ShortStak: Reverse-Engineering a Smart Garage App

Parking at my local garage (Stakspace) was a five-step chore. Because they didn't have a native app, everything ran through a web portal.

To open the gate, I had to:

• Unlock my phone and open Safari.
• Navigate to the parking URL.
• Pass a 2FA SMS check.
• Re-enter my payment info.
• Wait for the UI to load before tapping the button.

Doing this while pulling up to a line of cars wasn't just annoying, it was distracting and dangerous. I wanted to turn this entire flow into a single tap.

To fix this, I built ShortStak, a native iOS app that completely bypasses the facility's web frontend. By reverse-engineering their backend, I was able to move the access controls exactly where I needed them while driving.

Instead of fumbling with a browser, I can now open the garage through:

• CarPlay: A button right on the dashboard.
• Widgets: A quick tap from my iPhone's home screen.
• Siri: Hands-free voice commands ("Hey Siri, open the Franklin Street Entrance").
• Native iOS App: An interface with swipe-to-unlock sliders to prevent accidental taps.

The hard part wasn't the UI; it was getting a closed system to talk to my app. To trigger the POST /api/door endpoint, ShortStak had to perfectly mimic a desktop Chrome browser. I wrote logic to spoof user-agent strings, manage Stripe session cookies, and randomize X-Forwarded-For headers to get around their rate limits.

Parsing Minified JavaScript

Another major hurdle: the garage didn't have an API for its door list. The data was hardcoded directly into their compiled Next.js bundles.

To keep the app from breaking every time they updated their site, I wrote a live-refresh pipeline. The app dynamically downloads the site's live HTML, uses Regex to find the current Next.js chunk, downloads that specific JavaScript file, and extracts the door catalog directly from the minified code.

In August 2026, Stakspace cracked down. The exit gates started requiring a server-verified 'paid' session ID, blocking my requests with a 403 Forbidden.

Instead of reverting back to the manual web flow, I dug deeper into their network requests. I mapped out hidden endpoints like /api/parking and /api/stripe/charge-saved. Now, ShortStak quietly provisions a session and charges my card on file a split second before triggering the gate. The frontend UX didn't change at all: it's still just one tap.

By abstracting away the messy scraping and authentication, I was able to build a clean, reliable iOS experience. A single DoorProvider manages the state across the main app, the CarPlay CPListTemplate, and the AppIntents driving the iOS widgets.

Ultimately, ShortStak took a heavily guarded, multi-step web portal and turned it into an invisible piece of infrastructure. It’s a great example of how pushing through technical constraints can completely transform a frustrating daily routine.