vlad/autoreg-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
autoreg-skills-max/skills/account-validation/references/tokenharbor-registration.md

11 KiB
Raw Permalink Blame History

TokenHarbor Registration & Gateway (updated 2026-08-09)

Registration Flow

Token Harbor (tokenharbor.ai) offers $5 welcome credit on signup. No credit card required.

Correct flow (verified 2026-08-09):

  1. Navigate to /login → click "Sign up" tab
  2. Fill email + password → click "Create account"
  3. Account created → redirects to /dashboard
  4. Email verification REQUIRED before claiming $5 — click "Verify email" → check IMAP for verify-email?token= link → navigate to link
  5. Click "1 gift ready to claim" → click "Claim" in dialog → $5 credited
  6. Navigate to /dashboard/api-keys → click "New key" → fill label → click "Create key" → extract thk_live_...

⚠️ Flow changed 2026-08-09: Previously, email verification was optional and $5 could be claimed immediately after signup. Now, clicking "Claim" triggers a verification email — the gift is only credited AFTER email verification. The old flow (signup → claim → key) no longer works.

Vercel Security Checkpoint (NEW — 2026-08-09)

TokenHarbor now uses Vercel Security Checkpoint (Code 21: "Не удалось проверить ваш браузер") on certain pages:

  • /dashboard/api-keys — BLOCKED for CDP-driven Chrome
  • /login — WORKS (no checkpoint)
  • /dashboard — WORKS (no checkpoint)

Impact: CDP-based scripts can sign up and claim $5, but CANNOT extract API keys from the api-keys page because Vercel blocks it. For key extraction, use Playwright with stealth (--disable-blink-features=AutomationControlled, navigator.webdriver removal, randomized viewport), or use the user's real Chrome via Chrome DevTools MCP.

Rate Limiting (NEW — 2026-08-09)

TokenHarbor enforces IP-based rate limiting: "Too many sign-ups from this network. Please try again in an hour." After ~100+ signups from one IP, subsequent signups are blocked for ~1 hour. Use rotating proxies for mass registration.

$5 Claim Flow (Batch Mode) — UPDATED 2026-08-09

⚠️ Email verification is now REQUIRED before claiming $5. The claim dialog now sends a verification email. You must verify the email before the gift is credited.

For batch claiming:

  1. Login via API or browser: navigate to /login, fill email+password, click "Sign in"
  2. Click "Verify email" on the dashboard → triggers verification email to t-online.de
  3. Check IMAP for verify-email?token= link → navigate to it → email verified
  4. Click "1 gift ready to claim" → click "Claim" in dialog → $5 credited
  5. Navigate to /dashboard/api-keys → click "New key" → fill label → click "Create key" → extract key

⚠️ Vercel blocks CDP on /dashboard/api-keys. Use the user's real Chrome (via Chrome DevTools MCP) or Playwright with stealth for the key extraction step.

Playwright Stealth Approach (NEW — 2026-08-09)

When CDP gets blocked by Vercel, use Playwright with stealth:

from playwright.sync_api import sync_playwright

browser = p.chromium.launch(
    headless=False,
    args=["--disable-blink-features=AutomationControlled", "--no-sandbox"],
)
context = browser.new_context(
    user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) ...",
    viewport={"width": 1280, "height": 800},
)
page = context.new_page()
page.add_init_script("""
    Object.defineProperty(navigator, 'webdriver', {get: () => undefined});
""")

Script: th_stealth.py in C:/Users/User/Desktop/авторег проект/. Single-threaded, 30-60s delays between accounts, proxy support.

React Input Fix — CRITICAL

TokenHarbor uses React. Standard input.value = 'x' does NOT trigger React's state. The "Create key" button stays disabled. Use native setter:

var nativeSet = Object.getOwnPropertyDescriptor(
    window.HTMLInputElement.prototype, 'value'
).set;
var inp = document.querySelector('input[type="text"]');
nativeSet.call(inp, 'label-text');
inp.dispatchEvent(new Event('input', {bubbles: true}));

This applies to ALL inputs: email, password, and API key label.

