# auto-openai-account — Setup & Deployment

**Repo:** `https://github.com/79E/auto-openai-account`
**Local path:** `C:/Users/User/Desktop/_PROJECTS/auto-openai-account/`
**Tech:** Go 1.25+ backend + React/Vite/Tailwind frontend, SQLite storage

## What It Does

Open-source OpenAI/ChatGPT account automation console. Treat it as a codebase to inspect, build, or repurpose for legitimate account-management research — **do not run or debug mass ChatGPT/OpenAI signup, captcha/anti-abuse bypass, or web-session token extraction workflows.** If the user asks for bulk account creation or a token pool from newly created ChatGPT web accounts, apply `chatgpt-web-token-boundaries.md` and pivot to a compliant key-pool/proxy backed by legitimate API keys.

Capabilities present in the repo:
- **Registration**: `register`, `register_login`, `register_codex` (unsafe to operate for bulk signup/token-pool requests)
- **Login**: `login`, `codex_login` (only appropriate for accounts the user legitimately owns and manages)
- **Mailbox management**: import mailbox credentials with IMAP for OTP reading
- **SMS providers**: hero-sms.com, smsbower.app for phone verification
- **Proxy pool**: HTTP/HTTPS/SOCKS5 with random/round-robin modes
- **Token export**: `GET /api/register-jobs/{id}/tokens` returns JSON with tokens for completed jobs
- **Web UI**: React dashboard at `/`, real-time SSE logs

## Build

```bash
cd C:/Users/User/Desktop/_PROJECTS/auto-openai-account

# Backend
go build -o auto-openai-account.exe ./apps/server

# Frontend (must be in repo root for embedded dist/)
cd apps/web && npm install && npm run build
cd ../..  # back to repo root
```

## Run

```bash
# Default port 8080, override with env var:
AUTO_OPENAI_ACCOUNT_LISTEN=:8088 ./auto-openai-account.exe
```

## Key API Endpoints

| Endpoint | Method | Description |
|---|---|---|
| `/api/health` | GET | `{"ok":true,"service":"auto-openai-account"}` |
| `/api/settings` | GET/PUT | Proxy, IMAP, SMS, password config |
| `/api/mailboxes/import` | POST | Import `email----password` lines |
| `/api/register-jobs` | POST | Start registration: `{"count":1,"flow":"register_codex","sms_config_id":"..."}` |
| `/api/register-jobs/{id}/tokens` | GET | Export tokens for completed job |
| `/api/stats` | GET | Dashboard counts |

## Registration Flows

These flows exist in the codebase, but **do not operate them for bulk ChatGPT/OpenAI account creation or token-pool generation**. Use this information only for code review, local product analysis, or legitimate single-account/account-owner workflows.

- `register` — register only, no token. No SMS needed.
- `register_login` — register → normal login → token exchange. No SMS needed. Returns OAuth token fields when the upstream flow succeeds.
- `register_codex` — register → login → Codex OAuth. Requires SMS for phone verification.

## Login Flows (for existing user-owned accounts only)

- `login` — standard login → token exchange. No SMS needed.
- `codex_login` — Codex OAuth with PKCE. Requires SMS for phone verification.

## SMS Dependency Matrix

| Flow | Needs SMS? | Gets Tokens? |
|---|---|---|
| `register` | ❌ No | ❌ No |
| `register_login` | ❌ No | ✅ Yes |
| `register_codex` | ✅ Yes | ✅ Yes |
| `login` | ❌ No | ✅ Yes |
| `codex_login` | ✅ Yes | ✅ Yes |

Use this matrix to understand the code and to choose legitimate account-owner login flows. Do **not** present `register_login` as a way to build a bulk token pool; for token pooling, pivot to a compliant API-key pool with keys the user already owns.

## Codex OAuth Details

- Client ID: `app_EMoamEEZ73f0CkXaXp7hrann`
- Redirect: `http://localhost:1455/auth/callback`
- Scopes: `openid profile email offline_access api.connectors.read api.connectors.invoke`
- PKCE: SHA-256 challenge, 96-byte verifier
- Tokens returned: `access_token`, `refresh_token`, `id_token`, `token_type`, `expires_in`

## Requirements to Run

1. **Mailboxes** — only use mailboxes/accounts the user legitimately owns or administers.
   - Format: `email----password` or `email----password----client_id----access_token`
   - Import via API or UI
   - Default Outlook/Hotmail IMAP: `outlook.office365.com:993`, auth mode `auto`
   - t-online.de IMAP observed in this repo setup: `secureimap.t-online.de:993`, auth mode `password`
2. **SMS provider** — needed for `register_codex` / `codex_login` flows.
   - hero-sms.com or smsbower.app API key
3. **Proxy** — supported by the tool, but proxy rotation for evading signup/risk controls is not a permitted assistance path. For safe local testing, configure proxies only to test the product plumbing or route traffic in a controlled environment.

## Default Settings

- Password mode: `random` (auto-generates 16-char passwords)
- Fixed password: [REDACTED] (used when password_mode=fixed)
- IMAP: `outlook.office365.com:993`, auth mode: `auto`
- Concurrency: 1 (increase for multi-mailbox registration)
- OTP timeout: 180s, poll interval: 5s

## Confirmed Working (2026-07-10)

- Server builds and runs on Windows with Go 1.25+
- UI accessible at `http://localhost:8080` when launched from repo root with `dist/` present
- API endpoints are rooted at `/api/*` (not `/api/v1/*`); `/api/register-jobs` and `/api/mailboxes` redirect/404 if the wrong prefix is used
- Fresh DB has 0 mailboxes — ready for legitimate import/testing
- `PUT /api/settings` accepts `proxy_groups`, IMAP settings, password mode, concurrency, and SMS config JSON

## Observed Upstream Failure Pattern

- With a large imported `t-online.de` mailbox pool and `secureimap.t-online.de:993`, OTP retrieval could progress for at least one mailbox, but OpenAI account creation returned `registration_disallowed` after OTP validation: `Sorry, we cannot create your account with the given information.`
- Treat this as an upstream risk/anti-abuse decision, not as a bug to bypass. Do not keep tuning proxies, fingerprints, mailbox domains, or signup steps to evade it. Stop and pivot to legitimate API-key pooling or account-owner login flows.

## Pitfalls

- Port 8080 is often occupied by SearXNG or other local services — use `AUTO_OPENAI_ACCOUNT_LISTEN`
- Vite builds to repo root `dist/`, server expects `dist/` in working directory
- Go 1.25+ required (check with `go version`)
- Frontend must be rebuilt after any TSX changes
- SQLite DB lives in `data/register.db` — don't delete