walmart-app-login

KO | EN

gitlite — search

#python #java #python3 #arduino #golang #machine-learning #rust #html #flask #javascript #seismology #nodejs

walmart-app-login

★ 12 Open GitHub ↗

Python implementation for bypassing PerimeterX (PX) antibot on the latest Walmart Android app

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Walmart App Login

Working Python implementation for bypassing **PerimeterX (PX) antibot** on the latest **Walmart Android app** (`com.walmart.android`). Full login automation with PX header generation, TLS fingerprint matching and session management, all powered by [TakionAPI](https://takionapi.tech).

![Demo](https://raw.githubusercontent.com/glizzykingdreko/walmart-app-login/main/assets/demo.gif)

## Table of Contents
- [Quick Start](#quick-start)
- [Important Notes](#important-notes)
- [How to Bypass PerimeterX on Mobile](#how-to-bypass-perimeterx-on-mobile)
  - [PX Header Generation](#px-header-generation)
  - [TLS Fingerprint Matching](#tls-fingerprint-matching)
  - [Session Fingerprinting](#session-fingerprinting)
  - [Payload Recreation](#payload-recreation)
  - [IP and Proxy Management](#ip-and-proxy-management)
  - [Hold Captcha (PXHC)](#hold-captcha-pxhc)
- [Interacting with Walmart](#interacting-with-walmart)
  - [Headers](#headers)
  - [Login Flow](#login-flow)
  - [App Updates](#app-updates)
- [TakionAPI Solution](#takionapi-solution)
  - [Getting an API Key](#getting-an-api-key)
  - [Generating PX Headers](#generating-px-headers)
  - [TLS Endpoint](#tls-endpoint)
- [FAQ](#faq)
- [Connect with Me](#connect-with-me)

## Quick Start

```bash
git clone https://github.com/glizzykingdreko/walmart-app-login-v2.git
cd walmart-app-login-v2
pip install -r requirements.txt
```

![Script Running](https://raw.githubusercontent.com/glizzykingdreko/walmart-app-login/main/assets/script.gif)

Set your environment variables and run:
```bash
export TAKION_API_KEY="your_takion_api_key"
export WALMART_PROXY="ip:port:user:pass"
export WALMART_EMAIL="your@email.com"
export WALMART_PASSWORD="your_password"

python walmart_login.py
```

## Important Notes

The current code is up-to-date with version `26.12.2` of `com.walmart.android` (`11/04/2026`).

This repo will be kept updated for any new changes of the app. Always refer to this repo for up-to-date examples.

## How to Bypass PerimeterX on Mobile

This section covers the general approach to bypassing PX on **any** Android/iOS app, not just Walmart. If you're working with a different PX-protected app, the same concepts apply.

### PX Header Generation

The core of any PX bypass is generating valid `X-PX-*` headers. The most important one is `X-PX-AUTHORIZATION`, that contains the actual PX token. Here's the full set:

| Header | What it does |
|--------|-------------|
| `X-PX-AUTHORIZATION` | **The PX token**. Encrypted device/session data, the main target |
| `X-PX-DEVICE-FP` | Device fingerprint hash |
| `X-PX-UUID` | Unique PX session identifier |
| `X-PX-VID` | Visitor ID assigned by PX |
| `X-PX-OS` | Operating system (e.g., `Android`) |
| `X-PX-OS-VERSION` | OS version string |
| `X-PX-DEVICE-MODEL` | Device model string |
| `X-PX-MOBILE-SDK-VERSION` | PX SDK version embedded in the app |

These headers get generated through the PX SDK's challenge-response mechanism, which involves sending device signals and solving computation challenges. You can't just make them up.

### TLS Fingerprint Matching

PX validates the **TLS fingerprint** of incoming connections. The app uses OkHttp, producing specific JA3/JA4 hashes. If your TLS doesn't match, your session gets flagged.

For the current Walmart Android app:
- **JA4**: `t13d1513h2_8daaf6152771_40271e0a5736`
- **JA3**: `f79b6bad2ad0641e1921aef10262856b`

Unless you **exactly match those hashes**, on the long run (a few hours/days) your accounts and project will **get flagged**.

Validate your rest client tls by sending a request to `https://tls.peet.ws/api/all`:
```python
response = solver.get("https://tls.peet.ws/api/all").json()
print(f"JA4: {response['tls']['ja4']}")
print(f"JA3: {response['tls']['ja3_hash']}")
```

### Session Fingerprinting

PX doesn't just check individual requests, it builds a **session profile** based on:
- **Device consistency** -> same device details across all requests in a session (and actually valid and real details of it)
- **Generation timings** -> realistic intervals between PX token refreshes
- **Header ordering** -> headers must appear in the exact order the real app sends them
- **Behavioral signals** -> the PX SDK collects interaction data (touches, scrolls, etc.)

A session that suddenly changes device model or sends headers in a different order will be flagged immediately. Consistency is everything.