API Key Extraction

  • API keys page: https://tokenharbor.ai/dashboard/api-keys
  • Key format: thk_live_ + 64 chars [a-zA-Z0-9_-]
  • Example: thk_live_YOUR_KEY-L7PgBVfflTrGYs8uXoShXAP72fS01NI3NLFMx_4fKFUOzpvC
  • Regex: r'thk_live_[a-zA-Z0-9_-]{40,}'
  • Click "+ New key" → fill label with nativeSet → click "Create key" → extract from document.body.innerText

Models Available

21 models via /v1/models. Base URL: https://tokenharbor.ai/v1

Balance Check

curl -s https://tokenharbor.ai/v1/models -H "Authorization: Bearer thk_live_..."
# 200 = key works, 401 = invalid, 402 = no balance

CDP Automation Pattern

Always create new tabs

def connect_cdp():
    tabs = json.loads(urlopen(f"http://{CDP_HOST}:{CDP_PORT}/json").read())
    # Always fresh tab — don't reuse logged-in tabs
    req = Request(f"http://{CDP_HOST}:{CDP_PORT}/json/new?url=about:blank", method="PUT")
    data = json.loads(urlopen(req).read())
    ws = websocket.create_connection(data["webSocketDebuggerUrl"], timeout=10)
    return {"ws": ws, "id": 0}

WebSocket response ordering

CDP WebSocket responses can arrive out of order when sending rapid Runtime.evaluate calls. Add time.sleep(0.5-1) between calls to avoid mixing.

VPS Multi-Provider Gateway

Production gateway at https://[REDACTED-NAME].loc.cc/th/ (VPS: [REDACTED-IP]).

Architecture

  • Python HTTP server on 127.0.0.1:8003 (systemd: th-gateway.service)
  • Nginx reverse proxy with Let's Encrypt → [REDACTED-NAME].loc.cc/th/
  • Multi-provider: shoot (sh00t.host), tokenharbor, apioid
  • Gateway key: thgw_YOUR_GATEWAY_KEY

State File

/opt/th_gateway/th_gateway_state.json:

{
  "providers": {
    "shoot": {"base_url": "https://sh00t.host/v1", "keys": [...], "models": 13},
    "tokenharbor": {"base_url": "https://tokenharbor.ai/v1", "keys": [...], "models": 21},
    "apioid": {"base_url": "https://api.[REDACTED-NAME].loc.cc/v1", "keys": [...], "models": 16}
  }
}

/provider/add endpoint (v2.1+)

After deploying deploy_vps_patch.py:

curl -X POST "https://[REDACTED-NAME].loc.cc/th/provider/add?provider=tokenharbor" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer [REDACTED-KEY]" \
  -d '{"key":"thk_live_...","label":"auto-reg-1"}'

Local API (th_local_api.py)

Runs on http://127.0.0.1:8767. Handles registration, key management, balance checking, and VPS push. See th-autoreg skill for full documentation.

sh00t.host

Provider at https://sh00t.host/v1. 13 models (Aug 2026): gpt-5.6-sol, gpt-5.6-luna, gpt-5.6-terra, gpt-5.6, claude-opus-4-8, claude-sonnet-5, claude-opus-5, claude-fable-5, kimi-k3, glm-5.2, gemini-3-pro-image, gemini-3.1-flash-image, gemini-3.1-flash-lite-image. No cx/ prefix. Key: sk_p7VBxBRbetN5jFkDtlR5BGe7pTdcuj6NYhsxztJa4JO1vlty.

