Authentication Notes

This page describes the authentication procedure that takes place when the Flipnote Studio 3D web client tries to connect to an online service. Authentication must happen successfully before the online service can be used.

Initial request

The client first sends a POST request to / with the following HTTP headers:

Header	Notes
`Ugm-ID`	User's Flipnote Studio ID formatted as hex
`Ugm-MAC`	Console MAC address formatted as hex
`Ugm-Region`	Region ID
`Ugm-Language`	Language Code
`Ugm-Country`	Country Code (documented on 3dbrew)
`Ugm-Time`	Console time, format `YYYY/MM/DD hh:mm:ss`
`Ugm-Token`	ServiceToken
`Ugm-ShopID`	Title ID?

The request body is a multipart form with the following items:

Name	Notes
`miiName`	User's Mii name encoded as UTF-16
`miiImage`	User's Mii image as a 64x64 GIF image

Both of these seem to be blank/empty placeholder content in the EU/US version of Flipnote Studio 3D, presumably because the online functionality was hastily stripped back.

Response Headers:

Header	Notes
`Ugm-ChallengeBlob`	44-character lowercase HEX string
`Ugm-SessionID`	Session ID, this will be used by the client to identify the origin of any requests it makes after this point

The EU/US versions of Flipnote Studio 3D don't seem to do anything with Ugm-ChallengeBlob; it can be omitted

The standard HTTP Location header can also be used here to redirect the client to another URL.

Second request

After the 3DS received our response, it sent a GET request with the following HTTP headers:

Header	Notes
`Ugm-SessionID`	Same session ID as issued by the server
`Ugm-ID`	User's Flipnote Studio ID formatted as hex
`Ugm-Region`	Region ID
`Ugm-Language`	Language Code
`Ugm-Country`	Country Code (documented on 3dbrew)
`Ugm-Version`	Flipnote Studio 3D app version