autoreg-skills-max: initial public release (restored, redacted, hardened)

2026-10-20 02:16:32 +03:00
commit f58eafeb48
565 changed files with 60064 additions and 0 deletions
--- a/skills/account-validation/references/new-api-fork-registration.md
+++ b/skills/account-validation/references/new-api-fork-registration.md
@@ -0,0 +1,219 @@
+# "New API" Fork Registration — Dual Captcha Pattern
+
+## Overview
+
+"New API" (also called "One API", "UNIKEY", "NewAPI") is a popular open-source AI API gateway. Many public instances run modified forks. This reference covers the registration flow for these forks.
+
+The canonical fork is at `https://github.com/QuantumNous/new-api` — the getunikey.ai instance runs version `0052ce8`.
+
+## API Discovery
+
+```bash
+# Status endpoint — reveals ALL config
+curl -s https://TARGET/api/status | jq .data
+
+# Key fields:
+#   register_enabled: true/false
+#   password_register_enabled: true/false
+#   password_login_enabled: true/false
+#   google_oauth: true/false
+#   web3_login: true/false
+#   email_verification: true/false
+#   turnstile_check: true/false
+#   turnstile_site_key: "0x4AAAAA..."
+#   hcaptcha_check: true/false
+#   hcaptcha_site_key: "uuid-format-key"
+#   google_client_id: "..." — if google_oauth enabled
+#   walletconnect_project_id: "..." — if web3_login enabled
+```
+
+## Dual Captcha Pattern (Turnstile + hCaptcha)
+
+**CRITICAL**: Some "New API" instances have BOTH `turnstile_check: true` AND `hcaptcha_check: true`. The server requires BOTH tokens, but the frontend page may only render ONE widget (Turnstile). The hCaptcha JS is loaded globally (`typeof hcaptcha !== 'undefined'` returns true) but the widget is NOT initialized on the page.
+
+### Server-side validation
+
+Both tokens are sent as QUERY PARAMETERS:
+```
+POST /api/user/register?turnstile=TOKEN&hcaptcha=HCAPTCHA_TOKEN
+POST /api/user/login?turnstile=TOKEN&hcaptcha=HCAPTCHA_TOKEN
+```
+
+The JS code pattern:
+```javascript
+FH.post("/api/user/login", {username, password}, {params: {turnstile: e.turnstile??"", hcaptcha: e.hcaptcha??""}})
+```
+
+### Error messages by scenario
+
+| Scenario | Error |
+|----------|-------|
+| No turnstile param | `"Turnstile token 为空"` |
+| No hcaptcha param | `"hCaptcha token 为空"` |
+| Invalid turnstile | `"Turnstile 校验失败，请刷新重试！"` |
+| Invalid hcaptcha | `"hCaptcha 校验失败：invalid-input-response"` |
+| Both valid | `"success": true` |
+
+### Workaround
+
+1. **capsolver.com** solves both Turnstile AND hCaptcha (~$0.0004/solve each)
+2. For Turnstile: use `AntiTurnstileTaskProxyLess` type
+3. For hCaptcha: use `HCaptchaTaskProxyLess` type with the sitekey from `/api/status`
+4. Send both tokens as query parameters
+
+OR
+
+1. Use `undetected-chromedriver` (Python 3.11) to get Turnstile token from the page
+2. Manually render hCaptcha via JS and get its token
+3. Send both via API
+
+## Registration Endpoints
+
+```python
+BASE = "https://TARGET"
+
+# Register
+POST /api/user/register?turnstile=TOKEN&hcaptcha=HCAPTCHA
+Body: {"username": "email@domain.com", "password": "Pass123!", "aff": "REF_CODE"}
+
+# Login
+POST /api/user/login?turnstile=TOKEN&hcaptcha=HCAPTCHA
+Body: {"username": "email@domain.com", "password": "Pass123!"}
+# Returns: {"success": true, "data": {"access_token": "..."}}
+
+# Get API keys
+GET /api/token/?p=1&size=10
+Headers: {"Authorization": "Bearer ACCESS_TOKEN"}
+
+# Create API key
+POST /api/token/
+Headers: {"Authorization": "Bearer ACCESS_TOKEN"}
+Body: {"name": "auto", "remain_quota": 500000, "expired_time": -1, "unlimited_quota": false}
+```
+
+## TokenHarbor.ai — Same "New API" Fork
+
+TokenHarbor.ai runs the same "New API" fork. Config:
