But I could also just dex2jar + JD-GUI the Android app and study the decompiled Java code to see what they're doing.
Edited to add: https://twitter.com/CiPHPerCoder/status/1042870740880637952