Identify Den on your network

Recognize Den’s requests in proxy logs and firewall rules, and learn what the app connects to.

This article is for network administrators who manage Den in schools, libraries, and workplaces, and for publishers who want to recognize Den in their server logs.

What Den connects to

Den connects to the websites behind the channels a person subscribes to. That means feed URLs, the article pages those feeds link to, and the images they reference. Nothing else originates from the app.

Den has no servers of its own. It does not send analytics, telemetry, or crash reports, and it does not check in with the developer. iCloud sync, App Store updates, and Apple-hosted asset downloads are handled by the operating system on Den’s behalf, from Apple’s own system processes rather than from the app. Apple documents those connections in Use Apple products on enterprise networks.

Recognize Den’s requests

Every request Den makes carries a Den.io/ product token in its User-Agent header. The number after Den.io/ is the build number. The token appears in one of two forms.

Feed refreshes, feed discovery, and image downloads send the token on its own:

User-Agent: Den.io/400

The article viewer is a WebKit web view. It uses WebKit’s standard identification followed by the same token and build number:

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Den.io/400

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Den.io/400

Den never identifies itself as Safari or any other browser, and it sends no operating system version in the User-Agent of its data requests.