autoreg-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok60915d52e8425
124
skills/discord-automation/SKILL.md
Normal file
124
skills/discord-automation/SKILL.md
Normal file
@@ -0,0 +1,124 @@
|
||||
---
|
||||
name: discord-automation
|
||||
description: Automate Discord account management — register accounts, join servers, solve captchas, manage tokens, handle rate limits. Covers API and browser approaches with tradeoffs.
|
||||
category: automation
|
||||
trigger: discord, discord token, discord register, discord join, discord captcha, discord server join, discord hcaptcha, discord API
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
Programmatic Discord operations via API (fast but fragile) and browser (slow but more human-like). Covers: token lifecycle, registration, server joining, captcha solving, rate limits.
|
||||
|
||||
## Token Lifecycle
|
||||
|
||||
**User account tokens from automated sources die FAST.** From non-residential IPs (datacenter/VPS), tokens survive 2–3 API requests before returning 401. Discord fingerprints the IP + User-Agent and invalidates sessions that look programmatic.
|
||||
|
||||
- Check token health with GET `/users/@me` — if 401, token is dead, move on
|
||||
- Do NOT waste time debugging dead tokens — just get a fresh one
|
||||
- Prefer batch: all independent reads in one call to maximize utility per token
|
||||
- Joining servers with captcha is the hardest case — requires 3+ requests (join attempt → get captcha → wait for solve → join with captcha), which almost always exceeds token lifetime
|
||||
|
||||
## Registration API
|
||||
|
||||
```
|
||||
POST https://discord.com/api/v9/auth/register
|
||||
Body: {
|
||||
"email": "...",
|
||||
"username": "...",
|
||||
"password": "...",
|
||||
"invite": "nicnames", // optional, joins server after registration
|
||||
"consent": true,
|
||||
"date_of_birth": "1995-04-20",
|
||||
"fingerprint": "<from GET /experiments>"
|
||||
}
|
||||
```
|
||||
|
||||
### Rate Limiting
|
||||
After ~3 registration attempts from the same IP, Discord returns 429 with `retry_after` (~96 seconds). Wait the full duration — sequential 429s stack.
|
||||
|
||||
### Email Already Registered
|
||||
Discord permanently stores email→account mappings. Recycled temp emails (AnyMessage, emailnator, etc.) are virtually guaranteed to return `EMAIL_ALREADY_REGISTERED`. See `anymessage-email-api` skill pitfall #14. **Use a fresh, never-before-used email for Discord registration.**
|
||||
|
||||
## Server Joining
|
||||
|
||||
```
|
||||
POST https://discord.com/api/v9/invites/{code}
|
||||
Headers: Authorization: {token}
|
||||
Body: {} // or {"captcha_key": "...", "captcha_rqtoken": "..."}
|
||||
```
|
||||
|
||||
- 200 = joined
|
||||
- 400 with `captcha_sitekey` = hCaptcha required (see Captcha Solving below)
|
||||
- 401 = token dead
|
||||
- 403 with code 10008 = invite invalid, banned, or membership screening required
|
||||
|
||||
## Captcha Solving
|
||||
|
||||
Discord uses hCaptcha (sitekey: `a9b5fb07-92ff-493f-86fe-352a2803b3df`). Enterprise hCaptcha with `rqdata` payload.
|
||||
|
||||
### AntiCaptcha (✅ confirmed working)
|
||||
```
|
||||
POST https://api.anti-captcha.com/createTask
|
||||
{
|
||||
"clientKey": "{key}",
|
||||
"task": {
|
||||
"type": "HCaptchaTaskProxyless",
|
||||
"websiteURL": "https://discord.com",
|
||||
"websiteKey": "a9b5fb07-92ff-493f-86fe-352a2803b3df",
|
||||
"data": "{rqdata}" // from join response, if present
|
||||
}
|
||||
}
|
||||
```
|
||||
Solve time: ~8–15 seconds. Cost: ~$0.002 per solve.