### Payload Recreation

PerimeterX bases its analysis on the generation (via some requests) of different payloads. Those payloads contain SDK-version and app-specific details, device signals, some computation challenges as well as movements and interactions within the app/session.

Creating a `PX-AUTHORIZATION` doesn't grant you success on its own. The token needs to be "kept warm" by updating your session with the interactions done in the app. A wrong generation will not just block your access, but also potentially flag your device and account.

Usually after an interaction such as login / adding to cart / checkout you may want to regenerate the token, follow the exact flow used by the real app, goal is to recreate 1:1 a "human" one.

### IP and Proxy Management

PX is pretty strict on IP reputation. Once an IP is flagged for suspicious activity, navigation gets prevented with several HoldCaptcha challenges (or a direct block). For this reason:

- **Different proxy per session** -> never reuse IPs
- **IP-generation lock** -> the proxy used during PX header generation must be the same one used for API requests
- **Residential or mobile proxies** -> strongly recommended over datacenter

### Hold Captcha (PXHC)

![PXHC](https://raw.githubusercontent.com/glizzykingdreko/walmart-app-login/main/assets/pxhc.gif)

During a normal client interaction, a **Hold Captcha** (`pxhc`) will be required only if the session is detected as suspicious (root/apk modification/bad ip reputation/mitm proxy).

So, like a real genuine user, with:
- Correct flow
- Correct headers order
- Correct tls details
- Correct px-generation
- Correct session (and headers) relation

the access will be always granted. No captcha, no blocks. That's the whole point.

---

## Interacting with Walmart

### Headers

![Headers](https://raw.githubusercontent.com/glizzykingdreko/walmart-app-login/main/assets/headers.png)

During Walmart app interactions some of the needed headers are going to be:

**1. Endpoint-specific** (change per GraphQL operation):
```json
{
    "X-APOLLO-OPERATION-ID": "<operation_sha256_hash>",
    "X-APOLLO-OPERATION-NAME": "<OperationName>",
    "X-APOLLO-CACHE-KEY": "<md5_hash>",
    "tenant-id": "elh9ie"
}
```

**2. Device and session** (consistent across the session):
```json
{
    "User-Agent": "<from_px_generation>",
    "Accept-Language": "es-US",
    "x-o-mart": "B2C",
    "x-o-bu": "WALMART-US",
    "x-o-segment": "oaoh",
    "x-o-platform": "<from_px_generation>",
    "x-o-platform-version": "<from_px_generation>",
    "traceparent": "<from_px_generation>",
    "x-o-fuzzy-install-date": "<truncated_timestamp>",
    "baggage": "deviceType=Android,trafficType=release,requestTs=<timestamp>"
}
```

**3. PX headers** (all from TakionAPI `/generate`):
```json
{
    "x-wm-sid": "<from_px_generation>",
    "x-wm-vid": "<from_px_generation>",
    "x-o-device-id": "<from_px_generation>",
    "X-PX-VID": "<from_px_generation>",
    "X-PX-OS-VERSION": "<from_px_generation>",
    "X-PX-UUID": "<from_px_generation>",
    "X-PX-DEVICE-FP": "<from_px_generation>",
    "X-PX-DEVICE-MODEL": "<from_px_generation>",
    "X-PX-OS": "<from_px_generation>",
    "X-PX-MOBILE-SDK-VERSION": "<from_px_generation>",
    "X-PX-AUTHORIZATION": "<from_px_generation>"
}
```

All PX headers are returned by the TakionAPI `/generate` endpoint, no manual construction needed. The header order matters, make sure to replicate it exactly as shown from your recorded app's session

### Login Flow

The Walmart app login follows a strict 3-step GraphQL sequence:

```
CountryList -> GetLoginOptions -> SignInV2
```

Each step uses the **same PX session** (same headers, same proxy). See [`walmart_login.py`](./walmart_login.py) for the complete implementation.

**Step 1, CountryList**: This is the warmup just to get session cookies.

**Step 2, GetLoginOptions**: Queries available login methods for the given email (may be usefull on production or to check if a mail is registered)

**Step 3, SignInV2**: The actual login mutation. Submits email + password and returns auth tokens on success.

The `X-APOLLO-CACHE-KEY` for each operation is computed as:
```python
from hashlib import md5
cache_key = md5((operation_name + operation_hash).encode()).hexdigest()
```

Pretty simple. Check the source for the full implementation with all the correct hashes.

### App Updates

What happens during app updates?

1. **PX SDK version may change** -> so during generation more parameters/different values may need to be provided during the payload requests
2. **Walmart usually changes the endpoint hashes and headers order** -> during updates (flagging still-old endpoint interactions), flow may need updates
3. **In case of OkHttp update** -> the TLS details may need to be changed too

This repo tracks these changes. Check back for the latest hashes and configurations.

