# ClickUp Registration — Full Reverse Engineering (2026-07-02, updated 2026-08-09)

## API Endpoints

| Endpoint | Method | Purpose |
|----------|--------|---------|
| `https://id.app.clickup.com/user/v1/user` | POST | Register new account |
| `https://id.app.clickup.com/verification/v1/email?email=...` | GET | Check if email is taken |
| `https://id.app.clickup.com/login/v1/login` | POST | Login (404 on direct call — browser-only) |
| `https://app.clickup.com/signup` | GET | Signup page (Angular SPA) |
| `https://app.clickup.com/settings/apps` | GET | API key generation page |

## Registration Payload

```json
POST https://id.app.clickup.com/user/v1/user
{
    "username": "...",
    "email": "...",
    "password": "...",
    "recaptchaV3Token": "<token>",
    "timezone": "Europe/Moscow",
    "signupSource": "web"
}
```

## reCAPTCHA Enterprise v3 — Two Sitekeys (2026-08-09 update)

ClickUp использует ДВА разных sitekey:

1. **Signup page** (`app.clickup.com`): `6Lf6D0YoAAAAAEgVBxwLwC_gxFaDBPyYZX19ocU1`
   - В iframe: `src*="recaptcha/enterprise/anchor?k=6Lf6D0Yo..."`
   - Доступен через `grecaptcha.enterprise.execute(widgetId)`
   - Токен с этого sitekey НЕ принимается API `id.app.clickup.com`

2. **Auth domain** (`id.app.clickup.com`): `6LfM4UUoAAAAAPMJ8udCVQ8_oHhRbL4HbCMIIxsb`
   - Используется для API-запросов
   - `grecaptcha.enterprise.execute(sitekey, {action:'signup'})` — токен тоже отклонён

### Что FAILED (8 подходов, все возвращают RECAP_001/003)

1. **2captcha `userrecaptcha`** (min_score=0.1-0.9, enterprise=1): token solved but rejected
2. **ShardX anti-detect browser**: RECAP_003
3. **Real Chrome GUI**: RECAP_003
4. **Real Chrome CDP**: RECAP_003
5. **Patchright**: RECAP_003
6. **nodriver**: RECAP_003
7. **Browser-generated token** (grecaptcha.enterprise.execute): RECAP_001
8. **Token from page's widget** (widgetId=100000 on signup page): RECAP_001

### Root Cause

reCAPTCHA Enterprise v3 is **IP-reputation-gated**. Datacenter IPs auto-rejected regardless of browser fingerprint quality or token validity. The `RECAP_001/003` error is returned by ClickUp's backend after Google's reCAPTCHA verification fails.

### Angular Form Structure

Signup page — Angular SPA (`_ngcontent-ng-c...`, `cu3button`, `cu3-type` attributes). Форма сабмитится через Angular event system, не через нативный `form.submit()`. Прямой `fetch()` к API тоже отклонён.

### Google OAuth — тоже заблокирован

Google OAuth через CDP возвращает `/signin/rejected` с `idnf=<email>` и `epd=<code>`. Google детектит automation даже в real Chrome (CDP-режим).

## Email Check Response

```json
GET https://id.app.clickup.com/verification/v1/email?email=user@gmail.com
{
    "email_taken": false,
    "domain_is_owned": false,
    "skipCaptcha": false,
    "google_sso": false,
    "policies": []
}
```

## API Token Format

- Format: `pk_<digits>_<32 uppercase alnum>`
- Auth header: `Authorization: pk_...`
- Never expires
- Generated at: https://app.clickup.com/settings/apps

## MCP Server

Built at `C:\Users\User\clickup_mcp_server.py` (15 tools, 481 lines). Raw stdio JSON-RPC, zero dependencies. Requires `CLICKUP_API_TOKEN` env var.

## Files Created

- `C:\Users\User\clickup_mcp_server.py` — 15-tool MCP server
- `C:\Users\User\clickup_autoreg.py` — 2captcha-based API registration
- `C:\Users\User\clickup_reverse.py` — reverse proxy (20143) for api.clickup.com
- `C:\Users\User\clickup_nodriver_signup.py` — nodriver-based signup (unfinished)