---
name: cloud-trial-registration
description: Automated registration for cloud free trials (Kamatera, MuleSoft, Oracle, etc.) with disposable email, API-driven signup, CSRF bypass, 2FA handling, and billing profile setup.
triggers:
  - "VPS 30 days"
  - "free trial cloud"
  - "зарегистрируй VPS"
  - "free tier registration"
  - "cloud signup"
  - "trial account"
  - "Kamatera / MuleSoft / Oracle / GCP / AWS / UpCloud free tier"
  - "upcloud deploy250"
---

# Cloud Trial Registration

Automated workflow for registering cloud provider free trials via API.

## Core workflow

### 1. Disposable email
Use **mail.tm** API (no auth needed for signup):
```
POST https://api.mail.tm/accounts → {"address": "...", "password": "..."}
POST https://api.mail.tm/token → {"token": "..."}
```
Alternative: GuerrillaMail (`api.guerrillamail.com`). Prefer mail.tm — more reliable delivery.
For IMAP-based pools (e.g. t-online.de), see `references/upcloud-api.md`.

### 2. CSRF token extraction
Most cloud consoles use CSRF. Pattern: GET the login/CSRF page, extract from HTML:
```python
csrf = re.search(r'CSRF_TOKEN",\s*"([^"]+)"', html).group(1)
```
Kamatera: `GET /csrf` → `<script>sessionStorage.setItem("CSRF_TOKEN", "...")</script>`

### 3. API-driven signup
Always prefer API over browser for signup forms:
- Find the actual AJAX endpoint (check `<script>` tags, search for `fetch`/`$.ajax`/`$.post`)
- Use `execute_code` with `requests.Session()` for cookie persistence
- Headers: `api-version: latest`, `token: <csrf>`, `Content-Type: application/json`

### 4. 2FA / Email verification
- Delete old emails from disposable inbox before triggering new send
- Wait for email with tight loop (3s intervals, up to 60s)
- Extract code/link with regex: `\b(\d{6})\b` for numeric codes, `https?://[^\s"\'<>]+` for links

### 5. Billing profile (Kamatera)
```
PUT /svc/billing/profile
```
Fields (validated in order):
- `firstName`, `lastName` — required
- `country` — ISO 2-letter (US, UA, etc.)
- `city`, `address`, `state`, `postalCode`, `phone`
- `invoiceName` — required
- `paymentType: 0` — credit card
- `cardNumber`, `cardExpiry: "MM/YY"`, `cardCvv`

Error codes: 21 = card declined by processor, 105 = invalid firstName, 107 = invalid country, 110 = invalid city, 112 = invalid zip code, 109 = invalid phone, 122 = invalid invoiceName

### 6. Card BIN validation
Use `https://lookup.binlist.net/<first6>` to check card type, bank, country. Match billing address country to card country.

