# Clerk Auth: Detecting OAuth-Only Sign-Up

## Problem

When a platform uses Clerk for auth, email sign-up may silently fail with `captcha_missing_token` or `email_address is not a valid parameter` — even with a valid Turnstile token. The root cause is NOT the CAPTCHA: the Clerk dashboard has email sign-up DISABLED.

## Detection

Before attempting email registration, check the Clerk environment:

```bash
curl -s https://clerk.PLATFORM.COM/v1/environment?__clerk_api_version=2025-11-10 | \
  python3 -c "import sys,json; d=json.load(sys.stdin); print(d['auth_config']['identification_requirements'])"
```

Key field: `auth_config.identification_requirements` — a list of lists. Each sublist is a set of strategies where at least ONE must be used.

```json
// OAuth-ONLY (tuskcentral.ai):
"identification_requirements": [["oauth_apple","oauth_facebook","oauth_google","oauth_token_apple"],[]]

// Email + OAuth:
"identification_requirements": [["email_address","oauth_google"],[]]

// Email only:
"identification_requirements": [[]]
```

If `email_address` is NOT in any sublist, email sign-up is impossible. The API will return:
- `captcha_missing_token` (code misleading — CAPTCHA was fine, but email isn't allowed)
- `email_address is not a valid parameter for this request`

## Turnstile Token Still Needed

Even for OAuth sign-up, the Turnstile token may be required. The solver service at `solver/service.py` (port 8191) provides Turnstile tokens. Extract the sitekey from `display_config.captcha_public_key` (visible) or `display_config.captcha_public_key_invisible`.

## Example: tuskcentral.ai

```
Clerk API:     https://clerk.tuskcentral.ai/v1/
Publishable:   pk_live_Y2xlcmsudHVza2NlbnRyYWwuYWkk
Sitekey:       0x4AAAAAAAWXJGBD7bONzLBd (visible)
Invisible:     0x4AAAAAAAFV93qQdS0ycilX
Sign-up:       OAuth only (Google, Apple, Facebook)
Sign-in:       Email + OTP (email_code) OR OAuth
Identification: [["oauth_apple","oauth_facebook","oauth_google","oauth_token_apple"],[]]
Block disposable: true
Cloudflare:    Yes — direct API calls return 403 error 1010; browser-based Clerk JS SDK works
```

## Workflow

1. `GET /v1/environment` → check `identification_requirements`
2. If OAuth-only → switch to Google OAuth (or abandon email approach)
3. If email allowed → get Turnstile token from solver, then `POST /v1/client/sign_ups`
4. Never waste CAPTCHA solver credits on OAuth-only platforms

## Solver Service Dependency

The Turnstile solver at `solver/service.py` (port 8191) must be running:
```bash
cd "<project>/solver" && python service.py
```
Check: `curl -s http://127.0.0.1:8191/health`