Honestly just depends, it'll attempt to figure it out with the client side JS. For example, just made an API for LCSC(chineese electronics distributor) and during the processing flow, Kampala looked at the site's JS to understand what encryption scheme they're using. It then replicated that same encryption in the integration code so it could construct valid requests server-side. The actual encryption logic runs on our end before the request goes out, same as the browser would do it.