MaxxRK
maybe try api3x.firstrade.com
I am doing similar work as this project, I found the default Firstrade web page is not very convenient. They have a web interface called 'Navigator'(Sadly just shut down for a month) which uses api3x.firstrade.com as the domain, and it is a RESTful API, I think it will help you write functions more quickly. although the navigator does not open now, their mobile app still using the api3x, you can hack from that.
I have never messed with intercepting network traffic on an app. Where do you start with that?
I have finally had some time to intercept the app traffic and I do agree this python package will be better on the restful api they are using in the app. It looks easier to implement the new mfa as well as new features in the python-api itself. I have added a new branch to add options orders and I am planning to switch to api3x.firstrade.com at the same time. Thanks for the suggestion and stay tuned!