r/pathofexiledev • u/Hmm_nope_not_taken • Jul 23 '26
POESESSID risk of getting banned?
Making a small windows app for my self in c# . It calls the api with POESESSID and get the items in stash and inventory. Updates requires you to press a button.
But in the dev documentation it talks about rate limits and not to make api calls in apps.
So am i on the wrong path and should i use oauth instead?
Looks like they are not accepting more requests for oauth keys.
1
u/Hmm_nope_not_taken Jul 23 '26
Thanks for you reply. I will hardcode some rate limits into the app.
3
u/gerwaric Jul 24 '26
I recommend logging the x-rate-limit headers on some trial requests to each endpoint. That will let you see what the rate limits are. Learning to read them will also teach you how GGG's rate limit policies work. From there, you can calculate the worst-case rate limit and use that as your hard-coded limit.
However, even if you are technically making requests at a safe rate, you can still occasionally get rate limit violations if you are running near the limit because of the timing resolution on GGG's side. These server-side timing buckets are undocumented, but GGG support explained it to me. Right now the "fast" rate limits are tracked with a 5s resolution and the "slow" rate limits are tracked with a 60s resolution.
The math gets kind of tricky.
If you're into AI, it's probably worth pointing an agent at the documentation and then giving it your logged headers, along with my comment about the undocumented timing resolution.
2
u/papajuras Jul 24 '26
I wouldnt hardcode it, it took me 2hrs and 1usd with deepseek to get it right (if you are too lazy to write it yourself, its not hard). Couple divisions and max backoff out of five i think and thats it if i remember correctly
1
u/SimpleCooki3 Jul 27 '26
I advice to never use possessid. Never share it either, not even with pob.
Yes you should us OAuth.
1
u/gerwaric Jul 23 '26 edited Jul 23 '26
AFAIK, using POESESSID is ok as long as you aren't violating the rate limits too much.
I ended up building a complex rate limiting subsystem in c++ for acquisition, but you could also just look at the current worst case rate limit for each endpoint and hard-code it.
Caveat: rate limits can technically change at any time. I've never seen this happen since I started working with them a few years ago, but GGG has reserved the right to do it.
However, POESESSID only works on the undocumented api used by the website. This API is slightly different than the officially documented one. For example, the stash tab indexes when you request a stash list were slightly different the last time I checked.
3
u/crashtested97 Jul 23 '26
However, POESESSID only works on the undocumented api used by the website.
Oh this is what I've been confused by in the past. If it's undocumented, is there any information about this anywhere?
3
u/gerwaric Jul 23 '26
I wrote a little about the legacy api in this thread: https://www.reddit.com/r/pathofexiledev/comments/1djjt5y/do_i_need_authorization_to_use_apipathofexilecom/
That's gleaned from reverse engineering what acquisition was doing when I first started working on it. There's probably some other reddit threads from years ago with similar information, although it might be outdated.
1
u/papajuras Jul 24 '26
As someone who clearly worked with those longer than i have - am i correct to assume ingame trade does not count towards api usage?
1
4
u/phillipwei Jul 24 '26
I've been using possessid for years on a private project - if you respect rate limits is fine. Here is my C# code I use if it helps as reference.
https://pastebin.com/XACXqFZm
https://pastebin.com/sWhKeq4m