+- `turnstile_check: true`, sitekey: `0x4AAAAAADBuC8Knz1EJZx9-`
+- `hcaptcha_check: false` — only Turnstile required
+- `password_register_enabled: true` — email/password registration works
+- `email_verification: true` — verification email required
+
+### $5 Claim Flow
+
+After registration, TokenHarbor offers a $5 credit claim:
+1. Login to the dashboard
+2. Look for "Claim $5" or similar button
+3. This triggers a verification email check
+4. If already verified: `$5 claimed!` immediately
+5. If not verified: click "Verify email" → new verification email sent → verify → claim
+
+## Google OAuth Path
+
+If `google_oauth: true` and `google_client_id` is set:
+1. Call `/api/oauth/state?turnstile=TOKEN&aff=REF` to get OAuth state
+2. Redirect to Google OAuth with the state
+3. After callback, the site creates/links the account
+4. The OAuth state endpoint ALSO requires Turnstile (and hCaptcha if enabled)
+
+## Web3 Wallet Path
+
+If `web3_login: true` and `walletconnect_project_id` is set:
+- Wallet connection is handled entirely client-side via WalletConnect
+- No server-side API endpoints for wallet auth
+- The browser's WalletConnect modal handles the signing flow
+- Not automatable without browser interaction
+
+## Email Verification Flow (rsiai.net / New-Api v1.0.0)
+
+Some New-Api instances require email verification on registration (`email_verification: true`). The flow differs from the direct register pattern:
+
+### Step 1: Send verification code
+```
+GET /api/verification?email=user@outlook.com&turnstile=TOKEN
+```
+- Returns session cookie on success: `Set-Cookie: session=MTc4OTU1...`
+- Turnstile token is OPTIONAL in query params (depends on `turnstile_check` config)
+- Response: `{"success":true}` on success
+
+### Step 2: Register with code
+```
+POST /api/user/register?turnstile=TOKEN
+Body: {"username": "...", "password": "...", "email": "...", "verification_code": "123456"}
+```
+- All fields required: username, password, email, verification_code
+- Turnstile token in URL query parameter (same as login/full-register)
+- Unlike the direct register flow, NO hCaptcha field required
+
+### Source: LuckyForge (yurika0211/LuckyForge)
+
+The authoritative API contract is in `frontend/src/api/client.ts`:
+```typescript
+// Send code
+export async function sendVerifyCode(params: SendVerifyCodeParams): Promise<void> {
+  const search = new URLSearchParams({ email: params.email })
+  if (params.turnstile_token) search.set('turnstile', params.turnstile_token)
+  await fetch(`${NEWAPI_AUTH_BASE}/api/verification?${search}`, { method: 'GET', credentials: 'include' })
+}
+
+// Register
+export async function register(params: RegisterParams): Promise<void> {
+  const query = params.turnstile_token ? `?turnstile=${encodeURIComponent(params.turnstile_token)}` : ''
+  await fetch(`${NEWAPI_AUTH_BASE}/api/user/register${query}`, {
+    method: 'POST',
+    body: JSON.stringify({ username, password, email, verification_code: params.code })
+  })
+}
+```
+
+### When API approach fails: Browser-based bypass
+
+If the Turnstile sitekey is NOT in `/api/status` and NOT findable in JS bundles (minified/hidden), AND the server returns `"Turnstile token 为空"` — fall back to browser automation:
+
+1. Use **Playwright** (not plain CDP — Turnstile detects CDP)
+2. Navigate to sign-up page → fill form → click "Send code" (browser solves Turnstile naturally)
+3. Read verification code from Outlook IMAP (`outlook.office365.com:993`)
+4. Enter code + submit in browser
+5. After login, go to `/token` → extract API key from page/DOM
+
+This is the pattern used for rsiai.net (2026-09-16), which runs New-Api v1.0.0 on nginx/1.18.0 Ubuntu.
