Need help with YouTube stream extraction in Android app - persistent 403 errors despite trying every approach

[Mathias8405]

Checklist

• I made sure that there are no existing issues or discussions - open or closed - which I could contribute my information to.
• I have taken the time to fill in all the required details. I understand that the question will be dismissed otherwise.
• I have read and understood the contribution guidelines.

What is/are your question(s)?

I'm building an Android app in Kotlin to extract YouTube video stream URLs and download them. I've hit a wall with 403 Forbidden errors and I'm hoping the community can point me in the right direction.

What I've tried:

• Custom cipher logic with Rhino - Extracted the player JS, found the n transform and signature decrypt functions, executed them with Rhino. Result: 403 errors because Rhino can't handle modern ES6+ JavaScript that YouTube uses.
• NewPipe Extractor library (v0.24.6) - Used the community-maintained library. Result: Failed with "Got HTML document, expected JSON response" error on the visitor_id endpoint. YouTube changed their API and the library hasn't been updated yet.
• WebView-based cipher (V8 engine) - Loaded YouTube's player JS into an Android WebView with full browser stubs (document, navigator, location, etc.), used JavascriptInterface to call the n transform and signature decrypt functions. Result: WebViewCipher never initialized properly or the functions returned unchanged values, still got 403.
• yt-dlp (youtubedl-android library) - Used the yt-dlp Android wrapper. Result: Streams populated briefly but then showed a message saying YouTube may be blocking requests.
• Cobalt API (cobalt.tools) - Used the third-party API that handles extraction server-side. Result: Still blocked, no streams returned.
• Cookie persistence with OkHttp CookieJar - Shared cookies between the extraction request and the download request using JavaNetCookieJar. Result: Still 403.

What I've observed:

• Stream URLs are tied to the session that requested them
• YouTube validates cookies, User-Agent, Referer, and Origin headers
• The n parameter transformation is critical - without it, YouTube returns 403
• Even with correct n transformation, YouTube still rejects downloads from non-browser contexts

My question:

How do working YouTube downloaders like Seal, NewPipe, and yt-dlp actually bypass these protections on Android? Is there a specific approach to session management, cookie handling, or request signing that I'm missing? Any guidance or code examples would be greatly appreciated.

AI assistants and online tutorials haven't been able to solve this, so I'm turning to the community. Thank you in advance for any help.

Additional information

No response

[absurdlylongusername]

1. Confirm whether you get these same errors in browser while logged out?
2. While logged in?
3. Are you extracting while logged out or logged in? (idk what CookieJar is but if you're getting 403 maybe you're not using it correctly?)
4. Extractor is on version 0.26.1.
5. What is the content of the 403? Does it not give any detailed error message?
6. YT is known to block IPs, but also their blocking mechanism is not just limited to IPs. E.g. I can access youtube on browser but on NewPipe for the same IP, because YT detects something in NewPipe that it doesn't in the browser or vice versa. So unless you are cycling IPs and confirming that the IP you are trying to extract with at least works in the browser while logged out, your tests are automatically invalid.
7. Seal, NewPipe, yt-dlp, Morphe, grayjay, and desktop and mobile browser all work. So if what you're doing is not working, it's because you're doing something wrong.

All these things are open source: how come you're not just reverse engineering what they are doing and copy paste? Or am I missing something?