---

## TakionAPI Solution

![TakionAPI Banner](https://raw.githubusercontent.com/glizzykingdreko/walmart-app-login/main/assets/takion.png)

Unless you want to start deobfuscating, understanding (and most importantly keeping up-to-date) both your PX solution, TLS client and device banks, we at [TakionAPI](https://takionapi.tech) provide a simple and direct solution to implement into your project. Focus on your business and let us worry about the protection bypasses.

[`takion_px_mobile.py`](./takion_px_mobile.py) has already all the implementation ready for your project.
 
- [TakionAPI Docs](https://docs.takionapi.tech)  
- [TakionAPI Trial](https://dashboard.takionapi.tech)  
- [TakionAPI Discord](https://takionapi.tech/discord) for custom development and support.

### Getting an API Key

Start with a free trial at [takionapi.tech](https://takionapi.tech/demo) in order to get an API key with some tokens in it. Nothing more than an email address required, make your tests and contact us for any question or business inquiries.

### Generating PX Headers

```bash
curl -X POST 'https://px-mobile.takionapi.tech/generate' \
  -H 'Content-Type: application/json' \
  -H 'x-api-key: TAKION_API_XXXX' \
  -d '{
    "package_name": "com.walmart.android",
    "proxy": "ip:port:user:pass"
  }'
```

The 2 required parameters, other than the API key, are:
- `package_name`: The package name of the android app
- `proxy`: Either in format `ip:port` or `ip:port:user:pass`, the same one you are going to use in your session

Then you can provide optional arguments for a more specific device selection:

| Parameter | Example | Description |
|-----------|---------|-------------|
| `manufacturer` | `samsung`, `google`, `vivo` | Device manufacturer |
| `android_version` | `14`, `15` | Android version |
| `continent` | `america`, `europa`, `africa` | Impacts device language and availability |
| `language` | `en-US`, `pt-BR` | Device language (ignored if `continent` is passed) |

Specifically for Walmart you don't have to worry about those extra arguments at the moment.

**Python example** using the included client:
```python
from takion_px_mobile import TakionPxMobile, Device

solver = TakionPxMobile("TAKION_API_XXXX", "ip:port:user:pass")
px = solver.generate_px_headers(
    "com.walmart.android",
    # Optional
    device=Device(
        manufacturer="samsung",
        android_version="14",
        continent="america",
        language="en-US"
    )
)

# You now have all the needed px-* headers
print(px["x-px-authorization"])
```

### TLS Endpoint

We offer as well TLS solutions in order to make sure that your program is always using the most updated (and expected) TLS details as the application.

```bash
curl -X POST 'https://px-mobile.takionapi.tech/mobile/tls' \
  -H 'Content-Type: application/json' \
  -H 'x-api-key: YOUR_API_KEY' \
  -d '{
    "proxy": "ip:port:user:pass",
    "session_id": "from_generate_response",
    "method": "GET",
    "url": "https://www.walmart.com/...",
    "headers": { "Header-Name": "value" }
  }'
```

So basically if you are working with Walmart app you can directly proceed building your project having all the antibot and TLS part already covered by us. The `session_id` is returned by the `/generate` endpoint and links TLS sessions to PX sessions.

```python
# After generating PX headers, use solver.get/post for TLS-matched requests
response = solver.get(
    "https://www.walmart.com/orchestra/aroundme/graphql/CountryList/...",
    headers={...}
)
print(response.status_code, response.text)
```

The hard part is done! Now just focus on your actual business logic.

---

## FAQ

> I work with a different PX-protected mobile app, do you support it?

Yes, we can add support to your specific app (if not already supported). Just change the `package_name`. Contact us on Discord for details if you ar enot sure about your specific app's implementation/flow.

> Do you provide the generation via iOS device too?

Yes, contact us on Discord for more information.

> I'm getting Hold Captcha (PXHC) challenges, what's wrong?

Your session is flagged. Check: 
 1. TLS fingerprint matches
 2. header order is correct
 3.  proxy IP is clean
 4. PX headers are fresh and from the same session
 5. you're not reusing IPs across sessions.

> Can I use other Python TLS libraries?

Make sure that the reported JA4 and JA3 are correct, TLS libraries are typically outdated and don't produce the exact JA3/JA4 hashes. Use TakionAPI's TLS endpoint during tests if you want to make sure.

> What happens when Walmart updates the app?

Operation hashes, header orders, and potentially TLS details change. This repo tracks updates, check back for the latest values. TakionAPI automatically updates PX generation and tls details for new SDK versions.

> I have problems implementing the solution / interacting with my target app, could you help?

Yes, Discord.

> I'm not sure about how to extract the requests flow/use an http proxy on the application I'm working with, how should I proceed?

A detailed guide about how to correctly proceed will be out soon, be sure to follow me on [Medium](https://medium.com/@glizzykingdreko).

## Author

If you found this project helpful or interesting, consider starring the repo and following me for more security research and tools, or buy me a coffee to keep me up

walmart-app-login

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README