Skip to content
Switch branches/tags
Go to file
Cannot retrieve contributors at this time

Skype protocol notes

It looks a lot like msnp21 with a different login process.


If you log in with a MS Account, you start (in the MSNP stream) by being referred to as and end up as something more like 8:live:alice_1, 8 apparently being the namespace for Skype users. Looks like the documented process for logging in to Windows Live, with scope (there's mention of ambientssl in later in the MSNP21 parts!) and client ID 00000000480BC46C

Follow that, eventually you get a redirection to the URL you requested as the callback (Skype requests with a big fragment and a fuckton of cookies. Note that so long as you use Skype's client ID you pretty much [i]have[/i] to use that URL. WL will complain if you use anything it doesn't like, which is probably any other URL given that Skype is a desktop application.

access_token=<lots of base64>
refresh_token=<a bit less base64>
user_id=<a bunch of hex> // I guess this is one of the forms of UID that WL uses?

Skype then requests with query parameters

jsoncallback=<valid JS name>
access_token=<the token we got from l.l.c>
_=<some number>

and gets back some JSON wrapped in a call to the function named by jsoncallback (optional parameter, leave it out for normal JSON). Guess it's a very basic profile information.

  "gender": "m",
  "siteId": 287688,
  "firstName": "REDA",
  "cid": <a bunch of hex>, // same thing l.l.c gave us in user_id
  "siteName": "",
  "lastName": "CTED",
  "country": "UK",
  "email": <a mail address>, // It's the one I entered during the oauth2 stuff.
  "birthdate": <date in big-endian format> 

Next up, same sort of query to except now there's _accept=1.0 in the query too:

  "uid": <hex> , // WL CID again.
  "username": <some string>, // This is important for the MSNP parts.
  "status": "ACTIVE", // Account is enabled?
  "partnerUsername": <email address> // Yeah, this is my WL login name.

Note that partnerUsername and username can be related: for me, live:alice_1 and respectively. Interesting that there's a 999 in the URL as well as returned in the first login token.

I guess this is how Skype knows what username to use later on given I entered partnerUsername when logging in but username is used once logged in.

The refresh_token is then used to get more authentication tokens, post to with urlencoded body

refresh_token=<the refresh token from login>

Not sure what it's for, but the scopes

are used.

Contacts list

Note that ABFindAll from MSNP13 doesn't work.

This appears to use a mutant version of exchange activesync. Have a wbxml decoder ready. It also uses SOAP in places. The first request is SOAP to, and looks like this:

<?xml version='1.0' encoding='utf-8'?>
<soap:Envelope xmlns:soap="" 
    <ABApplicationHeader xmlns="">
      <CacheKey><!-- some long base64 string --></CacheKey>
    <ABAuthHeader xmlns="">
      <TicketToken><!-- the access_token for --></TicketToken>
    <FindMembershipByRole xmlns="">


<?xml version='1.0' encoding='utf-8'?>
<soap:Envelope xmlns:soap="" xmlns:xsi="" xmlns:xsd="">
    <ServiceHeader xmlns="">
    <FindMembershipByRoleResponse xmlns="">
            <CreatorCID><!-- number which is presumaby the CID from above read as a signed integer --></CreatorCID>

Which is odd. The MSNP21 link above says the address with the zero UUID is used to create groupchats, so it's anyone's guess what that is.

Then begins an ActiveSync conversation; starting by sending to That query string is base64 for (in Ruby's string escaping, so "\xnn" is a 0xnn byte) \x8C\t\t\x04\x10Skype-3026547794\x00\fClassicSkype. Currently not known exactly how that works; it may or may not be the documented form of activesync. The Authorization header contains "RPSToken", a space, and the access_token for

While that's going on, the Skype UI starts loading stuff, and there's another SOAP request, this time to The request envelope is the same as the last one, the body is now

<FindAllBlockedContacts xmlns=""/>

With response body

<FindAllBlockedContactsResponse xmlns="">

I have no blocked contacts, so I don't know what would go in there.

After that, it's msnp, looks like. Also like the contacts list is only attainable using activesync.


The backend doesn't do name translation between Messenger and Skype modes, so you see two different names used for you. One is 1:, the other is the one used for Skype itself.

/me is represented by adding the user's display name to the beginning of the message, and a header "Skype-EmoteOffset" with the length of that name.

It looks like the Registration and Set-Registration headers are for a cookie.