TLS profiles

An app on a phone does not connect like Chrome. Akamai’s mobile SDK checks the TLS handshake and the HTTP/2 settings of every request, and the sensor Roolink returns is built for a device that connects one specific way. Your client has to connect the same way or the sensor is wasted. This page names the profiles for each platform and shows how to load them in each language. Everything else about the request, the headers and their order, comes from a capture of the real app, exactly as it does for a website; see Capture requests with powhttp.

iOS

iOS apps built with Akamai’s SDK connect with one of two handshakes, which we call Standard and Secondary. The handshake also changes between iOS releases, so the profile you pick depends on the ios version in the sensor response.

`ios` in the response	Standard	Secondary
26.2 and later	`StandardIOS26_2`	`SecondaryIOS26_2`
26.0 and 26.1	`StandardIOS26`	`SecondaryIOS26`
Older	`StandardIOS`	`SecondaryIOS`

Start with the Standard profile for the row that matches your device. If the app rejects the session even though the sensor is fresh and the cookies are right, switch to the Secondary profile and try again. Note which one an app accepts so you do not repeat the experiment. The profiles ship in one repository, roolinkio/tlsprofiles, in two forms that produce the same handshake: a Go module for Go, and a profiles.json file that Python and Node hand to the tls-client shared library as a custom client. All three TLS clients in these docs wrap that library, and we check the three against each other: same JA3, same JA4, same HTTP/2 fingerprint for every profile.

import json, os
import tls_client

PROFILES = json.load(open("profiles.json"))


class AppSession(tls_client.Session):
    """A tls_client.Session driven by one entry of profiles.json."""

    def __init__(self, spec, proxy):
        self._spec = spec
        self.trust_anchors_payload = None
        super().__init__(
            client_identifier=None,
            ja3_string=spec["ja3String"],
            h2_settings=spec["h2Settings"],
            h2_settings_order=spec["h2SettingsOrder"],
            pseudo_header_order=spec["pseudoHeaderOrder"],
            connection_flow=spec["connectionFlow"],
            supported_signature_algorithms=spec["supportedSignatureAlgorithms"],
            supported_versions=spec["supportedVersions"],
            key_share_curves=spec["keyShareCurves"],
            disable_http3=True,
        )
        self.proxies = {"http": proxy}
        self.timeout = 30

    def _build_request_payload(self, *args, **kwargs):
        payload = super()._build_request_payload(*args, **kwargs)
        custom = payload["customTlsClient"]
        custom["alpnProtocols"] = self._spec["alpnProtocols"]
        custom["certCompressionAlgos"] = self._spec["certCompressionAlgos"]
        custom.pop("certCompressionAlgo", None)
        return payload


app = AppSession(PROFILES["StandardIOS26_2"], os.environ["PROXY_URL"])

import (
	tls_client "github.com/bogdanfinn/tls-client"
	"github.com/roolinkio/tlsprofiles"
)

app, err := tls_client.NewHttpClient(tls_client.NewNoopLogger(),
	tls_client.WithClientProfile(tlsprofiles.StandardIOS26_2),
	tls_client.WithCookieJar(tls_client.NewCookieJar()),
	tls_client.WithProxyUrl(os.Getenv("PROXY_URL")),
	tls_client.WithDisableHttp3(),
)

import { readFileSync } from "node:fs";
import { ModuleClient, SessionClient } from "tlsclientwrapper";

const profiles = JSON.parse(readFileSync("profiles.json", "utf8"));
const moduleClient = new ModuleClient();

const app = new SessionClient(moduleClient, {
  customTlsClient: profiles["StandardIOS26_2"],
  withRandomTLSExtensionOrder: false,
  disableHttp3: true,
  proxyUrl: process.env.PROXY_URL,
  timeoutSeconds: 30,
});

Two details matter in Python and Node. The profiles fix their own extension order, so extension randomization must be off; Node turns it on by default. And the Python library builds its custom-client payload for an older shared library, so AppSession sets the ALPN list and the certificate compression list in the shape the current one expects. Without those two lines the connection negotiates no ALPN and the handshake is refused.

Android

Android apps built with Akamai’s SDK use OkHttp, and the tls-client engine ships a matching preset in every language. No profile file is needed.

import os
import tls_client

app = tls_client.Session(client_identifier="okhttp4_android_13")
app.proxies = {"http": os.environ["PROXY_URL"]}

import (
	tls_client "github.com/bogdanfinn/tls-client"
	"github.com/bogdanfinn/tls-client/profiles"
)

app, err := tls_client.NewHttpClient(tls_client.NewNoopLogger(),
	tls_client.WithClientProfile(profiles.Okhttp4Android13),
	tls_client.WithCookieJar(tls_client.NewCookieJar()),
	tls_client.WithProxyUrl(os.Getenv("PROXY_URL")),
)

import { ModuleClient, SessionClient } from "tlsclientwrapper";

const app = new SessionClient(new ModuleClient(), {
  tlsClientIdentifier: "okhttp4_android_13",
  withRandomTLSExtensionOrder: false,
  proxyUrl: process.env.PROXY_URL,
});

Keep the profile for the life of the session

A BMP session is the device Roolink emulated, the cookies it earned, the IP it used and the handshake it connected with, all together. Changing the TLS profile in the middle of a session is the same as changing phones: the session ends. Choose the profile when you create the client and keep that client for as long as you keep the deviceId. Sessions covers the rest of the bundle.

Check your handshake

Route your client through powhttp and compare its TLS handshake with a capture of the real app from a phone on the same network. The cipher list, the extension order and the HTTP/2 settings should match. If you do not have the app capture, a fingerprint echo such as https://tls.peet.ws/api/all at least confirms that the profile you selected is the one your client is actually using. For reference, SecondaryIOS26_2 reports the JA4 t13d2013h2_a09f3c656075_7f0f34a4126d and the Standard iOS 26 profiles report t13d1313h2_f57a46bbacb6_7f0f34a4126d, in every language.

Get started

Products

iOS

Android

Keep the profile for the life of the session

Check your handshake

​iOS

​Android

​Keep the profile for the life of the session

​Check your handshake

iOS

Android

Keep the profile for the life of the session

Check your handshake