Question: API flow

[hyundai-kia-connect]

Question: API flow

[fuatakgun]

let's start from fun part, your bonus question; I do not know why Kia made this so complex, it is totally weird, it is close to OAuth but somehow very unique and peculiar itself :)

main questions;

• no. you do not need to rely on these, you can refresh your tokens using PIN. For me, it was a redundant ask to get from user and it was avoidable. Total duration of these calls are not taking too much time, so, I neglected them. You can generate all tokens once and update them using PIN, but I was not able to understand why it would be needed at all.
• yes, you have to do these, as we are expecting KIA to generate server side session for our call. That is also another weird thing, without cookie generation, calls are failing.
• PIN was redundant in my case as I decided to login from scratch every day.

I have modified the APK on my android to accept device SSL certificates, then used Fiddler Network Analyzer on my computer and setup proxy on my android phone's wifi connection to redirect the traffic into my computer. I have also installed Fiddler generated SSL certificate into android device so I can decrypt ongoing traffic and response. You can give it a try and try to solve the puzzle :)

Please ask if you need more information and feel free to resolve.