Perimeter X Mobile

A PerimeterX bypass for mobile apps. Takion generates the PerimeterX mobile headers an iOS or Android app expects, including _px3 and x-px-authorization, so your requests can pass

Trial and plan access is gated. A PerimeterX bypass can be abused for fraud, so trial access is not automatic, and PXHC additionally requires your key to be whitelisted for the service. Please contact us on Discord or via mail , we'll need to verify your business first.

Check our example bundles in order to validate your implementation against our validate ones, with correct headers order, TLS and flow from our Github repo

What is PerimeterX Mobile?

PerimeterX, known simply as px (now HUMAN), is a bot-management solution that protects mobile applications, APIs, and web apps from automated threats. It tells human traffic from bot traffic using advanced detection built into the app's SDK.

PerimeterX ships in several forms: web, hold captcha (pxhc), and a mobile version. This documentation focuses specifically on the mobile version used in apps on iOS and Android. The web and pxhc variants are covered separately in their respective docs.

How to Detect if an Application is Using PerimeterX

PerimeterX protection can be identified in mobile app requests by inspecting the headers for specific values:

• For px3: headers resembling 3:5b0de...3c67add:MO...P5VNA==:1000:6xXz...=

• For px2: headers resembling 2:eyJ1Ijoi...JkZWYyIn0=

These headers are often passed as x-px-original-token, x-px-authorization, or x-px-context.

Additionally, look for requests made to URLs such as:

• https://collector-XXX.perimeterx.net/api/v1/collector/mobile

• https://collector-XXX.px-cloud.net/api/v2/collector

Some apps using PerimeterX

Some applications known to use PerimeterX for mobile protection:

App Name	Package Name
StockX	com.stockx.stockx
TextNow	com.enflick.android.TextNow
GrubHub	com.grubhub.android
My B&B	com.bathandbody.bbw
FanDuel	com.fanduel.sportsbook
PrizePicks	com.myprizepicks.myprizepicks

Our API

Takion generates you all the x-px-* related header for interacting without issue into the application endpoints.