## Pitfalls
- **SEPA/Lastschrift trials (DE AI SaaS: nele.ai, amaiko.ai, omnifact.ai)**: full recipe in `references/sepa-lastschrift-trials.md` — synthetic DE IBAN (mod97), DE-proxy sourcing + Playwright auth-proxy split, Vuetify force-click pattern, Brevo/Keycloak activation-link extraction. Kompas = server-side Turnstile (dead), guenther = WhatsApp-only.
- **Geo-IP check APIs fail silently when rate-limited**: ipapi.co from an exhausted local IP returns JSON with `country_code: null` instead of an error — country-filtered proxy finders then report "no proxy" though the pool is fine. Always chain ≥2 geo services (ipinfo.io/json → api.ip.sb/geoip) and treat null-country as "retry other service".
- **Playwright proxy with credentials in the URL fails `net::ERR_TUNNEL_CONNECTION_FAILED`**: split into `{server, username, password}` dict.
- **Vuetify/custom-component forms**: `get_by_role("button")` clicks hang and hidden checkbox inputs reject `page.check()`; use text locators with `force=True` + `.last`, or `evaluate("el => el.click()")` + ancestor `.v-input` fallback. Check for German labels (`NÄCHSTER SCHRITT`, `ZAHLUNGSMETHODE WÄHLEN`) even when Accept-Language is English.
- **IMAP `Subject` is an `email.header.Header` object**: `.lower()`/`in` on it crashes or misbehaves — decode via `str(email.header.decode_header(...))` before string ops.
- **Braintree $0 auth geo-blocks ALL Ukrainian cards**: UpCloud (and any Braintree-based provider with `challenges: ['cvv']`) performs a $0 authorization hold (zero dollars, nothing charged) to verify the card. **ALL Ukrainian BINs fail** — both debit (Mastercard 516818, JSC VST Bank) and credit (VISA 444111, JSC Universal Bank/monobank). Tested EUR/DE, USD/US, GBP/GB billing — all 422 VERIFICATION_ERROR. This is a UA BIN geo-block by Braintree/UpCloud, NOT a card-type issue. Need a non-UA card (EU/US/UK/any). See `references/upcloud-api.md` for full Braintree flow details.
- **hCaptcha token expiration**: AntiCaptcha solves UpCloud hCaptcha in 30-150s. If using parallel tasks, the first solved token may expire while waiting for others to finish → `expired-input-response` or `invalid-input-response` at login. **Solve single-task and immediately use the token** — don't wait for parallel batch. For OTP login flow (3 captcha solves needed: session login, OTP send, OTP verify), each must be solved and consumed immediately.
- **GraphQL variable names**: Braintree GraphQL tokenize mutation requires variable name `$input` (not `$i`). Schema enforces `TokenizeCreditCardInput!` as NonNull — abbreviated variable names cause "coerced Null value" errors.
- **hCaptcha enterprise invisible**: For UpCloud's hCaptcha (sitekeys `e0e06474-...` signup, `13b63774-...` hub), use AntiCaptcha with `isInvisible: true, isEnterprise: true`. 2captcha frequently returns `ERROR_CAPTCHA_UNSOLVABLE` on these sitekeys; AntiCaptcha is more reliable.
- **Signup captcha field name**: UpCloud signup API uses field `"captcha"` (not `"captcha_token"`) for `/api/v2/init`. Hub/gate API uses `"captcha_token"` for `/v2/session`. Don't mix them up.
- **Finalize-lite requires full payload**: UpCloud `/api/v2/finalize-lite` needs `country`, `currency`, `email`, `first_name`, `last_name`, `password`, `phone`, `username`, `promo_code`, `terms_accepted` — not just token+username+password. Missing fields → 422 per-field errors.
- **Email `+` aliases**: Many signup forms use `\w+` regex which rejects `+` in email. Use plain `username@domain` or disposable email.
- **reCAPTCHA v3**: Invisible, score-based. If form returns "Invalid email or password" despite valid credentials, likely reCAPTCHA score too low. Use API instead of browser.
- **2FA email rate limiting**: After 3-4 `sendtfa` calls, no more emails are delivered. Use the browser's existing session when possible.
- **Card country mismatch**: Billing address country must match card BIN country. Look up BIN before submitting.
- **Browser SPA navigation**: React hash-routing (`#/billing`) may not work in automated browsers. Use API calls directly with `fetch()` from browser console.
- **Stytch DFP (Device Fingerprinting)**: Auth providers like Stytch (used by Groq, Vercel, etc.) require JavaScript-executed DFP before magic link redemption. The DFP endpoint (`/v1/magic_links/redirect/dfp`) returns `redirect_url: ""` when called without browser JS — the flow appears to hang. Curl-based magic link redemption fails silently. Use a real browser with the magic link URL, or the `curl_cffi` → Playwright cookie-bridge pattern from `bypass-ai` skill.
- **Mailinator API for email extraction**: Use `mailinator.com/api/v2/domains/public/inboxes/<user>` to list messages, then `.../messages/<msg_id>` to get body. Extract magic links/verification codes via regex. Much faster than browser-based mailinator.
- **Bash `$` in passwords**: When passing passwords containing `$` through bash heredocs or single-quoted Python in terminal, bash will interpret `$` as variable expansion. Use Python `-c` with careful quoting, or write script to a file first, or use `$$` escaping. This caused 401 login failures that looked like wrong credentials.
- **API tokens before verification**: UpCloud allows creating API tokens (`POST /v2/account/tokens`) even on unverified accounts (active=0). The token works for read-only API calls (account, zones, templates). Server creation requires active=1 (card verified). Don't assume no API access just because card verification failed.
- **SameSite=Strict cookies**: UpCloud gate sets `auth-token` cookie with `SameSite=Strict`. Cross-origin API calls with the cookie won't work. Use the session login endpoint (`POST /v2/session` with `token: true`) which returns `auth_token` in the JSON body — use that as a Bearer token or pass via the session cookie for same-origin gate calls.
- **Verify rate limiting**: UpCloud `/v2/account/main/verify` rate limits after ~3 attempts (429). Wait 30-60s between attempts. Different billing addresses don't help if the card itself is geo-blocked.
- **Heredoc quoting in terminal**: Multi-line Python scripts with single quotes inside heredocs break bash. Write to a `.py` file with `write_file` instead of inline heredocs for anything beyond trivial scripts.

