Self-Hosted Source Code
Three server-side codebases covering the RedNote app, RedNote web and the Dandelion (PGY) platform — request signing, device registration, automatic captcha solving and a full automation toolkit, working against both the mainland and overseas apps. Compile and self-host them yourself — intended for protocol and algorithm study.
The test key is free: register, verify your email, then request it from the dashboard — valid for 1 day, 20 requests/minute, 100 requests/day. Purchases are self-serve in the same place.
RedNote App
API wrapper service for the mobile client, including a server-side implementation of the client request signing.
- · 100+ wrapped endpoints
- · Device registration · guest and logged-in states
- · Targets a specific RedNote 9.x client version
- · Captcha solved automatically, end to end
RedNote Web
Server-side implementation of the web request signing and the security-verification flow. A completely separate algorithm from the app side.
- · The signing implementation is the core asset
- · Anonymous cookies generated from scratch
- · Extend to more endpoints yourself
- · Captcha solved automatically, end to end
Dandelion (PGY)
API wrapper for the Dandelion commercial platform. Requires your own logged-in account cookie at runtime.
- · Creator data and audience breakdowns
- · Reuses the web signing stack
- · Bring your own account cookie
- · Accounts not provided
Included With Each
All three share the same project layout, deployment and auth model
Full source
Compiles as-is, with very few third-party dependencies
Containerised deployment
Dockerfile and compose orchestration — one command to bring it up
Documentation
Product overview, deployment guide and usage tutorial (in Chinese)
Built-in API docs and auth
Swagger UI for direct testing, multi-tenant API key system; the app package also ships a visual console
Algorithms and Capabilities Covered
The parameters each package can generate and the key flows already implemented, so you can tell whether it covers what you want to study. Both the mainland and overseas RedNote apps are supported.
Automation
Mainland and overseas appsAutomated sign-up and login
Device registration, SMS code and login chained into a single call, with any security challenge along the way solved automatically.
Automated note publishing
Image and video upload, cover, topics and location assembled through to a published note.
Automated comment replies
Pull comments and sub-comments, locate the target thread, post a reply.
Automated direct messages
Conversation list and message send/receive, including reaching a batch of users.
Account restriction checks
Read account status and penalties to spot rate-limited or banned accounts and drop them from a batch early.
Data crawling
Notes, users, search, topics and products — available in both guest and logged-in states.
Bulk account management
Many accounts each bound to their own device profile, centrally scheduled, with full CRUD and status tracking.
Account import and export
Export accounts together with their device profiles and import them into another deployment — migration and backup.
All of the above ship as server-side endpoints for you to orchestrate as you like; accounts and proxies are yours to provide.
RedNote App
a completely separate algorithm from the web sideRequest parameters it can generate
shield x-mini-mua x-mini-sig x-mini-nsig x-mini-s1 x-mini-gid xy-common-params xy-platform-info x-legacy-did x-legacy-fid x-legacy-sid x-legacy-smid x-b3-traceidDevice fingerprint generation
Produces a self-consistent hardware and OS snapshot for one device: model, OS version, build number and kernel version, with the fields matching each other rather than randomly stitched together.
Device registration
The seven upstream registration steps are wrapped into a single call, producing a reusable device profile. Registration alone yields a guest state that can already call a handful of public endpoints; after the SMS and login steps you write the logged-in state back into the same profile and use it for anything that requires being signed in. Device profiles persist and come with full CRUD.
Automatic security verification
The whole flow runs unattended: fetch the challenge, decrypt the ciphertext to recover the pick-2-of-6 images and prompt text, solve it automatically, then encrypt the answer with the same algorithm and submit. No human in the loop, no third-party solver needed.
Business coverage
Note collection, interactions, publishing and media upload, account profile, comments and direct messages, cold-start config, and more — over a hundred endpoints in total.
RedNote Web
the signing layer is the core; extend endpoints on top of itRequest parameters it can generate
X-S X-T X-S-Common a1 webId xsecappidAnonymous cookie derivation
Generates the cookie-derived values an anonymous web session needs, without having to run a browser first.
Automatic security verification
Fetches the challenge, solves it automatically, submits and checks the result, with decoded fields attached to the response — transparent to the caller.
Dandelion (PGY)
reuses the web signing stackRequest parameters it can generate
X-S X-T X-S-CommonData coverage
Creator listing and filtering, creator detail and rate cards, note breakdowns and conversion metrics, audience summary / profile / growth history, core metrics and data overview. Requires your own logged-in cookie at runtime.
Scope of Use and Limitations
- Study material only. The source is provided for protocol analysis, security research and technical study, and is not offered for any other purpose.
- No accounts or data. No platform accounts, cookies or platform data are provided; you supply the credentials it needs to run.
- No accuracy guarantee on captcha solving. Security challenges are solved automatically, but the success rate moves with upstream changes and is not guaranteed; failures are retried per the retry policy.
- No proxy resources. Residential proxies are recommended for device registration and SMS sending; proxies are yours to supply.
- No availability guarantee. Upstream may change at any time. The source is delivered as-is, with no warranty of availability, timeliness or fitness for a particular purpose.
- Compliance is your responsibility. You must assess and comply with the laws of your jurisdiction and the target platform's terms of service. All consequences arising from use of this source rest with you.
Purchase and Delivery
Entirely self-serve: order in the dashboard → on-chain confirmation → automatic delivery → download any time
Cryptocurrency only
USDT / USDC / PYUSD on TRON, Ethereum or Solana. No cards, no Alipay, and account balance cannot be used.
Delivered on confirmation
Once the transfer confirms on-chain, download access is granted automatically and a confirmation email goes out. No manual step.
Download any time
Signed one-off links from the My Products page in the dashboard, three downloads per file per day; later revisions stay available to existing buyers.
No refunds
Digital goods are complete on delivery, so purchases are non-refundable. Try the free test key first to confirm the capabilities match what you need.
Still Have Questions?
Buying and downloading are self-serve in the dashboard; for versions, coverage and licensing terms, reach us on Telegram.
Contact us on TelegramOther channels are listed on the contact page