PureGym Apple Wallet

PassKit Vapor Reverse Engineering

Personal project to reduce gym entry time from 47 seconds to 3 seconds. Not open-sourced due to potential TOS implications.

  • Reverse engineered PureGym's authentication and QR code APIs via mitmproxy
  • Built Vapor backend for PassKit certificate signing and push updates
  • Auto-refreshing QR codes via silent push notifications
  • Location-aware passes using scraped coordinates of all UK gyms
  • Apple Watch support for wrist-scan entry

Related consulting: Apple Wallet & PassKit, iOS security audit.

Platform iOS, watchOS Year 2025
📝 Related Article 💬 176 comments

How I accidentally became PureGym's unofficial Apple Wallet developer

Tired of fumbling with the gym app every morning, I reverse-engineered their API to build an Apple Wallet pass that gets me in with a quick wrist scan and discovered a bizzare security theatre along the way.

Read article