I am building a tool to access some data on a site (Fitocracy) and I would like to turn it into an unofficial partial API, as no official API exists.

If you are not logged in, you cannot get access to any data, so my tool uses Ruby's mechanize to log in (with my account) and scrape some data from a page.

How should I handle this when I turn it into an API? I am worried that people won't feel comfortable sending their login credentials through an unofficial API and I don't want to just circumvent the login to the site by giving everybody access through a dummy account.

  • Is the API online or offline? Is it open-source? Is it hosted on your machine or on an independent server? This stuff in general will determine whether someone would trust your API with his credentials. Also, check with the site TOS to make sure you're not breaking any laws with the API. – K.Steff Aug 7 '12 at 0:17
  • I would like to build this as a RESTful API run from Heroku. – DorkRawk Aug 7 '12 at 0:24
  • If you open-source it, I'd say it's okay to request user credentials. A self-respecting programmer could check what exactly you're using his credentials for. – K.Steff Aug 7 '12 at 0:34
  • Yea, I think I'd throw this up on Github. It's all just for fun and learning, plus it might be useful for some people. – DorkRawk Aug 7 '12 at 1:54

I'm Kasra Rahjerdi, a Software Engineer at Fitocracy. Before I joined the team, I actually created a reverse engineered copy of the mobile site's API with the goal of creating my own Android app off of it, so I can relate to what you're asking.

To directly respond to your question: Even if an app is open-source, the average user is going to be confused and hesitant to hand over their data to a third party, unless the developer name for the application is the company's name. I assume you're asking this question in regards for creating an API to create an Android application, in which case I'd strongly recommend against doing this because publicly releasing an application and API based off of our information will lead to hassles for the both of us. Users finding your application will be contacting you asking you why X doesn't work where it works on the iPhone app, and users finding the product through you will be leaving our ecosystem after the initial impression because the #1 thing our iPhone app is based off of is the perfect UX that we want.

But, I can't stop you from doing anything, so here's a GitHub project of another reverse engineered version of our API with a barebones Android app that you can use as a stepping stone if you want: https://github.com/walialu/Unofficial-Fitocracy.com-Android-App I'll just tell you that the creation of that application created a lot of chaos for us, since we had confused users left and right.

And to go back to your direct question: In the day and age of oAuth I really believe that the average consumer is hesitant to give user information unless they're on the application website of the supplier of data, so I wouldn't ask the user for username/password.

  • 1
    Thank you for the response! I actually have no plan to build a mobile app with this. I just wanted a more robust way to work with my running data (and thought others might want the same) and wanted to learn more about Ruby so this seemed like a good project to tackle. If I get it to a point I'm happy with I'll be put everything up on Github and let you guys know. – DorkRawk Aug 7 '12 at 7:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.