# ChatGPT t-online.de Registration Pattern (2026-07-09)

## Working Flow

1. **Playwright opens chatgpt.com/signup** with real Chrome profile (CF cookies already present)
2. **`page.route("**/auth.openai.com/**", handler)`** intercepts all XHR to auth.openai.com
3. **Handler skips GET** (page navigations), proxies POST/PUT/PATCH through `curl_cffi(impersonate="chrome124")`
4. **Fill email** (t-online.de address), click submit
5. **IMAP poll** (`secureimap.t-online.de:993`) for OTP from last 10 minutes
6. **Fill OTP**, verify via proxied API call
7. **.de domains skip about-you** — response directly contains `continue_url` callback
8. **If about-you appears**: fill form via JS, click submit via Playwright `btn.click()` (NOT evaluate)
9. **Route handler captures callback URL** from `create_account` response
10. **Navigate to callback URL** → session established
11. **GET `chatgpt.com/api/auth/session`** → extract `accessToken`

## Key Details

- **IMAP**: `secureimap.t-online.de:993`, login with full email + password
- **Date filter**: Only accept emails < 600 seconds old (10 min window)
- **Code extraction**: Last 6-digit code from body, check for "openai" OR "chatgpt" in body
- **Button click**: `await btn.click()` (Playwright native), NOT `page.evaluate("btn.click()")`
- **Callback capture**: Global variable set by route handler, consumed by main flow
- **Session endpoint**: `https://chatgpt.com/api/auth/session` returns `{"accessToken": "eyJ..."}`
- **Token format**: JWT, lives 1-30 days, ~40-80 requests/3h per account for GPT-4o

## Pitfalls

- **Gmail aliases get rate-limited**: After ~20-30 registrations, OpenAI stops sending OTP to `user+alias@gmail.com`. Switch to t-online.de.
- **Wrong code from old emails**: IMAP returns all emails to the address. Date filter is mandatory.
- **`create_account` returns 400 `user_already_exists`**: Account already fully created. Try login flow instead.
- **Cloudflare on API endpoints**: XHR/fetch calls from browser get 403. Must proxy through `curl_cffi`.
- **`page.route()` intercepts navigations**: Always skip GET requests, only handle POST/PUT/PATCH.
- **CSS color codes in HTML emails match `\b(\d{6})\b` regex**: OpenAI verification emails are HTML-only. The body contains CSS hex colors like `#202123` and `#353740` which are 6-digit numbers. The regex `\b(\d{6})\b` matches both the OTP code AND CSS colors. **Fix**: strip HTML tags (`re.sub(r'<[^>]+>', ' ', body)`) AND strip CSS hex colors (`re.sub(r'#[0-9a-fA-F]{6}', ' ', body)`) before extracting codes. Without this, the first extracted code is a CSS color, not the OTP.
- **IMAP `SEARCH` requires `SELECT` first**: Calling `mail.search()` immediately after `mail.login()` without `mail.select("INBOX")` returns `command SEARCH illegal in state AUTH`. Always call `mail.select("INBOX")` before any search/fetch operations.
- **Scanning all messages on empty `before_ids`**: When `get_current_ids` returns empty (first run, error), `wait_for_code` iterates through ALL messages in the inbox. For accounts with 1000+ emails, this takes 3+ minutes and never finds the code. **Fix**: limit to last 50 messages: `sorted(new_ids, key=int, reverse=True)[:50]`.
- **`\b` in regex becomes backspace (0x08) in Python source files**: When writing regex patterns to Python files programmatically, `\b` in a regular string is interpreted as backspace (ASCII 0x08). The resulting file has `r'\x08(\d{6})\x08'` instead of `r'\b(\d{6})\b'`. **Fix**: use raw strings (`r'\b'`) in the source code, or use `bytes([0x5c, 0x62])` to write the literal `\b` bytes. Verify with `repr()` — `\b` should show as `\\b`, not `\x08`.
- **Protocol registration skips about-you for .de domains**: t-online.de emails skip the about-you form entirely. The OTP verification response directly contains `continue_url` callback. This makes .de domains ~2x faster than Gmail for registration.

- **`code=` redirect detection via page TITLE (2026-07-30)**: After OTP submission, OpenAI sometimes redirects via meta-refresh or JS navigation where the page TITLE changes to the target URL (e.g., `"Loading https://chatgpt.com/api/auth/callback/openai?code=ac..."`) while the browser URL STAYS on `email-verification`. The title check must include:
  ```python
  ("code=" in page_title and "chatgpt.com" in page_title)
  ```
  Without this, the code thinks the page didn't change, tries clicking "Continue", and fails with "验证码页未找到 Continue 按钮". The `code=` token in the title means OTP was ACCEPTED and the redirect is happening — no button click needed.

## Email Sources

- `C:\Users\User\Desktop\Downloads_backup_01.07.2026\working_mails_RECOVERED.txt` — 9767 t-online.de accounts
- `C:\Users\User\Desktop\EzSolver\pateway_accounts_v9.txt` — 6 t-online.de accounts (may need IMAP enabled)
- Format: `[REDACTED-EMAIL]:[REDACTED], one per line