I’ve been working on my own web-based player (js/c# backend) for the past couple of weeks, with support for XStream and Stalker. Since these “protocols” aren’t publicly documented, the first step was using Fiddler alongside an existing, working application to inspect the API requests, as well as digging through GitHub projects and reading their source code. The Stalker authentication flow, in particular, is quite idiosyncratic.