@davidfor ok, sorry, I was wrong. The x-kobo-userkey header is the exact same as in the KoboReader.sqlite database, user table, UserKey.
@miyoyo, I don't know where are you trying these, but I just fired up the above mentioned extension in firefox, and loaded this url:
https://storeapi.kobo.com/v1/user/re...=0&page_size=1
(captured from the sync process of Kobo device, slightly modified, as it uses page_size=50), and got this response:
Spoiler:
Code:
{"Items":[{"Book":{"Recommendation":{"Reasons":[]},"Contributors":"Erin Kellison","WorkId":"<some workid was here, removed>","Subtitle":"Shadow Series 1","IsFree":false,"ISBN":"9780996398060","PublicationDate":"2015-10-22T04:00:00.0000000Z","CrossRevisionId":"<some revision id was here, removed>","Title":"Shadow Bound","Description":"<p><span>DEATH</span></p> <p>Some people will do anything to avoid it. Even trade their immortal souls for endless existence.</p> <p><span>WRAITHS</span></p> <p>Secretly, inexorably, they are infiltrating our world, sucking the essence out of unsuspecting victims with their hideous parody of a kiss.</p> <p><span>SEGUE</span></p> <p>Adam Thorne founded the Institute to study and destroy his monster of a brother, but the key to its success is held in the pale, slender hand of a woman on th...","Language":"en","ImageId":"<some image id was here, removed>","PublisherName":"Fire Flower Publishing, LLC","Rating":3.8,"TotalRating":5,"RatingHistogram":{"1":1,"2":0,"3":1,"4":0,"5":3},"Slug":"shadow-bound-5","IsContentSharingEnabled":true,"RedirectPreviewUrls":[{"DrmType":"None","Format":"EPUB3_SAMPLE","Url":"http://storedownloads.kobo.com/download?downloadToken=<download token was here, removed>","Platform":"Generic","Size":798142}],"HasPreview":true,"Price":{"Currency":"USD","Price":3.99},"EligibleForKoboLoveDiscount":false,"IsPreOrder":false,"Id":"<some id removed>"}}],"ItemCount":1,"TotalPageCount":43,"TotalItemCount":43,"CurrentPageIndex":0,"ItemsPerPage":1,"Filters":{}}
Note, I removed the IDs and download tokens from the response, as I don't want to violate any law, perhaps I wouldn't.
I didn't change any auth or userkey headers since weeks ago, so i don't think any of these auth tokens ever expire. At least not 48 hours. May I know how and where did you try?