I Spent Three Weeks Reverse Engineering a Mobile App’s API — Here’s What It Took

A while back, a client asked me a deceptively simple question: "Can you find out how our competitor's mobile app talks to its backend?"

No public API docs. No Postman collection floating around GitHub. Just a Flutter app, a few permissions in the manifest, and a backend that clearly wasn't expecting anyone to come knocking.

I said yes before I fully understood what I was signing up for.

The First Wall: Flutter Doesn't Decompile Like a Normal App

If you've reverse engineered a native Android app before, you know the drill — pull the APK, run it through a decompiler, read mostly-readable Java or Kotlin, find the API calls, done in an afternoon.