autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/ai-provider-autoreg/references/nexotoken-whitelist-autoreg.md

@@ -0,0 +1,58 @@
+# Nexotoken.net — Domain Whitelist & Turnstile Autoreg
+
+**Service:** nexotoken.net (AI API gateway, ~40 models, $3/7days promo)
+**Base API:** `https://www.nexotoken.net/api`
+**Auth:** FingerprintJS visitorId + Cloudflare Turnstile on BOTH send-code and register
+
+## Critical: Email Domain Whitelist
+
+Nexotoken enforces a DOMAIN WHITELIST for registration. `POST /api/auth/send-code` returns `400 validation_error` for blocked domains:
+
+| Domain | Status | Error |
+|---|---|---|
+| **t-online.de** | ✅ ACCEPTED | 200 success |
+| **icloud.com** | ✅ ACCEPTED | 200 success |
+| **qq.com / foxmail.com / 163.com / 126.com** | ✅ ACCEPTED | (listed in error as examples) |
+| **gmail.com** | ❌ BLOCKED | "Google 邮箱请使用 Google 快捷登录，暂不支持邮件验证码注册" |
+| **voidash.bond** | ❌ BLOCKED | "当前平台仅支持主流邮箱域名注册" |
+| **outlook.com** | ❌ BLOCKED | same whitelist error |
+| **hotmail.com** | ❌ BLOCKED | same whitelist error |
+
+**Decision: use t-online.de pool (C:/Users/User/Desktop/avtoreg/working_mails.txt) with IMAP at secureimap.t-online.de:993.**
+
+Probe new domains: solve 1 Turnstile via sidecar, call send-code, read the error.
+
+## Registration Flow (HTTP-only)
+
+1. **Turnstile**: sitekey `0x4AAAAAADkmZg-ZC-lJ2DRw`, page `https://www.nexotoken.net/register`
+   - Sidecar: `POST http://127.0.0.1:8877/solve {"type":"turnstile","url":"...","sitekey":"...","real_page":true}`
+2. **Send-code**: `POST /api/auth/send-code {email, turnstileToken, fingerprint, acq: null}`
+   - `fingerprint` = FingerprintJS visitorId (32-char hex; server may validate — use random hex, not static)
+   - Response: `{success:true, data:{registrationSession:"..."}}`
+3. **OTP**: read 6-digit code from email (IMAP: filter by "nexotoken" keyword)
+4. **Register**: `POST /api/auth/register {username, email, password, displayName, verificationCode, registrationSession, turnstileToken, fingerprint}`
+   - Requires FRESH Turnstile token (the one from send-code may be consumed)
+   - Response: `{success:true, data:{token:"...", user:{...}}}`
+5. **Token**: Bearer token from register response → stored in localStorage as `token`
+6. **Balance**: `GET /api/user/balance` (auth required)
+7. **API keys**: probe `/api/keys`, `/api/user/keys`, `/api/api-keys`
+
+## Endpoints Discovered
+
+- `/api/auth/send-code` — send verification code
+- `/api/auth/register` — complete registration
+- `/api/auth/login` — login (username + password + turnstile)
+- `/api/auth/verify` — verify session
+- `/api/user/balance` — credit balance
+- `/api/user/stats` — usage stats
+- `/api/models/featured` — featured models
+- `/api/models/providers` — provider list
+- `/api/public/model-status` — public model status
+
+## Turnstile Double Requirement
+
+Both send-code AND register require valid Turnstile tokens — the same token cannot be reused. Obtain a fresh token for each step.
+
+## Base URL
+
+`https://www.nexotoken.net/api` — all paths are relative to this base. The request helper prepends `/api` to all paths.