# V2EX Account Validation Reference

## API Endpoints

### Username Existence (public, no auth)
```
GET https://www.v2ex.com/api/members/show.json?username={username}
```

**Response (exists):**
```json
{
  "id": 1,
  "username": "Livid",
  "url": "https://www.v2ex.com/u/Livid",
  "website": "...",
  "twitter": "",
  "github": "",
  "avatar_mini": "https://cdn.v2ex.com/avatar/...",
  "avatar_normal": "...",
  "avatar_large": "...",
  "created": 1272200000,
  "last_modified": 1782797864,
  "pro": false,
  "status": "found"
}
```

**Response (not found):**
```json
{"status": "error", "message": "Object Not Found"}
```
HTTP 404.

**Response (rate limited):**
```json
{"status": "error", "message": "Rate Limit Exceeded", "rate_limit": {"used": 600, "quota": 600, "reset_at": 1782957764}}
```
HTTP 403.

### Rate Limit Headers
- `X-Rate-Limit-Limit`: 600 (quota per hour)
- `X-Rate-Limit-Remaining`: remaining requests
- `X-Rate-Limit-Reset`: Unix timestamp of reset
- Rate limit is per-IP, resets on the hour

### Site Info
```
GET https://www.v2ex.com/api/site/info.json
```
Returns: `{"title": "V2EX", "slogan": "way to explore", "domain": "www.v2ex.com"}`

## Login Form Mechanics

### Form Structure
V2EX login at `/signin` uses randomized SHA256 field names. Must be parsed fresh from each page load:

```html
<form method="post" action="/signin">
  <input type="text" name="<sha256_hash_1>" placeholder="Username or Email" />
  <input type="password" name="<sha256_hash_2>" />
  <input type="text" name="<sha256_hash_3>" placeholder="Enter the code above, click to change" />
  <input type="hidden" name="once" value="<numeric_token>" />
  <input type="hidden" name="next" value="/" />
</form>
```

### CAPTCHA
- Image: `GET /_captcha` (returns PNG)
- Simple text CAPTCHA, not reCAPTCHA
- Solvable via Tesseract OCR or 2captcha API

### Login POST
```
POST /signin
Content-Type: application/x-www-form-urlencoded

<hash_1>=username&<hash_2>=password&<hash_3>=captcha_text&once=<token>&next=/
```

### Rate Limiting on Signin
- IP blocked for ~24 hours after ~10-15 failed signin attempts
- Message: "Because too many sign in attempts have been made from this IP in a short period of time, further attempts are temporarily not allowed."
- Blocked IP shown on page

## API v2 (Beta)
- Requires Personal Access Token: [REDACTED] Bearer <token>`
- No login/auth endpoint — only data access endpoints
- Rate limit: 600 req/hr per IP
- Base URL: `https://www.v2ex.com/api/v2/`

## Proxy Requirements
- V2EX blocks many datacenter IPs
- Residential/high-quality SOCKS5 proxies recommended
- Test proxy by GETting `/signin` — 403 or "Restricted" = blocked IP
- Working proxy: returns 200 with form HTML