Reverse engineering Google Reader

This is an old topic. Google Reader is one of the few Google products which lacks an API. However, some people managed to reverse-engineering it almost three years ago. There is a well-know post (Google Reader API) from Niall Kennedy, former employee at Technorati, where he explained the underpinnings of Google Reader.

Comments **on that same post **are also interesting. One of them links to the docs of pyrfeed, a RSS/Atom framework which uses Google Reader as storage base. In my opinion, this is the best documentation I found so far about how the protocol works 1.

Interestingly enough, as some googlers admitted, Google Reader was in fact built upon its own API, that means the API came first, however, it has never been released. I believe that since it was one of the first Google products which was bound to an API, there was not a standarized way of doing things at that time, as an outcome, there are a few things which differ from other Google APIs. One of these differences, for example, is how to fetch an user authorization token, which is not based neither on ClientLogin or AuthSub.

Despite the completeness of pyrfeed documentation, I could tell from the comments on Nial Kennedy’s post, that there are still a few developers who do not know how to retrieve an authorization token, and how later, pass this token on requests which may need authorization, like getting a list of your feeds, managing them, or making a feed as starred. Let’s see how it works:

If you wish to perform an operation in Google Reader which requires authentication, you need to provide the following two tokens:

• SID (Session ID)
• Authentication token or T token (do not mix up this token with the Auth token you get by authenticating with ClientLogin)

There are also two ways of retrieving a* Session ID *token :

• If your browser (i.e Firefox) is opened and already logged in any Google site, a valid SID token would be stored in it. Firefox stores its session tokens inside sessionstore.js file. In conclusion, search for the SID inside sessionstore.js if there is any google session opened inside your Firefox.

• Authenticating against Google reader service using ClientLogin mechanism. Google reader service codename is reader. ClienLogin mechanism is fully documented by Google. ClientLogin mechanism returns three tokens, one of them is the SID token.

Once you got a valid SID token, do a GET request to the following URL to get a valid T token.

http://www.google.com/reader/api/0/token

Please notice that you should add the SID token as a cookie on this request, otherwise it would fail.

Once you get both tokens, SID and T, you can successfully perform any Google Reader operation which requires authentication (always pass these two values as cookies)

Finally, let’s review the whole proccess by examples:

1. First, get a valid SID token:

curl https://www.google.com/accounts/ClientLogin
-d Email=just_your_username_here_without_at_gmail_dot_com
-d Passwd=your_password_here
-d source=Google-cURL-Example
-d service=reader

Response:
SID=DQAAAH0AAAC0YHom0L5LDq10xGnbQK_O7OLiX3Qrou4XeA6P469shoM1goEFQT_zVn8YxDV38Y5v3mGJlhSzJuz5xLPqpKEM0Wedks-ak7LLpNjO7dZw779ljOQrC-2UCYFjiktJcfXmof7WeZs7O0SCNCQgPSKaENJ6FBTeDBeQLahUUrajrg
LSID=XXX
Auth=XXX

2. Once you get a valid SID, request a T token:curl -s -X GET http://www.google.com/reader/api/0/token –header “Cookie: SID=DQAAAH0AAAC0YHom0L5LDq10xGnbQK_O7OLiX3Qrou4XeA6P469shoM1goEFQT_zVn8YxDV38Y5v3mGJlhSzJuz5xLPqpKEM0Wedks-ak7LLpNjO7dZw779ljOQrC-2UCYFjiktJcfXmof7WeZs7O0SCNCQgPSKaENJ6FBTeDBeQLahUUrajrg”

Response:
kArWxxwBAAA.vegUbtUjv2Vvf_HKWlwjIA.QfhP1LoSb5ghYPz_AbOG_Q

3. Once you get a valid T token, perform any Google Reader operation you want, for instance, retrieve a list of your feeds

Resources:

1 pyrfeed, Google Reader API