# baaaai.com Registration Notes (2026-07-27)

## Site Info
- **URL:** https://baaaai.com
- **Type:** AI API Gateway (subscription-based)
- **Balance:** $50-$80 new-user bonus on application
- **Language:** Chinese (zh-CN)

## Protection
- **Cloudflare Turnstile** on registration form
- Same fingerprint-check pattern as g0i.ai — API-only registration IMPOSSIBLE
- Must use real browser (Playwright with Chrome)

## Sitekey
- `0x4AAAAAAD38oqy2OVfVxy_y`
- Extracted from JS bundle (not from `/settings/public` — CF blocks that endpoint)

## Registration Form
- **Page:** `/register`
- **Fields:** `#email`, `#password`
- **Turnstile widget:** `[data-testid="registration-turnstile"]` → hidden input `#cf-chl-widget-*_response`
- **Agreement checkbox:** `#login-agreement-consent`
- **Submit:** `button[type="submit"]`
- **All fields DISABLED until Turnstile solves** — enablement is the signal

## Registration API
- **Endpoint:** `POST /auth/register`
- **Body:** `{"email": "...", "password": "...", "cf-turnstile-response": "..."}`
- **Content-Type:** application/json
- **Success:** redirect to dashboard, `auth_token` in localStorage
- **May require email verification** — check for redirect to `/verify`

## Post-Registration
- **API Keys:** `/keys` — create via button, extract from page (`/sk-[a-f0-9]{40,}/i`)
- **Balance application:** `POST /user/balance-applications` with `{amount: 50, reason: "..."}` + Bearer auth

## Sandbox Limitations
1. Sandbox IP blocked by Cloudflare: all API calls return HTML challenge page (826KB), not JSON
2. curl_cffi with any impersonation target (chrome124/120/110, safari17_0) returns same HTML
3. Browserbase: page loads initially (form in DOM) but Turnstile doesn't auto-solve
4. After page reload, browserbase DOM becomes empty — CF escalates blocking
5. Even `fetch()` from browser console returns HTML instead of API JSON

## Working Approach
- **Playwright on local machine**
- `launch(channel="chrome", headless=False)` with `--disable-blink-features=AutomationControlled`
- Turnstile auto-solves on fresh context (1-5 seconds)
- Script: `C:\Users\User\Desktop\baaaai_playwright_reg.py`
- Also: `C:\Users\User\Desktop\baaaai_autoreg.py` (alternative)
- Also: `C:\Users\User\Desktop\baaaai_api_reg.py` (API-only, blocked)

## Email Source
- t-online.de pool: 17,895 email:pass pairs
- File: `Downloads\Telegram Desktop\working_mails.txt`
- Format: `email:password` (one per line)

## 2captcha Status
- ALL KEYS DEAD (2026-07-27): all 6 keys have zero or negative balance
- Must use browser-based Turnstile auto-solve (no captcha service needed with fresh Chrome profile)

## Verification
- Successful registration: redirect to dashboard, `auth_token` in localStorage
- API key creation: key appears on `/keys` page after creation
- Balance application: API returns 200 with application details