autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/bulk-account-registration/references/clerk-oauth-only-detection.md

@@ -0,0 +1,64 @@
+# Clerk Auth: Detecting OAuth-Only Sign-Up
+
+## Problem
+
+When a platform uses Clerk for auth, email sign-up may silently fail with `captcha_missing_token` or `email_address is not a valid parameter` — even with a valid Turnstile token. The root cause is NOT the CAPTCHA: the Clerk dashboard has email sign-up DISABLED.
+
+## Detection
+
+Before attempting email registration, check the Clerk environment:
+
+```bash
+curl -s https://clerk.PLATFORM.COM/v1/environment?__clerk_api_version=2025-11-10 | \
+  python3 -c "import sys,json; d=json.load(sys.stdin); print(d['auth_config']['identification_requirements'])"
+```
+
+Key field: `auth_config.identification_requirements` — a list of lists. Each sublist is a set of strategies where at least ONE must be used.
+
+```json
+// OAuth-ONLY (tuskcentral.ai):
+"identification_requirements": [["oauth_apple","oauth_facebook","oauth_google","oauth_token_apple"],[]]
+
+// Email + OAuth:
+"identification_requirements": [["email_address","oauth_google"],[]]
+
+// Email only:
+"identification_requirements": [[]]
+```
+
+If `email_address` is NOT in any sublist, email sign-up is impossible. The API will return:
+- `captcha_missing_token` (code misleading — CAPTCHA was fine, but email isn't allowed)
+- `email_address is not a valid parameter for this request`
+
+## Turnstile Token Still Needed
+
+Even for OAuth sign-up, the Turnstile token may be required. The solver service at `solver/service.py` (port 8191) provides Turnstile tokens. Extract the sitekey from `display_config.captcha_public_key` (visible) or `display_config.captcha_public_key_invisible`.
+
+## Example: tuskcentral.ai
+
+```
+Clerk API:     https://clerk.tuskcentral.ai/v1/
+Publishable:   pk_live_Y2xlcmsudHVza2NlbnRyYWwuYWkk
+Sitekey:       0x4AAAAAAAWXJGBD7bONzLBd (visible)
+Invisible:     0x4AAAAAAAFV93qQdS0ycilX
+Sign-up:       OAuth only (Google, Apple, Facebook)
+Sign-in:       Email + OTP (email_code) OR OAuth
+Identification: [["oauth_apple","oauth_facebook","oauth_google","oauth_token_apple"],[]]
+Block disposable: true
+Cloudflare:    Yes — direct API calls return 403 error 1010; browser-based Clerk JS SDK works
+```
+
+## Workflow
+
+1. `GET /v1/environment` → check `identification_requirements`
+2. If OAuth-only → switch to Google OAuth (or abandon email approach)
+3. If email allowed → get Turnstile token from solver, then `POST /v1/client/sign_ups`
+4. Never waste CAPTCHA solver credits on OAuth-only platforms
+
+## Solver Service Dependency
+
+The Turnstile solver at `solver/service.py` (port 8191) must be running:
+```bash
+cd "<project>/solver" && python service.py
+```
+Check: `curl -s http://127.0.0.1:8191/health`