xhshow

Use the Xhshow client to generate all necessary headers (including x-s, x-s-common, x-t, etc.) for Xiaohongshu API requests.

• For GET requests, use sign_headers_get. You can pass a full URL or just the URI path; the library will automatically extract the path.
• For POST requests, use sign_headers_post. Instead of params, use the payload argument to pass the request body.

from xhshow import Xhshow
import requests

client = Xhshow()
cookies = {"a1": "...", "web_session": "...", "webId": "..."}

# GET Request
headers = client.sign_headers_get(
    uri="https://edith.xiaohongshu.com/api/sns/web/v1/user_posted",
    cookies=cookies,
    params={"num": "30", "cursor": "", "user_id": "123"},
)

# POST Request
headers = client.sign_headers_post(
    uri="https://edith.xiaohongshu.com/api/sns/web/v1/login",
    cookies=cookies,
    payload={"username": "test", "password": "123456"},
)

The Xhshow class is the primary entrypoint for generating all necessary Xiaohongshu request headers, including signatures (x-s), common signatures (x-s-common), and trace IDs.

Depending on the API endpoint, you may need to choose between two signature formats:

• xys: The traditional format (default), suitable for most non-data APIs.
• xyw: Required for data-fetching APIs (e.g., user_posted, otherinfo) that return HTTP 406 when using the xys format.

For endpoints like feed, search, or note publishing, enable x_rap=True to generate the x-rap-param header.

from xhshow import Xhshow

client = Xhshow()
cookies = {"a1": "your_a1_value", "web_session": "..."}

# Example: GET request for data-fetching API using 'xyw' format
headers = client.sign_headers_get(
    uri="/api/sns/web/v1/user_posted",
    cookies=cookies,
    params={"num": "30"},
    sign_format="xyw"
)

# Example: POST request with x-rap-param enabled
headers = client.sign_headers_post(
    uri="/api/sns/web/v1/feed",
    cookies=cookies,
    payload={"source_note_id": "..."},
    x_rap=True
)

If you do not need the full header set, you can generate specific fields individually:

x-s Signatures

• sign_xs_get(uri, a1_value, params=None, timestamp=None): Generates x-s for GET requests. Requires a1_value.
• sign_xs_post(uri, a1_value, payload=None, timestamp=None): Generates x-s for POST requests. Requires a1_value.

x-s-common

• sign_xsc(cookie_dict): Generates x-s-common. Accepts a dictionary or a string of cookies.

Other Fields

• get_x_t(timestamp=None): Returns a millisecond timestamp. Use the timestamp argument to ensure consistency across all headers.
• get_b3_trace_id(): Returns a 16-character trace ID.
• get_xray_trace_id(timestamp=None): Returns a 32-character trace ID.

Note on Timestamps: To ensure all header fields use the exact same time, generate a single timestamp using time.time() and pass it to the relevant methods.

import time

ts = time.time()
# Use the same timestamp for all fields to ensure consistency
x_s = client.sign_xs_get(uri="...", a1_value="...", params={"num": "30"}, timestamp=ts)
x_t = client.get_x_t(timestamp=ts)
x_xray = client.get_xray_trace_id(timestamp=int(ts * 1000))

To generate realistic signatures that mimic a real user session, use the SessionManager class. It maintains evolving state counters (like sequence_value and window_props_length) that change over time to simulate user activity between requests.

Key Workflow

1. Initialize: Create a SessionManager instance. You can optionally pass a CryptoConfig object to customize the initial ranges for session parameters.
2. Retrieve State: Call get_current_state(uri) before each signing operation. This method automatically updates the internal session counters and calculates the uri_length based on the provided URI.
3. State Persistence: The manager is designed to be long-lived; do not re-instantiate it for every request, as the counters must evolve across multiple requests within the same logical session.

from xhshow.session import SessionManager

# Initialize the manager
manager = SessionManager()

# For each request, get the current state using the target URI
uri = "https://example.com/api/data"
state = manager.get_current_state(uri)

# Use the state (SignState) for your signing logic
print(f"Timestamp: {state.page_load_timestamp}")
print(f"Sequence: {state.sequence_value}")
print(f"URI Length: {state.uri_length}")