ShortStak: Reverse-Engineering a Smart Garage App

The Arduous Parking Process

Parking at my local garage (operated by Stakspace) should be a simple process, but it ended up being an incredibly frustrating daily ritual. Because the facility lacked a dedicated mobile SDK or app, they relied entirely on a web-based frontend for access control.

Every single time I wanted to park, both to enter and to exit, I had to:

• Open a web browser on my phone.
• Navigate to the parking portal.
• Enter my phone number and complete a 2FA flow.
• Enter payment information.
• Wait for the UI to load and tap a specific button to open the gate.

When you're sitting in a line of cars at a garage entrance or exit, this multi-step web flow is not just annoying—it's stressful and dangerous. I needed a way to simplify this into a single tap.

ShortStak: Native iOS Experience

I decided to build ShortStak, a private iOS garage-access app that completely bypasses the clunky web frontend. By reverse-engineering the website's API calls, ShortStak authenticates as a web browser against the parking.stakspace.com backend and triggers the door-open and door-close events natively.

Instead of a 5-step web process, I can now open the garage using:

• CarPlay: Tapping a button directly on my car's dashboard.
• Home Screen Widgets: A single tap on my phone's home screen.
• Siri Shortcuts: Using voice commands (e.g., "Hey Siri, open the Franklin Street Entrance").
• SwiftUI App: A beautiful, native iOS interface with swipe-to-unlock interactions.

Reverse Engineering & API Spoofing

The hardest part of this project wasn't building the UI—it was figuring out how to talk to a backend that was never designed for third-party apps.

Impersonating a Web Browser

To trigger the POST /api/door endpoint, the app has to look exactly like a desktop Chrome browser. The app dynamically generates headers on each request:

• Spoofed user-agent strings.
• Fresh __stripe_mid and __stripe_sid cookies.
• Randomized X-Forwarded-For and Client-IP headers to prevent rate limiting.

Dynamic JS Bundle Parsing

The list of garage doors isn't available via a simple JSON API. Instead, the Stakspace frontend compiles the door definitions directly into their Next.js JavaScript bundles.

To ensure the app doesn't break when they deploy updates, I built a live-refresh system (DoorProvider.refresh()) that:

1. Fetches the parking.stakspace.com HTML.
2. Uses Regex to find the current Next.js chunk filename (e.g., 3296-f9c6f354b0f0fa49.js).
3. Downloads the chunk and parses it using Regex to extract the doorId, name, and imagePath for every door in the facility.
4. Deduplicates the results and persists them to UserDefaults.

The Cat and Mouse Game

Initially, ShortStak could open both entrance and exit gates without providing a session ID. However, in August 2026, the backend introduced a strict payment guard.

For exit gates, the server started enforcing a server-side verified sessionId with a "paid" status. If I sent a request without a session ID, it returned a 403 Forbidden (SESSION_REQUIRED). If I sent an unpaid session, it returned PAYMENT_EXPIRED.

To work around this and maintain the frictionless experience, I had to dig deeper into the API. I discovered hidden endpoints like /api/parking to create sessions and /api/stripe/charge-saved to automatically charge the saved credit card on file before triggering the exit gate, allowing me to fully automate the payment flow in the background.

Building the Ecosystem

The SwiftUI app is built around a central DoorProvider singleton that manages the state across multiple UI surfaces:

• Main App: Features both a compact list view and an expanded hero-card view with custom gradient overlays and swipe-to-unlock sliders.
• CarPlay: Implemented using CPListTemplate. It asynchronously downloads door thumbnails and displays them in a highly responsive 80x80 grid on the car's head unit.
• Widgets: Using AppIntents, I built systemSmall and systemMedium widgets that show the current state of a door ("Unlock", "Unlocking...", "✅ Unlocked") directly on the iOS Home Screen.
• Siri: Configured an OpenGarageDoorIntent so I can literally just talk to my Apple Watch as I pull up to the gate.