy
   • In Nox, go to Wi-Fi settings
   • Long-press your connected network
   • Modify network → Advanced options
   • Set proxy to Manual
   • Enter your computer's IP address and port 8888
5. 5
   Verify & Capture
   • Reboot Nox
   • Launch target application
   • Monitor traffic in Reqable
   • Look for the x-device-code in request headers

🎮 LDPlayer — Using Reqable

Requirements

• LDPlayer emulator installed
• Reqable for capturing traffic
• Root access in LDPlayer

Step-by-Step Instructions

1. 1
   Setup LDPlayer
   • Install and launch LDPlayer on your computer
   • Enable Root access in LDPlayer settings
   • Install a file manager with root capabilities
2. 2
   Configure Reqable
   • Set up Reqable as your proxy server
   • Enable SSL Proxying in Reqable settings
   • Export Reqable's SSL certificate
3. 3
   Configure Network Settings
   • In LDPlayer: Settings → Network → Modify Wi-Fi
   • Set proxy to Manual
   • Enter your computer's IP address
   • Port: 8888 (default Reqable port)
4. 4
   Install Certificate
   • Import the certificate to LDPlayer's trusted certificate store
   • For detailed steps, follow our video guide
5. 5
   Capture Traffic
   • Launch your target app in LDPlayer
   • Monitor traffic in Reqable
   • Locate the x-device-code in request headers

📊 Troubleshooting

🛡️ Security Notice

Last updated: April 2025