You can replicate the experience of generating a client JWT token in Nfl.com by opening chrome inspector and going to nfl.com then clearing your application local storage and your network console, refreshing the page and then just watching the responses come across the line and how it issues a token.
I'd argue they probably have a bit of a security gap in how they issue tokens because they sent their clientId and clientSecret to the end user which is later posted back to the server create a JWT, when they should probably have some sort of end point that gens a token and also has some site origin protections, but hey makes consumption of the API a bit easier.
Usage:
using (var client = await WebClientFactory.Create())
{
foreach (var week in all)
{
var url = $"https://api.nfl.com/football/v1/games?season={year}&seasonType=REG&week={week}&withExternalIds=true";
var content = await client.DownloadStringTaskAsync(url);
var obj = JsonConvert.DeserializeObject<SeasonStripV2>(content);
// do so0mething here
}
}
The meat and potatoes:
public class WebClientFactory
{
static WebClientFactory()
{
ServicePointManager.ServerCertificateValidationCallback += (o, c, ch, er) =>
{
Console.WriteLine(er);
// I had some cert troubles you may need to fiddle with this if you get a 405
// if (c.Subject?.Trim() == "CN=clubsweb.san1.nfl.com")
// {
// return true;
// }
Console.WriteLine(c);
return false;
};
}
public static async Task<WebClient> Create()
{
var clientInfo = new
{
clientId = "e535c7c0-817f-4776-8990-56556f8b1928",
clientKey = "4cFUW6DmwJpzT9L7LrG3qRAcABG5s04g",
clientSecret = "CZuvCL49d9OwfGsR",
deviceId = "1259aca6-3793-4391-9dc3-2c4b4c96abc5",
useRefreshToken = false
};
var clientUploadInfo = JsonConvert.SerializeObject(clientInfo);
var webRequest = WebRequest.CreateHttp("https://api.nfl.com/identity/v1/token/client");
webRequest.Accept = "*/*";
webRequest.ContentType = "application/json";
webRequest.Method = WebRequestMethods.Http.Post;
await WriteBody(webRequest, clientUploadInfo);
var result = await GetResult(webRequest);
var tokenWrapper = JsonConvert.DeserializeObject<RootV2>(result);
var client = new WebClient();
client.Headers.Add("Authorization", $"Bearer {tokenWrapper.accessToken}");
return client;
}
private static async Task WriteBody(HttpWebRequest webRequest, string clientUploadInfo)
{
using (var stream = webRequest.GetRequestStream())
{
using (var sw = new StreamWriter(stream))
{
await sw.WriteAsync(clientUploadInfo);
}
}
}
private static async Task<string> GetResult(HttpWebRequest webRequest)
{
using (var response = await webRequest.GetResponseAsync())
{
return await GetResult((HttpWebResponse) response);
}
}
private static async Task<string> GetResult(HttpWebResponse webResponse)
{
using (var stream = webResponse.GetResponseStream())
{
using (StreamReader sr = new StreamReader(stream))
{
return await sr.ReadToEndAsync();
}
}
}
private class RootV2
{
public string accessToken { get; set; }
public int expiresIn { get; set; }
public object refreshToken { get; set; }
}
}
Note you can also getting a token by calling this endpoint:
POST "https://api.nfl.com/v1/reroute"
BODY: "device_id=5cb798ec-82fc-4ba0-8055-35aad432c492&grant_type=client_credentials"
and add these headers:
client.Headers[HttpRequestHeader.ContentType] = "application/x-www-form-urlencoded";
client.Headers["X-Domain-Id"] = "100";
