How to Scrape Xiaohongshu (RedNote) in 2026: Three Methods Compared

Xiaohongshu — marketed internationally as RedNote — is the hardest of the major Chinese platforms to collect data from, and the one people most often ask about. It has no public developer API, its web client signs every request, and its mobile client adds device attestation on top. Below are the three approaches teams actually use, and the conditions under which each one is the right call.

Method 1: Browser automation

Drive a real Chromium instance with Playwright or Puppeteer, log in with a real account, and read the rendered DOM. This is the approach most tutorials show because it is the easiest to get working on day one.

It is also the approach that fails first at scale. Every request is tied to a logged-in account, so rate limits and bans land on that account rather than on an anonymous pool. A headless browser costs roughly 300–500 MB of RAM per concurrent session, which makes even modest fan-out expensive. And the selectors break whenever the front end ships a redesign.

• Good for: one-off research, under a few hundred notes, no uptime requirement.
• Bad for: anything scheduled, anything that must not lose an account, anything above ~10 concurrent sessions.
• Hidden cost: someone has to own selector maintenance forever.

Method 2: Reverse-engineered signed endpoints

Xiaohongshu's web client computes an `x-s` / `x-t` signature pair for each XHR, derived from the request path, body and a timestamp. Reproduce that signing function and you can call the JSON endpoints directly, without a browser. Throughput improves by an order of magnitude and memory cost collapses.

The catch is that the signing algorithm is obfuscated and rotates. When it changes — historically every few months, sometimes faster — every request 403s until someone re-derives it from the new bundle. That is a specialist task measured in days, not hours, and it lands without warning.

Method 3: A hosted data API

A hosted API moves the signing, the proxy pool and the breakage response to someone else's on-call rotation. You call a stable REST endpoint and get JSON. The trade-off is per-request cost and dependence on the provider's coverage.

curl -H 'Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxx' \
  'https://api.spiderhubs.com/openapi/v1/contentcreator/xiaohongshu/web_v2/fetch_search_users?keywords=coffee&page=1'

SpiderHubs exposes the Xiaohongshu surface as a set of REST endpoints — user profile and posted notes, note detail for both image and video posts, note comments, home feed, the hot list, and creator search. Media URLs come back unwatermarked, and captions are available where the platform exposes them.

Choosing between them

The honest summary: build it yourself if collection is your product and you can staff it. Buy it if collection is an input to your product and the engineer-weeks are better spent elsewhere. The failure mode we see most often is a team choosing method 2 with no plan for the week the signature rotates.

A note on what you may legally collect

Everything above concerns publicly visible content — posts a platform serves to a logged-out or ordinary visitor. Collecting private messages, follower lists behind a privacy setting, or personal data of individuals is a different question with a different answer, and platform terms and local law both apply. Check both before you build.