# Token Extraction Workflow — 2026-08-01

## Extract tokens from account_manager.db

After a registration task completes with `status: succeeded`, extract tokens immediately
(session cookies expire within 1-3 hours):

```python
import sqlite3, json

db = sqlite3.connect("C:/Users/User/Desktop/GPT-AUTOREG/aBaiAutoplus/account_manager.db")
db.row_factory = sqlite3.Row

# 1. Find valid accounts from the latest task
task = db.execute("SELECT result_json FROM tasks WHERE status='succeeded' ORDER BY finished_at DESC LIMIT 1").fetchone()
result = json.loads(task["result_json"])
account_ids = result["data"]["account_ids"]  # e.g. [33, 34, 35, ...]

# 2. Get emails
emails = {}
for aid in account_ids:
    a = db.execute("SELECT email FROM accounts WHERE id = ?", (aid,)).fetchone()
    emails[aid] = a["email"]

# 3. Get full tokens (cookies + access_token + session_token + legacy_token)
new_accounts = []
for aid in account_ids:
    creds = db.execute("""
        SELECT key, value FROM account_credentials
        WHERE account_id = ? AND credential_type IN ('token','cookie')
    """, (aid,)).fetchall()
    tokens = {c["key"]: c["value"] for c in creds}
    new_accounts.append({"email": emails[aid], "tokens": tokens})

# 4. Save to accounts_tokens.json
with open("C:/Users/User/Desktop/GPT-AUTOREG/accounts_tokens.json", "w") as f:
    json.dump({"accounts": new_accounts}, f, indent=2)

db.close()
```

## Token structure

Each account in `account_credentials` table has these credential types:

| credential_type | key | Description |
|---|---|---|
| token | `session_token` | ~3700-char JWT, used as `__Secure-next-auth.session-token` cookie |
| token | `access_token` | ~1700-char JWT, ChatGPT web app access token |
| token | `legacy_token` | Same as access_token |
| cookie | `cookies` | Python dict string with 27 cookies (CF, oai-*, auth-*, etc.) |
| identifier | `account_id` | UUID for workspace/account |

## Camoufox cookie injection

Cookies set via `context.add_cookies()` — format requirements:

- `domain`: "chatgpt.com" (NO leading dot)
- `secure`: True
- `sameSite`: "Lax"
- Do NOT set `httpOnly` field (causes "Invalid cookie fields" error)
- Truncate cookie values >4000 chars (Playwright limit)

```python
import ast
cookies_dict = ast.literal_eval(account["tokens"]["cookies"])
cookies_list = []
for name, value in cookies_dict.items():
    if not isinstance(value, str): continue
    clean = value[:4000] if len(value) > 4000 else value
    cookies_list.append({
        "name": name, "value": clean,
        "domain": "chatgpt.com", "path": "/",
        "secure": True, "sameSite": "Lax",
    })
await page.context.add_cookies(cookies_list)
```

## API endpoints tested

| Endpoint | Result | Notes |
|---|---|---|
| `GET /backend-api/me` | HTTP 200 | Works even on fresh accounts |
| `POST /backend-api/conversation` | HTTP 403 | "Unusual activity" on accounts <24h old |
| `POST /backend-api/conversation` (text) | HTTP 403 | Same block for text messages |
| `POST api.openai.com/v1/images/generations` | HTTP 401 | `token_invalidated` — access_token not valid for official API |

## Transport comparison

| Transport | Cloudflare | /me | /conversation |
|---|---|---|---|
| httpx (Python) | Blocked (403 HTML) | ❌ | ❌ |
| Playwright Chromium | Blocked ("Just a moment...") | ❌ | ❌ |
| Camoufox (Firefox) | Passes | ✅ 200 | ❌ 403 (account age) |
| curl_cffi (aBaiAutoplus) | Passes (firefox144 impersonation) | ✅ | Used for registration only |

## Registration task command

```bash
curl -s -X POST http://localhost:8000/api/tasks/register \
  -H "Content-Type: application/json" \
  -d '{"count":10,"concurrency":2,"executor_type":"protocol","captcha_solver":"auto","extra":{"mail_provider":"imap_pool","identity_provider":"mailbox"}}'
```

Typical yield: 8/10 success with t-online.de pool. Failures are `account_deactivated` or `invalid_auth_step`.