|
||||
Poll: `POST /getTaskResult` every 2–4 seconds.
|
||||
|
||||
### Capsolver (⚠️ may block Discord tasks)
|
||||
Tested and returned `ERROR_INVALID_TASK_DATA` with "violation of usage policies" for Discord hCaptcha. Not reliable for this target.
|
||||
|
||||
### 2Captcha/TWOCAPTCHA keys
|
||||
User-provided "TWOCAPTCHA" keys did NOT work with standard `api.2captcha.com` or `rucaptcha.com` endpoints (returned `ERROR_KEY_DOES_NOT_EXIST`). The `twocaptcha.com` domain is parked. Verify key validity before relying on it.
|
||||
|
||||
## Browser Approach
|
||||
|
||||
### What works
|
||||
- **Invite page registration form**: `https://discord.com/invite/{code}` loads a simplified registration form (display name + date of birth). Form renders reliably.
|
||||
- **NicNames.com**: Full site works in Browserbase, signup and login functional.
|
||||
|
||||
### What doesn't work well
|
||||
- **Discord SPA** (`/app`, `/login`, `/register`, `/channels/@me`): Frequently shows blank skeleton (1 generic clickable element). Bot detection likely.
|
||||
- **Date pickers** (comboboxes): Discord's React date-of-birth pickers are hard to automate — clicks on options don't always register. Use JS console workarounds.
|
||||
|
||||
### JS Console for Discord forms
|
||||
When browser clicks fail, use `browser_console` to manipulate form state directly:
|
||||
```js
|
||||
// Find inputs
|
||||
document.querySelectorAll('input')
|
||||
// Click buttons by text
|
||||
Array.from(document.querySelectorAll('button')).find(b => b.textContent.includes('Save')).click()
|
||||
```
|
||||
|
||||
## Rate Limits & Backoff
|
||||
|
||||
| Trigger | Response | Cooldown |
|
||||
|---------|----------|----------|
|
||||
| Registration spam | 429 + retry_after | ~96 seconds |
|
||||
| Join attempts | hCaptcha challenge | Solve captcha |
|
||||
| API requests from server IP | Token → 401 | Get fresh token |
|
||||
| Too many requests | 429 global | Check retry_after header |
|
||||
|
||||
## NicNames Promo Flow (Discord-Dependent)
|
||||
|
||||
1. Join Discord server: `discord.gg/nicnames` (guild ID: `964607134136430623`, ~6400 members)
|
||||
2. Complete membership screening (MEMBER_VERIFICATION_GATE_ENABLED)
|
||||
3. Verify with **Captcha.bot** (Discord bot)
|
||||
4. Run `/promos` command
|
||||
5. Receive one-time promo code
|
||||
6. Apply code at NicNames checkout for free/discounted .cyou, .bond, .icu, .sbs, .cfd, .qpon, .buzz domains
|
||||
|
||||
## Pitfalls
|
||||
|
||||
1. **Tokens die in seconds, not minutes** — from non-residential IPs. Plan for 2–3 requests max per token. Don't design workflows that need a token to stay alive for 30+ seconds.
|
||||
2. **Captcha solve time kills tokens** — AntiCaptcha takes 8–15s. By the time captcha is solved, the token is usually dead. Either: (a) use browser-based join (no captcha needed when logged in), (b) pre-solve captcha and use within seconds, or (c) accept that join-via-API is a 2-token operation (first token gets captcha params, second token submits solved captcha).
|
||||
3. **Registration email uniqueness** — Discord NEVER forgets an email. Recycled temp emails are a dead end. Always verify an email is fresh before attempting registration.
|
||||
4. **Browser SPAs are fragile in Browserbase** — Discord's React SPA frequently fails to hydrate. The invite page form is the most reliable entry point.
|
||||
5. **AntiCaptcha is the go-to solver for Discord** — Capsolver blocks Discord tasks, TWOCAPTCHA keys may not work. Test balance with `getBalance` before creating tasks.
|
||||
Reference in New Issue
Block a user