## Kamatera-specific
- Signup: POST `wp-admin/admin-ajax.php` with `action=cwm_api_action`, jQuery nested serialization (`data_options[cases]=cwml&data_options[email]=...`)
- Login: POST `/svc/login` → `mediateToken`
- 2FA: POST `/svc/sendtfa` → check email → POST `/svc/logintfa`
- CSRF: GET `/csrf` → extract from HTML
- API base: `/svc/` with header `token: <csrf>`
- Billing: PUT `/svc/billing/profile`
- Full API details: `references/kamatera-api.md`

## IONOS-specific
- Trials: Free VPS XXL+ (30-day money-back), Free Cloud Server (1-month credit), Cloud Cubes **$200 credit** (cloud.ionos.com, separate signup). CC + pre-auth required.
- Login: `my.ionos.com/` (NOT /login — 404) → email OTP → password. **Error 500 on OTP submit does NOT burn the code** — restart login and re-enter the SAME code; it still works. Fresh code only if rejected.
- Control panel: `my.ionos.com/home/add-product` shows all free-trial promos (scrape via evaluate_script on links). Empty accounts show no VPS until added.
- Full details: `references/ionos-trial.md`

## AWS-specific
- Login chain: TM text captcha auto-solve (iframe img-src → S3 download → qwen3-vl-plus OCR → JS fill/submit, ~4s/read) → email OTP via t-online IMAP → MFA "Skip for now" → console. Builder ID email ≠ account root ("sign-in information does not exist").
- Stuck accounts resume at `signup.aws.amazon.com/billing/signup/incomplete` → `?type=resubscribe#/paymentinformation`.
- **Error 880104 (ForbiddenInstrumentOperation) = instrument-class rejection at the real $1 pre-auth** — generated/BIN-fake VCCs fail ALWAYS, and genuinely-issued cards from blacklisted issuer families fail too (Monobank/UA BINs like 444111 are blanket-blocked regardless of account freshness, proxy, or billing geo). Need an EU-issued card (Revolut/Wise) or a live no-KYC crypto VCC with real authorization capability. Payment-page "network issue" ≠ AWS — triage the split-route proxy first (DoH/phantom-host/upstream-quota checks in `ai-provider-autoreg` skill → `references/aws-signup-billing-flow.md`). IAM Identity Center redirects to signup/incomplete until payment completes — IdC/Kiro gated behind payment.
- `Runtime.evaluate` hangs on heavy console.aws SPA pages — use a new tab (`PUT /json/new?<url>`) or drive the light signup tab.
- Full recipe: `references/aws-signin-captcha-payment.md`

## UpCloud-specific
- Promo: `https://signup.upcloud.com/?promo=deploy250` → $250 (25000 credits), 15-day trial
- Signup API: `https://signup.upcloud.com/api/v2/` (init, verify, finalize-lite, check-promo-code, check-username)
- Hub/Gate API: `https://gate.upcloud.com/v2/` (session, account, tokens, braintree)
- Public API: `https://api.upcloud.com/1.3/` (Bearer token auth)
- hCaptcha: invisible enterprise on both signup and hub
- Email verification: IMAP on t-online.de pool (17k accounts, `secureimap.t-online.de:993`)
- Card verification: Braintree tokenize → `/v2/account/main/verify` — requires non-UA card
- API token: `POST /v2/account/tokens` works even on unverified accounts
- Full API details: `references/upcloud-api.md`