Custom Apple Wallet Passes for Fitness SF

Fitness SF has a number of great gyms around the Bay Area, but their app can be slow to load, and having to open it every time to scan in was annoying. Apple Wallet passes solve this problem by allowing you to set locations where it will auto-prompt showing a QR code if you're in the radius. The app doesn't let you create an Apple Wallet pass (or even screenshot the QR code), so let's make our own!

Existing Solution

I first tried Googling around to see if this existed. I found https://fitnesswallet.app/ but it required your username and password, and had the somewhat suspicious disclaimer at the bottom that "This tool operates entirely on your device— your credentials are never transmitted to any server."

This is trivially disproven though with the 'Network' tab of Chrome Inspector, which shows that your email and password are explicitly passed to an https://fsf-api-production.herokuapp.com/auth endpoint on a Heroku instance:

Additionally that Heroku app has expired, so even if you were willing to potentially share your credentials the tool doesn't work (my suspicion is this used to be the real production server for Fitness SF). Luckily we can 'fix' this by locally overriding the Javascript for the page, adding the following to the index.js file after the .post to https://fsf-api-production.herokuapp.com/auth, overriding the result. The scanCode is your member ID, which you can get by scanning the QR code in the official app (though it's often the first 9 digits of your phone number). The favoriteLocation corresponds to an array of locations, which the pass uses to identify which location you should get the popups for.

i = {
  data: {
    user: {
      scanCode: '123456789',
      name: 'James Sullivan',
      favoriteLocation: 'a0041000005WyC3AAK',
    }
  }
};

You can see all of the locations in the clubs.ts file, though the lat/long coordinates are off in a lot of cases.

Clicking the "Generate Pass" button again with any data will now work, creating a "Download Pass" option. Unfortunately the Developer ID and signature that's used (pass.com.fsf-wallet for GUSY2U4SMQ) has expired, which you can verify by looking at the "Passbook" logs in Console.app while dragging the generated .pkpass file onto an iOS Simulator.

My Own Solution

I don't particularly want my signing information to be public, which is the only way to do this in a trustworthy manner, so unfortunately I didn't build a replacement app. However the code that I used to generate my version is public on Github with instructions, so you can locally make one if you have an Apple Developer account. My version adapts the Fitness Wallet website code with a cleaner UI and more accurate location IDs as well, using Apple's flawed documentation and wiki.

Building that repo with python3 build.py will create Fitness SF.pkpass, which you can text/email to yourself. Opening it on your iPhone will allow you to add it to your wallet and tada!

Fitness Wallet version My version