rewerse engineering

This repository aims to implement all publicly accessible (unauthenticated) API endpoints used by the Rewe app for querying current discounts, products, recipes and recalls.

Current supported APK version: 5.7.3 (as of 09.01.26)

Caution

The certificates required for talking to the rewe api are not included in this repository. You need to extract them from the APK. Documentation & an extraction-script for windows can be found in the docs directory.

quick start

Extract certificates from the rewe apk; see docs for instructions

Use the library:

• Go: go get github.com/ByteSizedMarius/rewerse-engineering – docs
• Python: pip install rewerse – docs

Or install the CLI:

• Download a release
• Install via Go: go install github.com/ByteSizedMarius/rewerse-engineering/cmd@latest
• Or clone and build: go build -o rewerse ./cmd

Verify: rewerse --help

intro

In March 2024, Rewe started using Cloudflare MTLS to secure their api-endpoints, which broke existing solutions that allowed, for example, fetching discounts for a specific Rewe market. Github-user @torbenpfohl was obsessed persistent enough to figure this out, find the certificate and it's password. This repo is based on his work and aims to document the required procedures and implement some of the endpoints.

This repo is not meant to cause any harm. It's sole purpose is to give access to data that is already freely accessible via the app/website. It will never contain endpoints related to rewe account information (login/shoppinglist/etc.) or payback.

Not affiliated with Rewe in any way.

contents

• A basic go implementation of the rewe api is available in the pkg directory; see pkg/readme for the api documentation of the go-library including usage examples.
• An ffi python wrapper is available as rewerse on PyPI – see python/readme for details and source code.
• The source code of the cli for the go library is in cmd.
• Releases are in releases.

Note

Please note that since this is an unsigned go binary that does some encryption/decryption of certificates and sends webrequests to the rewe api, it will likely get flagged by your antivirus. There are no dependencies, so you can easily compile it yourself – which is always recommended from a security perspective.

cli

Usage: ./rewerse.exe [flags] <command> [subcommand] [flags]

Flags:
  -cert <path>    Certificate file (default: certificate.pem)
  -key <path>     Key file (default: private.key)
  -json           Output as JSON

Commands:
  markets         Search and get market details
  products        Search, browse, and get product info
  recipes         Search and browse recipes
  discounts       Get market discounts
  categories      Get product categories
  recalls         Get product recalls
  services        Get service portfolio by zip

Examples:
  ./rewerse.exe markets search -query Köln
  ./rewerse.exe products search -market 831002 -query Milch
  ./rewerse.exe products category -market 831002 -slug obst-gemuese
  ./rewerse.exe recipes search -term Pasta
  ./rewerse.exe discounts -market 840174
  ./rewerse.exe categories -market 831002
  ./rewerse.exe services -zip 50667

Run './rewerse.exe <command>' for subcommand help.

misc

Feel free to open github issues for suggestions, questions, bugs. PRs welcome. Email: rewe at marius dot codes.

attribution

• https://github.com/foo-git/rewe-discounts
• https://github.com/torbenpfohl/rewe-discounts
• https://github.com/egonelbre/gophers