autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/bulk-account-registration/references/blackbox-autoreg.md

@@ -0,0 +1,71 @@
+# Blackbox.ai — Registration Target
+
+**Discovered**: 2026-08-08 | **Updated**: 2026-08-08 (Google OAuth rejection, t-online.de delivery confirmed dead)
+
+## Quick facts
+- **Site**: https://app.blackbox.ai/
+- **API**: `https://enterprise.blackbox.ai/chat/completions` (OpenAI-compatible)
+- **Signup**: email + password, NO CAPTCHA on form
+- **Auth**: Google OAuth available as alternative ⚠️ **BLOCKED by Google**
+- **Verification**: 6-digit email code (required after signup)
+- **Pricing**: paid, per-token ($0.14–$30 per 1M tokens)
+- **Models**: 48+ shown in catalog, 300+ total
+
+## Registration flow
+
+### CDP Browser flow (confirmed working 2026-08-08)
+1. Navigate to `https://app.blackbox.ai/signup` (direct signup page, no login redirect needed)
+2. Fill email + password → click "CREATE ACCOUNT"
+3. **Response**: Next.js server action `POST /signup` returns `{"type":"success","resultCode":"USER_CREATED"}` — NO CAPTCHA
+4. Redirect to "Verify your email" page with 6-digit code input
+5. Poll IMAP for verification code → enter code → account activated
+
+### HTTP-only API (discovered 2026-08-08, NOT working headless)
+The signup is a Next.js server action (RSC) at `POST /signup` with multipart/form-data:
+- Fields: `1_email`, `1_password`, `0` = `["$undefined","$K1"]`
+- Required headers: `Content-Type: multipart/form-data`, `next-action` (dynamic — generated by JS, not in initial HTML), `accept: text/x-component`, `origin: https://app.blackbox.ai`
+- **Blocked**: The `next-action` header is dynamically generated by the React client bundle. It cannot be extracted from the initial HTML — only embedded in the RSC payload after JS loads. CDP browser is required for signup.
+
+## Pitfalls
+
+### Google OAuth — PERMANENTLY BLOCKED (2026-08-08)
+Google `/signin/rejected` for `blackbox.ai` OAuth client. Same pattern as Qoder: Google flags the OAuth application, not the browser. Even real Chrome CDP gets rejected with `idnf=[REDACTED-NAME]@gmail.com` + `epd=AVqPw...` in URL. The OAuth client itself is blacklisted by Google. **Do not waste time on Google OAuth for Blackbox.**
+
+### Email verification — delivery issues (updated 2026-08-08)
+- **t-online.de**: **Verification emails do NOT arrive.** Confirmed dead across 5 accounts: `[REDACTED-EMAIL]`, `[REDACTED-EMAIL]`, `[REDACTED-EMAIL]`, `[REDACTED-EMAIL]`, `[REDACTED-EMAIL]`. All IMAP checked — no Blackbox email in inbox or spam. Blackbox blocks t-online.de domains entirely.
+- **Gmail +aliases**: `[REDACTED-NAME]+bb1@gmail.com` accepted for signup (CDP confirmed: `USER_CREATED` response), but verification email never arrived at `[REDACTED-NAME]@gmail.com` inbox. Checked INBOX + All Mail + Spam — no Blackbox email. "Resend" button clicked, still no delivery.
+- **Gmail IMAP**: Password `IMAP_APP_PASSWORD` (app password for `[REDACTED-NAME]@gmail.com`, confirmed working 2026-08-08). Not the old `qomnkqyppivsxayz`.
+- **Guerrilla Mail**: Not tested yet for Blackbox. Domain `guerrillamailblock.com` is on disposable blocklists — likely rejected.
+- **Root cause**: Blackbox filters verification emails by domain reputation. t-online.de and Gmail+aliases both fail. Try business/private domain email (e.g. `@reforrm.me`), ProtonMail, or a different Gmail account (not +alias).
+
+### No CAPTCHA on form
+Simpler than TokenHarbor (no Turnstile), but email verification is the hard gate. No way to bypass without receiving the verification code.
+
+### Paid platform
+No free tier or welcome credits discovered. API access is paid-only.
+
+## Key models
+| Model ID | Input $/M | Output $/M |
+|----------|-----------|------------|
+| `z-ai/glm-5.2` | $1.40 | $4.40 |
+| `deepseek/deepseek-v4-pro` | $0.44 | $0.87 |
+| `deepseek/deepseek-v4-flash` | $0.14 | $0.28 |
+| `anthropic/claude-opus-4.8` | $5 | $25 |
+| `openai/gpt-5.5` | $5 | $30 |
+| `moonshotai/kimi-k2.7-code` | $0.74 | $3.50 |
+| `nvidia/nemotron-3-ultra` | $0.32 | $0.80 |
+| `google/gemini-3.5-flash` | $1.50 | $9 |
+| `x-ai/grok-4.3` | $1.25 | $2.50 |
+
+## API usage
+```bash
+curl -X POST https://enterprise.blackbox.ai/chat/completions \
+  -H "Authorization: Bearer sk-..." \
+  -H "Content-Type: application/json" \
+  -d '{"model":"z-ai/glm-5.2","messages":[{"role":"user","content":"hi"}]}'
+```
+
+## Next steps for auto-reg
+- **Primary blocker**: Find email provider that Blackbox actually delivers to. t-online.de and Gmail+aliases both confirmed dead. Try business/private domain email (e.g. `@reforrm.me`) or ProtonMail.
+- **CDP signup works**: The signup flow itself is working — no CAPTCHA, browser-based form submission succeeds. Only email verification delivery is the blocker.
+- **No GitHub OAuth found**: Only Google OAuth (blocked) and email+password (working but verification blocked).