+
+### rsiai.net specifics
+
+- URL: `https://www.rsiai.net`
+- Email provider: **Outlook only** (Gmail blocked/not accepted)
+- Models: Fable 5, Opus 5, GPT-6 Astra, GPT-5.6
+- $1 starter credit → internal coefficients: Fable 5=$7, GPT-6 Astra=$18, Opus 5=$20
+- API base: `https://www.rsiai.net/v1`
+- Registration: username/password/email/code, no Google OAuth
+- Session cookie: `session=MTc4OTU1...` (HttpOnly, Secure, SameSite=Strict, 30-day expiry)
+- Turnstile: present but sitekey hidden in minified JS bundle — browser-based bypass works
+
+**Status:** Exploration started, not yet automated.
+
+- URL: `https://www.tokenly.us/`
+- Signup: `https://www.tokenly.us/signup` (or via "Get started" CTA)
+- Form: email + optional referral code + Cloudflare Turnstile (no hCaptcha)
+- Turnstile sitekey: TBD (extract from page)
+- No `/api/status` discovered yet — may not be a New API fork
+- After signup: "Send codes" → email verification codes → login → API key
+- Models: Claude Opus 5, GPT-5.6 Sol, GLM-5.2, Claude Sonnet 5, GPT-5.6 Terra/Luna, DeepSeek V4 Flash
+- API format: `curl https://www.tokenly.us/api/v1/chat/completions -H "Authorization: Bearer ***"`
+- 50 free credits on signup
+
+### Next steps
+1. Check if `/api/status` exists (New API fork detection)
+2. Try registration with a test email
+3. Extract Turnstile sitekey from page source
+4. If Turnstile blocks CDP → use undetected-chromedriver + capsolver
+5. After registration: login → API key page → extract key → push to gateway
+
+## Pitfalls
+
+1. **Dual captcha mismatch**: Server requires both Turnstile + hCaptcha, but frontend only renders Turnstile. The hCaptcha is loaded globally but not initialized. This makes browser-based form submission impossible — must use API with both tokens from a captcha service.
+2. **Turnstile token is query parameter**: Sending `cf-turnstile-response` in the JSON body returns `"Turnstile token 为空"`. Must use `?turnstile=TOKEN` in URL.
+3. **hCaptcha site key validation**: The hCaptcha site key format `31e08332-1e10-4ece-849e-23b652d6d3fc` (UUID v4) is VALID — confirmed via `hcaptcha.com/checksiteconfig`. hCaptcha site keys can be UUIDs, not just `10000000-ffff-ffff-ffff-000000000001`.
+4. **Turnstile CDP detection**: Headless Chrome (CDP, `--headless`, `mcp__chrome_devtools__*`) is ALWAYS detected. The Turnstile iframe shows "Checking your browser..." forever. Use `undetected-chromedriver` (Python 3.11).
+5. **Python 3.14 breaks undetected-chromedriver**: `distutils.version.LooseVersion` was removed in Python 3.14. Use Python 3.11 (`C:/Users/User/AppData/Local/Python/Python311/python.exe`).
+6. **TokenHarbor email verification**: Some accounts show "Already verified" (from previous registration round), others need verification. The verification email is from `noreply@tokenharbor.ai` with subject containing "Verify".
+7. **TokenHarbor key push**: After claiming $5, push the API key to the gateway at `https://[REDACTED-NAME].loc.cc/th/provider/add?provider=tokenharbor`.