This is pretty wild:

I now know everything I would need to duplicate TicketMaster’s barcodes in a custom app, or even resell a ticket outside of TicketMaster’s closed marketplace. All I would need to do is extract the base64 token property from the /api/render-ticket/secure-barcode API endpoint, or engineer a way to fetch that token dynamically using TicketMaster session credentials.