# Pateway dual-captcha registration pattern (2026-07)

Use this when a site looks like a normal email-code registration flow but solver tokens keep failing even though Turnstile itself solves successfully.

## Discovery

Pateway (`pateway.ai`) uses **two different captcha systems in the same registration flow**:

1. **Send verification code** → **Aliyun captcha** (not Cloudflare Turnstile)
2. **Final register** → **Cloudflare Turnstile**

This means solving Turnstile and replaying that token into the send-code endpoint will always fail, even if the token is valid.

## Frontend evidence

JS bundle inspection showed:

- API base: `https://web.pateway.ai/api/v1`
- `send-code` flow calls `vn()` before the request
- `register` flow calls `Cn()` before the request

### Aliyun captcha config used by `send-code`
- SDK: `https://o.alicdn.com/captcha-frontend/aliyunCaptcha/AliyunCaptcha.js`
- `SceneId: 81tr55b5j`
- `region: sgp`
- `prefix: 1g3gnn6`

### Turnstile config used by `register`
- Sitekey: `0x4AAAAAADwVkCCX5O7Ewbe3`
- Mode: `execution: 'execute'`, `appearance: 'interaction-only'`

## Exact request shape discovered

The web client converts camelCase request fields to snake_case before sending.

### `send-code` request body
```json
{
  "email": "user@example.com",
  "scene": "register",
  "captcha_verify_param": "<aliyun-captcha-payload>"
}
```

### `register` request body
```json
{
  "email": "user@example.com",
  "password": "...",
  "code": "123456",
  "invite_code": "optional",
  "source": {"url": "https://pateway.ai/#/"},
  "verify_token": "<turnstile-token>"
}
```

## Server response meanings

- `40001 请求体格式错误` = wrong body shape / wrong field names
- `450055 人机验证失败，请重试` = body format is now accepted, but captcha payload is wrong or for the wrong captcha provider

## Practical lesson

If a registration flow has multiple challenge providers, do **not** assume the same solver token can be reused across all steps.

### Correct workflow
1. Inspect frontend JS bundle first
2. Identify which captcha protects which step
3. Extract the **exact** request body and field naming convention
4. Solve the correct captcha for each step independently
5. Only spend solver credits after confirming the right provider is attached to the current endpoint

## Aliyun puzzle captcha specifics (Pateway)

Pateway's Aliyun captcha is a **puzzle variant** — NOT a simple "slide to end". The slider must be dragged to an exact position matching the puzzle piece gap in the background image.

### DOM element IDs (2026-07)
- **Slider handle**: `#aliyunCaptcha-sliding-slider` (40×40px)
- **Track**: `#aliyunCaptcha-sliding-body` (300×40px)
- **Mask/overlay**: `#aliyunCaptcha-mask`
- **Puzzle piece**: `#aliyunCaptcha-puzzle`
- **Captcha image**: `#aliyunCaptcha-img`

### Solving method
- **JS `MouseEvent.dispatchEvent()` does NOT work** for Pateway's puzzle captcha
- **CDP `Input.dispatchMouseEvent`** (mousePressed → mouseMoved × N → mouseReleased) with non-linear easing curve works
- Distance is unknown — try fractions of the track: 0.3, 0.5, 0.7 (confirmed: 0.5 = 130px worked)
- Check success: `#aliyunCaptcha-mask` display becomes `none`
- Failed attempt text: `验证失败，请重试` → refresh captcha and retry with different fraction
- See `references/aliyun-slider-captcha-bypass.md` for full CDP drag code

### Registration completion check
- Registration dialog closing without error does NOT mean success
- Verify by attempting login: `"账号不存在"` = registration silently failed (missing Turnstile token)
- Both Aliyun captcha (send-code) AND Turnstile (register) must be solved for the account to actually exist

## SPA login quirk

After login, localStorage may contain `_l_KPLiPs` token, but the SPA may still show "Get Started" (unauthenticated state). The SPA requires proper session cookies (not just localStorage token) for the authenticated view. The API key management page is at `#/console/keys` but requires the SPA to recognize the authenticated state.

## Durable heuristic

When a supposedly valid Turnstile token keeps failing on a `send-code` endpoint:
- suspect a hidden or popup captcha layer (Aliyun, GeeTest, slider, etc.)
- inspect the frontend for multiple challenge initializers before retrying solvers

## Why this matters

Without this check, you can waste solver credits and misdiagnose the site as:
- blocking your IP,
- rejecting all external solvers,
- or having a bad Turnstile token,

when the real issue is simply that the endpoint is protected by **a different captcha system**.