# Blackbox.ai Registration & API

## Registration Flow

Blackbox.ai (`app.blackbox.ai`) — multi-agent orchestration platform with 48+ AI models, paid API access.

### Signup Mechanism

- Signup page: `https://app.blackbox.ai/signup`
- **NO CAPTCHA** on the signup form — just email + password
- **Next.js server action**: The form submits via `POST /signup` with `multipart/form-data` and `text/x-component` accept header
- Response: `{"type":"success","resultCode":"USER_CREATED"}` (RSC format)
- **NO browser needed** for the POST itself, but the `next-action` header is dynamically generated from the page — cannot be hardcoded for HTTP-only signup

### HTTP Signup Attempt (Partial)

The signup endpoint is `POST https://app.blackbox.ai/signup` with body:
```
------WebKitFormBoundary...
Content-Disposition: form-data; name="1_email"

email@domain.com
------WebKitFormBoundary...
Content-Disposition: form-data; name="1_password"

password
------WebKitFormBoundary...
Content-Disposition: form-data; name="0"

["$undefined","$K1"]
------WebKitFormBoundary...--
```

Required headers:
- `Content-Type: multipart/form-data; boundary=...`
- `next-action: <40-char hex from page>` — **dynamically generated, not in initial HTML**
- `Accept: text/x-component`
- `Origin: https://app.blackbox.ai`

Without a valid `next-action` header, the server returns a generic 400 error. The action ID is client-side generated and changes per session.

### Email Verification (BLOCKER)

- After signup, sent to "Verify your email" page (6-digit code)
- **t-online.de emails DO NOT receive verification emails from Blackbox** — tested with multiple accounts (asmoky, kevinfischer05, daniel.brueck, eric.foeller)
- **Gmail also does not receive** — tested with `[REDACTED-NAME]+bb1@gmail.com` (no email found in inbox)
- Email may be delayed or filtered by domain. Alternative email providers (Outlook, ProtonMail) untested.
- Login returns 500 Internal Server Error when account is unverified — verification is a hard requirement

### Google OAuth (BLOCKED)

- Google sign-in button on login/signup pages
- **Google blocks OAuth for Blackbox via CDP**: navigates to `accounts.google.com/v3/signin/rejected` with "browser or app may be unsafe"
- This happens even in the user's real Chrome via CDP (not just headless)
- Google client_id: `985058387028-iaa60lr5e586kvhjp085qcojv3jv2p7h.apps.googleusercontent.com`

## API Access

### Endpoint

- API base: `https://enterprise.blackbox.ai/chat/completions`
- OpenAI-compatible format
- Paid tier only — requires verified account with billing

### Models (48+)

Documented at `https://www.blackbox.ai/models`. Notable models:
- `z-ai/glm-5.2` ($1.40/$4.40 per MTok)
- `deepseek/deepseek-v4-pro` ($0.44/$0.87)
- `anthropic/claude-opus-4.8` ($5/$25)
- `openai/gpt-5.5` ($5/$30)
- `moonshotai/kimi-k2.7-code` ($0.74/$3.50)
- `nvidia/nemotron-3-ultra` ($0.32/$0.80)
- `google/gemini-3.5-flash` ($1.50/$9)
- `x-ai/grok-4.3` ($1.25/$2.50)
- `anthropic/claude-sonnet-5` ($3/$15)
- `anthropic/claude-opus-5` ($15/$75)

## Integration Strategy

### Working Approach

1. Use CDP Chrome to fill signup form (no CAPTCHA — works)
2. Account is created immediately (`USER_CREATED`)
3. Verification email — **unsolved for t-online.de and Gmail**
4. Alternative: use a different email provider that Blackbox accepts

### CDP Signup Pattern (Working)

```python
# Navigate to signup
page.goto("https://app.blackbox.ai/signup")

# Fill form
page.fill('input[type="email"]', email)
page.fill('input[type="password"]', password)

# Click CREATE ACCOUNT
page.click('button:has-text("CREATE ACCOUNT")')

# Wait for verify page
page.wait_for_selector('text=Verify your email')
```

### Pitfalls

- **No API-only signup**: The `next-action` header is session-bound and dynamically generated — HTTP-only signup is not feasible
- **Email domain blocking**: Blackbox appears to filter/block t-online.de and Gmail alias addresses for verification emails
- **Google OAuth blocking**: Google considers Blackbox's OAuth integration "unsafe" and blocks sign-in via CDP
- **Verification is hard requirement**: Unverified accounts cannot login (500 error on `/api/auth/callback/credentials`)
- **CSRF token**: Available at `/api/auth/csrf` but login requires verification first