autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/bulk-account-registration/references/clickup-autoreg-reverse-engineering.md

@@ -0,0 +1,92 @@
+# ClickUp Registration — Full Reverse Engineering (2026-07-02, updated 2026-08-09)
+
+## API Endpoints
+
+| Endpoint | Method | Purpose |
+|----------|--------|---------|
+| `https://id.app.clickup.com/user/v1/user` | POST | Register new account |
+| `https://id.app.clickup.com/verification/v1/email?email=...` | GET | Check if email is taken |
+| `https://id.app.clickup.com/login/v1/login` | POST | Login (404 on direct call — browser-only) |
+| `https://app.clickup.com/signup` | GET | Signup page (Angular SPA) |
+| `https://app.clickup.com/settings/apps` | GET | API key generation page |
+
+## Registration Payload
+
+```json
+POST https://id.app.clickup.com/user/v1/user
+{
+    "username": "...",
+    "email": "...",
+    "password": "...",
+    "recaptchaV3Token": "<token>",
+    "timezone": "Europe/Moscow",
+    "signupSource": "web"
+}
+```
+
+## reCAPTCHA Enterprise v3 — Two Sitekeys (2026-08-09 update)
+
+ClickUp использует ДВА разных sitekey:
+
+1. **Signup page** (`app.clickup.com`): `6Lf6D0YoAAAAAEgVBxwLwC_gxFaDBPyYZX19ocU1`
+   - В iframe: `src*="recaptcha/enterprise/anchor?k=6Lf6D0Yo..."`
+   - Доступен через `grecaptcha.enterprise.execute(widgetId)`
+   - Токен с этого sitekey НЕ принимается API `id.app.clickup.com`
+
+2. **Auth domain** (`id.app.clickup.com`): `6LfM4UUoAAAAAPMJ8udCVQ8_oHhRbL4HbCMIIxsb`
+   - Используется для API-запросов
+   - `grecaptcha.enterprise.execute(sitekey, {action:'signup'})` — токен тоже отклонён
+
+### Что FAILED (8 подходов, все возвращают RECAP_001/003)
+
+1. **2captcha `userrecaptcha`** (min_score=0.1-0.9, enterprise=1): token solved but rejected
+2. **ShardX anti-detect browser**: RECAP_003
+3. **Real Chrome GUI**: RECAP_003
+4. **Real Chrome CDP**: RECAP_003
+5. **Patchright**: RECAP_003
+6. **nodriver**: RECAP_003
+7. **Browser-generated token** (grecaptcha.enterprise.execute): RECAP_001
+8. **Token from page's widget** (widgetId=100000 on signup page): RECAP_001
+
+### Root Cause
+
+reCAPTCHA Enterprise v3 is **IP-reputation-gated**. Datacenter IPs auto-rejected regardless of browser fingerprint quality or token validity. The `RECAP_001/003` error is returned by ClickUp's backend after Google's reCAPTCHA verification fails.
+
+### Angular Form Structure
+
+Signup page — Angular SPA (`_ngcontent-ng-c...`, `cu3button`, `cu3-type` attributes). Форма сабмитится через Angular event system, не через нативный `form.submit()`. Прямой `fetch()` к API тоже отклонён.
+
+### Google OAuth — тоже заблокирован
+
+Google OAuth через CDP возвращает `/signin/rejected` с `idnf=<email>` и `epd=<code>`. Google детектит automation даже в real Chrome (CDP-режим).
+
+## Email Check Response
+
+```json
+GET https://id.app.clickup.com/verification/v1/email?email=user@gmail.com
+{
+    "email_taken": false,
+    "domain_is_owned": false,
+    "skipCaptcha": false,
+    "google_sso": false,
+    "policies": []
+}
+```
+
+## API Token Format
+
+- Format: `pk_<digits>_<32 uppercase alnum>`
+- Auth header: `Authorization: pk_...`
+- Never expires
+- Generated at: https://app.clickup.com/settings/apps
+
+## MCP Server
+
+Built at `C:\Users\User\clickup_mcp_server.py` (15 tools, 481 lines). Raw stdio JSON-RPC, zero dependencies. Requires `CLICKUP_API_TOKEN` env var.
+
+## Files Created
+
+- `C:\Users\User\clickup_mcp_server.py` — 15-tool MCP server
+- `C:\Users\User\clickup_autoreg.py` — 2captcha-based API registration
+- `C:\Users\User\clickup_reverse.py` — reverse proxy (20143) for api.clickup.com
+- `C:\Users\User\clickup_nodriver_signup.py` — nodriver-based signup (unfinished)