XFP Gateway API

Official Developer Documentation & Complete Integration Guide

🚀 Quick Start

Use the following production integration templates to connect directly to the authentication gateway service endpoints.

Endpoint Architecture

POST https://gateway.xiaomiflasherpro.com/gateway.php
Content-Type: application/x-www-form-urlencoded

1. cURL Terminal Implementation

curl -X POST https://gateway.xiaomiflasherpro.com/gateway.php \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=YOUR_USERNAME&password=YOUR_PASSWORD&serviceid=3&configblob=YOUR_CONFIG_BLOB&userdevice=none&projectname=none&platformname=none" \
  | jq '.'

2. Native PHP Wrapper

<?php
require 'examples_php.php';

$client = new XFPGatewayClient('YOUR_USERNAME', 'YOUR_PASSWORD');
// Parameters: serviceid, configblob, userdevice, projectname, platformname
$result = $client->authenticate(3, $configblob, 'none', 'none', 'none');

if ($result['status'] === 'success') {
    echo "Authdata: " . $result['authdata'];
} else {
    echo "Error: " . $result['message'];
}
?>

3. Python Scripting Integration

from examples_python import XFPGatewayClient

client = XFPGatewayClient('YOUR_USERNAME', 'YOUR_PASSWORD')
result = client.authenticate(serviceid=3, configblob=configblob, userdevice='none', projectname='none', platformname='none')

if result.success:
    print(f"Authdata: {result.authdata}")
else:
    print(f"Error: {result.message}")

🗃️ SDK Asset Manifest

The shared suite consists of core documentation specifications along with language examples built for rapid implementation:

API_DOCS.md

Core low-level parameter blueprints and protocol layouts.

examples_curl.sh

Shell templates built with exponential backoff handlers.

examples_php.php

Class structures processing internal connection pools natively.

examples_python.py

Threaded processing designs optimized using dataclass schemes.

📥 Request Parameter Specifications

The gateway expects body content submitted via application/x-www-form-urlencoded structures:

Key	Requirement	Example Value	Description / Usage
`username`	Required	`YOUR_USERNAME`	Authorized registered gateway service account identifier.
`password`	Required	`YOUR_PASSWORD`	Account key password string corresponding to the identity.
`configblob`	Required	`CBF3CGnvz3TUyty...`	Raw handshake cryptographic block payload string.
`serviceid`	Required	`3`	Target operation index identifier mapped to required tools.
`userdevice`	REQUIRED FOR V6 NEW SEC	`none`	Target specific metadata definition tracking constraints.
`projectname`	REQUIRED FOR V6 NEW SEC	`none`	Project platform naming identifiers applied to logs.
`platformname`	REQUIRED FOR V6 NEW SEC	`none`	Target hardware structure identification references.

📋 Service IDs Reference

Pass the explicit index targeting the selected device servicing pipeline through the serviceid parameter:

ID	Service Target	Operation	Primary Intent Case
1	`EDLAuth`	Flash	Qualcomm Emergency Download (EDL) flashing signature
2	`FRPAuth`	FRP	Factory Reset Protection lock bypass verification
3	`SPFTV6Auth`	Flash	Smart Phone Flash Tool Version 6 secure layer authorization
4	`FDLAuth`	Flash	Fastboot handshake translation down to EDL pipelines
5	`V5Auth`	Flash	Legacy MIUI V5 validation signature handling
6	`V6Auth`	Flash	Standard production MIUI V6 authorization runtime
7	`V6NEWSECV1Auth`	Flash	Next-gen V6 Security Scheme Variant 1 validation
8	`V6NEWSECV2Auth`	Flash	Next-gen V6 Security Scheme Variant 2 validation

✅ Response Schemas

Success Signature Object (HTTP 200 OK)

{
  "status": "success",
  "message": "Auth completed successfully",
  "authdata": "9If2uqQ7+bvy7CJB42G3P4Sk+Zx+NgVe4Mdkd+jj0oL1Y9Jjm1BoLJ5WscYDMD5b5Qnteg..."
}

Error Context Handling

{
  "status": "error",
  "message": "Credit not enough for EDLAuth (need 100, you have 50)"
}

🔄 Error Handling Matrix

Response Message Context	Root Mechanism Failure	Client Resolution Step
`Username not found`	Missing or malformed identity text	Check system profile credentials
`Incorrect password`	Secret hash string collision	Verify account settings match properly
`API access is disabled`	Missing configuration flag `apiuser != 'true'`	Request API privilege elevations via support
`Service not available`	Parameter requested index bounds ($<1$ or $>8$)	Confirm request limits lie between 1 and 8
`Credit not enough`	Insufficient token balance value remaining	Reload user account token balances
`All servers are Offline`	Operational backend system cycle update	Hold execution thread, execute queue loop retry
`Server X timed out`	Upstream transaction processing limits hit	Scale out execution polling timeout configurations

⚡ Architecture & Best Practices

🔐 Operational Security Core

Environment Scoping: Isolate secret configuration strings outside the deployment payload files. Inject runtimes entirely via protected .env file layers.
Payload Validation: Enforce format structures checks locally before sending raw configblob arrays to verify Base64 structure composition.
Status Validation Loops: Do not depend entirely on HTTP layer status headers. Evaluate internal JSON status parameter codes directly to track state configurations.

📈 Performance Calibration

Align network client configurations directly alongside operational metrics:

Standard Client Timeout Window: 20 seconds.
Maximum Queue Polling Window: 120 seconds ($24 \times 5\text{-second intervals}$).
Backoff Sequence: 3 to 5 iteration loops spaced via exponential curves ($2^n\text{ seconds}$).