autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/ai-provider-autoreg/references/unikey-autoreg-analysis.md

@@ -0,0 +1,89 @@
+# UNIKEY.AI (getunikey.ai) — New API Fork Analysis
+
+**Date:** 2026-08-09
+**Site:** https://www.getunikey.ai
+**Type:** New API / One API fork (AI gateway)
+**Affiliate:** `?aff=W2rW`
+
+## API Structure
+
+Site is a React SPA. All API endpoints under `/api/`.
+
+### Key endpoints:
+- `GET /api/status` — FULL config dump (captcha, OAuth, registration settings)
+- `GET /api/setup?t=<ts>` — setup status
+- `POST /api/user/register` — registration (email + password)
+- `POST /api/user/login` — login
+- `GET /api/token/?p=1&size=10` — API key list (auth required)
+- `POST /api/token/` — create API key
+- `GET /api/oauth/state` — OAuth state (needs Turnstile)
+- `GET /api/models/available` — models (auth required)
+
+### Config from `/api/status` (2026-08-09):
+```json
+{
+  "password_login_enabled": true,
+  "password_register_enabled": false,
+  "register_enabled": true,
+  "google_oauth": true,
+  "web3_login": true,
+  "turnstile_check": true,
+  "turnstile_site_key": "0x4AAAAAAD83S5lYamgIOFL4",
+  "hcaptcha_check": true,
+  "hcaptcha_site_key": "31e08332-1e10-4ece-849e-23b652d6d3fc",
+  "email_verification": true,
+  "google_client_id": "190146626926-416bbh8g0ft25u7rll5a82k2plk4atel.apps.googleusercontent.com",
+  "walletconnect_project_id": "[REDACTED-KEY]"
+}
+```
+
+## Double Captcha Trap
+
+**CRITICAL:** This site has BOTH `turnstile_check: true` AND `hcaptcha_check: true`. The server requires BOTH tokens for registration/login. However, only the Turnstile widget is rendered on the sign-in page — the hCaptcha widget is NOT initialized.
+
+### Captcha token format:
+Tokens are sent as **query parameters**, NOT in the request body:
+```bash
+POST /api/user/register?turnstile=<TOKEN>&hcaptcha=<TOKEN>
+Body: {"username": "...", "password": "...", "aff": "W2rW"}
+```
+
+### Error messages:
+- `"Turnstile token 为空"` — Turnstile missing
+- `"hCaptcha token 为空"` — hCaptcha missing
+- `"Turnstile 校验失败，请刷新重试！"` — Turnstile invalid/expired
+- `"hCaptcha 校验失败：invalid-input-response"` — hCaptcha invalid
+
+### hCaptcha verification:
+The hCaptcha site key `31e08332-1e10-4ece-849e-23b652d6d3fc` is VALID (confirmed via `hcaptcha.com/checksiteconfig`). The server calls the hCaptcha API to validate tokens.
+
+## Registration Flow
+
+1. **Turnstile bypass**: `undetected-chromedriver` on Python 3.11 successfully solves Turnstile (headless Chrome fails). Token via `window.turnstile.getResponse()`.
+2. **hCaptcha blocker**: hCaptcha widget not rendered on page → no way to get a valid token through browser automation.
+3. **Solution**: Use capsolver.com to solve BOTH Turnstile AND hCaptcha programmatically.
+
+## Registration Options
+
+1. **capsolver** (recommended): Solve both Turnstile + hCaptcha via API. ~$0.0004/Turnstile + ~$0.001/hCaptcha per solve.
+2. **Google OAuth**: Bypasses captcha but requires real Google account. Button disabled until Turnstile solved.
+3. **Web3 wallet**: WalletConnect integration. Might bypass captcha. Not tested.
+
+## Scripts
+
+- `unikey_autoreg.py` — API-based registration with capsolver (needs `CAPSOLVER_KEY`)
+- `unikey_autoreg_v2.py` — undetected-chromedriver browser-based (Turnstile only, blocked by hCaptcha)
+- `unikey_autoreg_v3.py` — full browser automation attempt
+
+## Key Format
+
+**Confirmed (2026-10-13):** Registration succeeded via password login on existing account (group `unikey`, uid 904331). Key has NO `sk-` prefix — raw 48-character alphanumeric string (e.g. `N084WS...`). Retrieved via `GET /api/token/961113/key` with session cookie. The `/v1/models` endpoint returns 200 with the key as Bearer.
+
+**Credits:** remain_quota 0, quota 0 — the advertised "5000 compute credits" were NOT granted to this email-registered account. No credit claim/check-in endpoint found. The credit may be for Google OAuth signups or a limited-time promo that ended.
+
+## Related
+
+- `tokenharbor.ai` — similar New API fork, NO captcha, working CDP automation
+- `aiqianshu.com` — similar New API fork, Turnstile only
+- `api-key-harvesting` skill — for key validation and gateway integration
+- `nace-ai-autoreg.md` — similar credit-gate pattern: email signup excluded from free credits