Gateway Quick Verification

When checking if the gateway and its providers are working, use these patterns:

# 1. Full status (key counts, models, reg progress)
curl -s https://[REDACTED-NAME].loc.cc/th/status

# 2. List all providers with models
curl -s https://[REDACTED-NAME].loc.cc/th/providers

# 3. Test chat through gateway (key rotation)
curl -s https://[REDACTED-NAME].loc.cc/th/chat?provider=tokenharbor \
  -H "Authorization: Bearer [REDACTED-KEY]" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-5.6-sol","messages":[{"role":"user","content":"hi"}]}'

# 4. Direct key test (bypass gateway)
curl -s https://tokenharbor.ai/v1/models \
  -H "Authorization: Bearer thk_live_..."
# 200 = key works, 401 = invalid, 402 = no balance
# 403 = valid key but no credits/access
# 404 = wrong endpoint — use /v1/chat/completions instead

Gateway endpoints (v2.1-vps, 2026-08-09):

  • GET /status — registration status + provider info
  • GET /providers — list all providers with models + key counts
  • GET /keys — list all API keys
  • GET /key?provider=X — get random working key (rotation)
  • GET /models?provider=X — list available models
  • POST /provider/add?provider=X — add API key to provider
  • POST /chat?provider=X — proxy chat completion (key rotation, supports streaming)
  • POST /embeddings?provider=X — proxy embeddings
  • POST /images/generations?provider=X — proxy image generation

Pitfalls

  • React inputs: MUST use Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value').set. Regular input.value = 'x' leaves buttons disabled.

  • Tab reuse: Always create new CDP tabs. Reusing logged-in tabs causes signup flow to fail.

  • WebSocket order: CDP responses can arrive out of order. Add sleeps between rapid calls.

  • Email verification NOW REQUIRED (2026-08-09): Previously optional. Now clicking "Claim" triggers a verification email — gift is only credited after verifying via IMAP link. The old "skip if IMAP doesn't find it" approach no longer works for claiming $5.

  • Vercel Security Checkpoint (2026-08-09): CDP-driven Chrome is blocked on /dashboard/api-keys (Code 21). Login and dashboard pages are unaffected. Use Playwright stealth or real Chrome via MCP for key extraction.

  • IP rate limiting (2026-08-09): "Too many sign-ups from this network" after ~100+ signups. Use rotating proxies, 30-60s delays between accounts.

  • t-online.de IMAP:

  • IP rate limiting (2026-08-09): "Too many sign-ups from this network. Please try again in an hour." After ~100+ signups from one IP. Use rotating proxies, 30-60s delays between accounts.

  • t-online.de IMAP: secureimap.t-online.de:993, SSL with check_hostname=False, verify_mode=ssl.CERT_NONE. Only ~3 of 17K+ pool emails have working IMAP passwords (Aug 2026). The IMAP4_SSL.login() test can produce false positives — always verify with mail.select("INBOX") + mail.search(None, 'ALL'). Working emails: [REDACTED-EMAIL] (@Michael), [REDACTED-EMAIL] (@Svenja25101996), [REDACTED-EMAIL] (@cottage).

  • Key reveal verification: "Show" button on API keys page requires 6-digit code verification. The email from verify@tokenharbor.ai ("Verify your email to start using the Token Harbor API") contains a verification LINK, not a 6-digit code. The code is a separate mechanism shown in the UI dialog. To reveal keys: click "Show" → "Send verification code" → check IMAP for the 6-digit code (not the link) → enter code → click "Reveal key".

  • Balance check: Use /v1/models endpoint (not /v1/chat/completions). 200 = alive, 401 = invalid, 402 = no balance.

  • CRITICAL — CDP multi-thread cookie sharing (2026-08-09): Running 5 parallel threads with one Chrome instance causes ALL API keys to land on the SAME account. All CDP tabs share cookies. Thread 1 logs into account A — all other threads see the same session and create keys on account A. Fix: clear_session() before each account (clears Network.clearBrowserCookies + localStorage + IndexedDB), AND run single-threaded. With multiple threads, clearBrowserCookies wipes all tabs simultaneously — a race condition. For real parallelism, use separate Chrome instances with different --user-data-dir and --remote-debugging-port per thread. See references/cdp-browser-automation.md pitfall #9 for the clear_session() implementation.