# How do bots exploit mobile app APIs that the website never exposes? | BotBulwark

Source: https://botbulwark.com/blog/2026-10-29-mobile-api-bots-hidden-endpoints.html

[Home](../index.md) / [Blog](index.md)


October 29, 2026 - BotBulwark

**Short answer:** The API behind a mobile app is part of your store, whether or not it appears on the website. It needs the same login screening, rate limits, and inventory controls as the web checkout, plus signing and attestation checks that are honest about their limits.

## The side door is documented in the app itself

Anyone can download an app, route its traffic through a proxy, and read the requests it makes. The endpoints, the parameter names, and the authentication flow are all there. Security through not mentioning the API is not security; it is a delay measured in hours.

What the operator finds is often a generation behind the website: an older login endpoint without breached password screening, a product feed with generous rate limits meant for app prefetching, or a coupon validation call that answers as many times as it is asked. Each one was reasonable inside the app design. Together they are a toolkit.

## Why app traffic is hard to judge

A website gives defenders browser signals: fingerprints, header order, JavaScript behaviour. An API receives structured calls that legitimate apps make identically, which means a botnet replaying those calls looks a lot like a fleet of phones.

App signing and device attestation help, and both get bypassed on rooted devices and emulators run at scale. Treat them as a cost raiser for the attacker, not as proof of humanity. The proof has to come from behaviour over time: account age, session history, and whether the actions make sense as a sequence.

## The endpoints that get abused first

Login and password reset, for credential stuffing with no web defences in the way. Gift card and coupon validation, because an unlimited oracle that answers valid or invalid is a guessing machine. Inventory and price feeds, scraped to time scalping runs. And checkout itself, where app only payment flows sometimes skip checks the web team added after the last incident.

The pattern in post incident reviews is consistent: the control existed, on the website. Nobody owned the inventory of API routes, so nobody noticed the same route existing twice with different rules.

## One inventory, one rule set

List every API route that touches login, payment, inventory, or discounts, and write next to each one the controls it carries. The gaps will be visible on one page. Then test the list the way an operator would: replay app traffic from a script, vary the obvious parameters, and see which answers change.

Retire what the app no longer calls. Old version endpoints kept alive for a shrinking tail of users are the softest targets on the list, and they rarely have an owner who will argue for them.

Keep reading: [Scrapers stealing prices: signs your catalogue is being copied](https://botbulwark.com/blog/2026-10-29-scrapers-stealing-prices-catalogue-copied.md), [Fake account signups: stopping bulk registrations without blocking buyers](https://botbulwark.com/blog/2026-10-29-fake-account-signups-bulk-registrations.md), and [Rate limiting that stops bots without slowing real shoppers](https://botbulwark.com/blog/2026-10-27-rate-limiting-bots-real-shoppers.md) cover the nearby cases in this series.

## Frequently asked questions

### How do bot operators find a mobile app API?

They proxy the app traffic on a device they control and read the requests directly. Endpoints, headers, and token formats are all visible. Any defence plan that assumes the API is secret fails at this first step.

### Does app attestation stop API bots?

It stops casual replay and raises the cost of serious abuse, since attackers must defeat it on emulators or rooted devices. It does not prove a human is present. Behavioural checks and rate limits still have to run behind it.

### Which API endpoints should a store audit first?

Login, password reset, coupon and gift card validation, inventory feeds, and checkout. These carry the money or the access, and they are the routes most often left on older, weaker rules than the equivalent web pages.

### Why do API defences lag behind website defences?

Different teams and different release cycles. The web team adds a control after an incident; the API, built earlier by another team, keeps serving the same function without it. A single route inventory with a named owner is the organisational fix.

## See your own numbers.

A free bot-traffic audit shows the human-automated split in your live traffic - no code changes, no commitment.

[Get a free bot-traffic audit](mailto:hello@botbulwark.com?subject=Free%20free%20bot-traffic%20audit)