autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/bulk-account-registration/references/aiqianshu-rate-limits.md

@@ -0,0 +1,35 @@
+# aiqianshu rate limit reference
+
+## Rate Limit Pattern (per IP)
+
+| Endpoint | Method | Rate Limit | Notes |
+|----------|--------|------------|-------|
+| /api/user/register | POST | 2-3 per 10-15 min | The bottleneck |
+| /api/user/login | POST | Unlimited* | Login freely |
+| /api/token/ | POST | Unlimited* | Token creation |
+| /api/token/batch/keys | POST | Unlimited* | Key extraction |
+| /api/verification | POST | N/A | Send-code (NOT the register endpoint) |
+| Browser send-code | POST | Unlimited | Different CSRF/session handling |
+| Browser register | POST | Same as API | Shared rate limit |
+
+*"Unlimited" means no observed rate limiting in practice during bulk operations.
+
+## Code Expiry
+- Verification codes expire in ~10 minutes
+- Must register within 2-3 minutes for safety margin
+- Expired codes return: `{"message":"Verification code is incorrect or has expired"}`
+
+## 429 Response
+- Empty body: `HTTP 429` with no JSON
+- Applies to ALL POST endpoints on the rate-limited IP
+- Recovery: ~5-15 minutes of inactivity
+- Browser and API share the same rate limit counter
+
+## Key Extraction Note
+Keys created before ~aq0010 have `sk-` prefix. Later keys have alphanumeric format without prefix. Both formats work with `Authorization: Bearer <key>`.
+
+## Proxy Handling
+- HTTP proxies work reliably with requests library
+- SOCKS5 proxies often fail on HTTPS endpoints
+- Proxy test: POST to /api/user/login with dummy credentials, expect 200
+- Dead proxies: timeout, connection refused, or non-200 status