I've tried to reverse engineer it, but failed. The best place to start, IMO, is the communication between client-server over a websocket. It is binary, but shows some interesting data and keys as in key-names, from key-value, not crypto-keys).

My idea was to make an API-rate limiter, where a client has to submit a list of calculated hashes (PoW) with each request and so protect the API against bots, scrapers and other (D)DoS attacks. Bad idea, because the data that has to be transfered (in Headers) is going to huge, megabytes, if you want to make even a few cents on a million-hits-per-day API.