autoreg-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok60915d52e8425
111
skills/account-validation/references/blackbox-ai-registration.md
Normal file
111
skills/account-validation/references/blackbox-ai-registration.md
Normal file
@@ -0,0 +1,111 @@
|
||||
# Blackbox.ai Registration & API
|
||||
|
||||
## Registration Flow
|
||||
|
||||
Blackbox.ai (`app.blackbox.ai`) — multi-agent orchestration platform with 48+ AI models, paid API access.
|
||||
|
||||
### Signup Mechanism
|
||||
|
||||
- Signup page: `https://app.blackbox.ai/signup`
|
||||
- **NO CAPTCHA** on the signup form — just email + password
|
||||
- **Next.js server action**: The form submits via `POST /signup` with `multipart/form-data` and `text/x-component` accept header
|
||||
- Response: `{"type":"success","resultCode":"USER_CREATED"}` (RSC format)
|
||||
- **NO browser needed** for the POST itself, but the `next-action` header is dynamically generated from the page — cannot be hardcoded for HTTP-only signup
|
||||
|
||||
### HTTP Signup Attempt (Partial)
|
||||
|
||||
The signup endpoint is `POST https://app.blackbox.ai/signup` with body:
|
||||
```
|
||||
------WebKitFormBoundary...
|
||||
Content-Disposition: form-data; name="1_email"
|
||||
|
||||
email@domain.com
|
||||
------WebKitFormBoundary...
|
||||
Content-Disposition: form-data; name="1_password"
|
||||
|
||||
password
|
||||
------WebKitFormBoundary...
|
||||
Content-Disposition: form-data; name="0"
|
||||
|
||||
["$undefined","$K1"]
|
||||
------WebKitFormBoundary...--
|
||||
```
|
||||
|
||||
Required headers:
|
||||
- `Content-Type: multipart/form-data; boundary=...`
|
||||
- `next-action: <40-char hex from page>` — **dynamically generated, not in initial HTML**
|
||||
- `Accept: text/x-component`
|
||||
- `Origin: https://app.blackbox.ai`
|
||||
|
||||
Without a valid `next-action` header, the server returns a generic 400 error. The action ID is client-side generated and changes per session.
|
||||
|
||||
### Email Verification (BLOCKER)
|
||||
|
||||
- After signup, sent to "Verify your email" page (6-digit code)
|
||||
- **t-online.de emails DO NOT receive verification emails from Blackbox** — tested with multiple accounts (asmoky, kevinfischer05, daniel.brueck, eric.foeller)
|
||||
- **Gmail also does not receive** — tested with `[REDACTED-NAME]+bb1@gmail.com` (no email found in inbox)
|
||||
- Email may be delayed or filtered by domain. Alternative email providers (Outlook, ProtonMail) untested.
|
||||
- Login returns 500 Internal Server Error when account is unverified — verification is a hard requirement
|
||||
|
||||
### Google OAuth (BLOCKED)
|
||||
|
||||
- Google sign-in button on login/signup pages
|
||||
- **Google blocks OAuth for Blackbox via CDP**: navigates to `accounts.google.com/v3/signin/rejected` with "browser or app may be unsafe"
|
||||
- This happens even in the user's real Chrome via CDP (not just headless)
|
||||
- Google client_id: `985058387028-iaa60lr5e586kvhjp085qcojv3jv2p7h.apps.googleusercontent.com`
|
||||
|
||||
## API Access
|
||||
|
||||
### Endpoint
|
||||
|
||||
- API base: `https://enterprise.blackbox.ai/chat/completions`
|
||||
- OpenAI-compatible format
|
||||
- Paid tier only — requires verified account with billing
|
||||
|
||||
### Models (48+)
|
||||
|
||||
Documented at `https://www.blackbox.ai/models`. Notable models:
|
||||
- `z-ai/glm-5.2` ($1.40/$4.40 per MTok)
|
||||
- `deepseek/deepseek-v4-pro` ($0.44/$0.87)
|
||||
- `anthropic/claude-opus-4.8` ($5/$25)
|
||||
- `openai/gpt-5.5` ($5/$30)
|
||||
- `moonshotai/kimi-k2.7-code` ($0.74/$3.50)
|
||||
- `nvidia/nemotron-3-ultra` ($0.32/$0.80)
|
||||
- `google/gemini-3.5-flash` ($1.50/$9)
|
||||
- `x-ai/grok-4.3` ($1.25/$2.50)
|
||||
- `anthropic/claude-sonnet-5` ($3/$15)
|
||||
- `anthropic/claude-opus-5` ($15/$75)
|
||||
|
||||
## Integration Strategy
|
||||
|
||||
### Working Approach
|
||||
|
||||
1. Use CDP Chrome to fill signup form (no CAPTCHA — works)
|
||||
2. Account is created immediately (`USER_CREATED`)
|
||||
3. Verification email — **unsolved for t-online.de and Gmail**
|
||||
4. Alternative: use a different email provider that Blackbox accepts
|
||||
|
||||
### CDP Signup Pattern (Working)
|
||||
|
||||
```python
|
||||
# Navigate to signup
|
||||
page.goto("https://app.blackbox.ai/signup")
|
||||
|
||||
# Fill form
|
||||
page.fill('input[type="email"]', email)
|
||||
page.fill('input[type="password"]', password)
|
||||
|
||||
# Click CREATE ACCOUNT
|
||||
page.click('button:has-text("CREATE ACCOUNT")')
|
||||
|
||||
# Wait for verify page
|
||||
page.wait_for_selector('text=Verify your email')
|
||||
```
|
||||
|
||||
### Pitfalls
|
||||
|
||||
- **No API-only signup**: The `next-action` header is session-bound and dynamically generated — HTTP-only signup is not feasible
|
||||
- **Email domain blocking**: Blackbox appears to filter/block t-online.de and Gmail alias addresses for verification emails
|
||||
- **Google OAuth blocking**: Google considers Blackbox's OAuth integration "unsafe" and blocks sign-in via CDP
|
||||
- **Verification is hard requirement**: Unverified accounts cannot login (500 error on `/api/auth/callback/credentials`)
|
||||
- **CSRF token**: Available at `/api/auth/csrf` but login requires verification first
|
||||
Reference in New Issue
Block a user