# Nexotoken.net — Domain Whitelist & Turnstile Autoreg

**Service:** nexotoken.net (AI API gateway, ~40 models, $3/7days promo)
**Base API:** `https://www.nexotoken.net/api`
**Auth:** FingerprintJS visitorId + Cloudflare Turnstile on BOTH send-code and register

## Critical: Email Domain Whitelist

Nexotoken enforces a DOMAIN WHITELIST for registration. `POST /api/auth/send-code` returns `400 validation_error` for blocked domains:

| Domain | Status | Error |
|---|---|---|
| **t-online.de** | ✅ ACCEPTED | 200 success |
| **icloud.com** | ✅ ACCEPTED | 200 success |
| **qq.com / foxmail.com / 163.com / 126.com** | ✅ ACCEPTED | (listed in error as examples) |
| **gmail.com** | ❌ BLOCKED | "Google 邮箱请使用 Google 快捷登录，暂不支持邮件验证码注册" |
| **voidash.bond** | ❌ BLOCKED | "当前平台仅支持主流邮箱域名注册" |
| **outlook.com** | ❌ BLOCKED | same whitelist error |
| **hotmail.com** | ❌ BLOCKED | same whitelist error |

**Decision: use t-online.de pool (C:/Users/User/Desktop/avtoreg/working_mails.txt) with IMAP at secureimap.t-online.de:993.**

Probe new domains: solve 1 Turnstile via sidecar, call send-code, read the error.

## Registration Flow (HTTP-only)

1. **Turnstile**: sitekey `0x4AAAAAADkmZg-ZC-lJ2DRw`, page `https://www.nexotoken.net/register`
   - Sidecar: `POST http://127.0.0.1:8877/solve {"type":"turnstile","url":"...","sitekey":"...","real_page":true}`
2. **Send-code**: `POST /api/auth/send-code {email, turnstileToken, fingerprint, acq: null}`
   - `fingerprint` = FingerprintJS visitorId (32-char hex; server may validate — use random hex, not static)
   - Response: `{success:true, data:{registrationSession:"..."}}`
3. **OTP**: read 6-digit code from email (IMAP: filter by "nexotoken" keyword)
4. **Register**: `POST /api/auth/register {username, email, password, displayName, verificationCode, registrationSession, turnstileToken, fingerprint}`
   - Requires FRESH Turnstile token (the one from send-code may be consumed)
   - Response: `{success:true, data:{token:"...", user:{...}}}`
5. **Token**: Bearer token from register response → stored in localStorage as `token`
6. **Balance**: `GET /api/user/balance` (auth required)
7. **API keys**: probe `/api/keys`, `/api/user/keys`, `/api/api-keys`

## Endpoints Discovered

- `/api/auth/send-code` — send verification code
- `/api/auth/register` — complete registration
- `/api/auth/login` — login (username + password + turnstile)
- `/api/auth/verify` — verify session
- `/api/user/balance` — credit balance
- `/api/user/stats` — usage stats
- `/api/models/featured` — featured models
- `/api/models/providers` — provider list
- `/api/public/model-status` — public model status

## Turnstile Double Requirement

Both send-code AND register require valid Turnstile tokens — the same token cannot be reused. Obtain a fresh token for each step.

## Base URL

`https://www.nexotoken.net/api` — all paths are relative to this base. The request helper prepends `/api` to all paths.