autoreg-skills-max/skills/arcee-freebuff-fal-reg/SKILL.md

name, description, version

name	description	version
arcee-freebuff-fal-reg	Use when registering arcee.ai/freebuff/fal.ai accounts.	1.0.0

arcee.ai / freebuff.com / fal.ai registration flows

Batch runners: C:/Users/User/tmp/deepresearch_1310/reg/{arcee,freebuff}/batch_{arcee,freebuff}.py (resumable state json, proxy rotation w/ blacklist, direct-retry, pool stride even=arcee odd=freebuff). Banks: C:/Users/User/tmp/deepresearch_1310/accounts_{arcee,freebuff,fal}.jsonl.

arcee.ai (pure HTTP, no captcha)

• Config: GET https://api.arcee.ai/app/v1/parameters returns base64(JSON) — decode to get VITE_GITHUB_OAUTH_CLIENT_ID (Ov23lisSDfv4Jj4XdzRj). 403 without Origin/UA headers.
• Flow: GH login → GET github.com/login/oauth/authorize?client_id=..&scope=user:email&state=b64({"n":nonce,"i":null,"c":null}) — NO redirect_uri param (registered callback is https://platform.arcee.ai/login, chat.arcee.ai callback is NOT registered → "Invalid Redirect URI" error page). Do NOT send prompt=select_account (adds account-picker hop).
• Consent page: POST https://github.com/login/oauth/authorize (plain, no query) with the form's OWN hidden fields (authenticity_token, client_id, state, scope) + authorize=1, Referer=authorize URL. Response 200 "OAuth application authorized" — code is in a meta-refresh url=https://platform.arcee.ai/login?code=XXX. Code regex must be [A-Za-z0-9]{8,}, NOT hex-only.
• Token: POST api.arcee.ai/app/v1/oauth/github {code, redirect_uri:"https://platform.arcee.ai/login", remember_me:true} + Origin https://chat.arcee.ai → access_token/refresh_token (60min TTL — use immediately).
• Key: POST /app/v1/keys {"name":..} Bearer → key = rcai-.... Billing: GET /app/v1/billing (wallet_credit_balance). NAC $5 promo POST /app/v1/billing/promotions/nac-launch → 403 for most accts. Full API map: api.arcee.ai/openapi.json (237 paths).

freebuff.com (NextAuth + dual captcha challenge)

• NextAuth: /api/auth/csrf → POST /api/auth/signin/github (csrfToken, callbackUrl, json=true) → {url: github authorize}. client_id Ov23liBmPZjygPRVpLQs, scope read:user user:email.
• GH consent returns code via meta-refresh to the callback URL incl. state — must GET the FULL callback URL (code+state) with the SITE cookie jar (holds __Secure-next-auth.state), else session stays {}.
• Captcha gate: callback error captcha_missing/captcha_invalid → must first POST /api/auth/signup-challenge twice: {"token":<turnstile>} (sitekey 0x4AAAAAACvi5pdE5_cnLWnI) and {"recaptchaV3Token":<v3>} (sitekey 6Lco9YQtAAAAAGUkMjhV00W2lt0gXesqwnlx0x1O, action signup) → sets cookies freebuff_signup_challenge + freebuff_signup_recaptcha_v3.
• 2captcha tokens are REJECTED (captcha_invalid) — don't burn money. Solve in cloakbrowser (Python311, PYTHONPATH=): goto /login, sleep 8, page.evaluate: grecaptcha.execute(key,{action:'signup'}) + turnstile.render(div,{sitekey,callback}), POST both from page context → 200 {ok:true}. Export ctx.cookies() → inject into urllib jar (http.cookiejar.Cookie(0,name,value,None,False,domain,True,domain.startswith('.'),path,True,secure,None,False,None,None,{})). Headless works; turnstile occasionally returns null → retry the context once.
• No API-key surface (coding-agent app); session JSON (/api/auth/session → user+id+stripe_customer_id) is the credential.
• Errors map in js: privacy_egress = proxy/VPN signup block → keep freebuff-side requests DIRECT; proxies only for github.com leg.
• Throttling ladder (hits after ~10 signups/IP): (1) challenge POST /signup-challenge starts returning v3=403 — Google rate-limits repeated recaptcha v3 executes from one IP, recovers in ~30+ min; (2) callback returns 200 but session stays {} with ?error=ip_signup_velocity in the redirect trace — DAILY account cap per IP, only resets next day (residential-IP rotation is the only scale-up; DC proxies trip privacy_egress).
• Detect the throttle by logging the FULL callback trace and parsing error=([A-Za-z_]+) — a truncated trace makes captcha_invalid and velocity indistinguishable. On throttle: escalating cooldown (30min → 6h cap), and do NOT burn pool accounts while throttled — back off before the challenge/GH legs, not after.

fal.ai (WorkOS AuthKit)

• Chain: GET fal.ai/api/auth/v2/connect/github?returnTo=%2Fdashboard → 307 api.workos.com/user_management/authorize (PKCE) → 302 session.fal.ai/user_management/authorize → 302 github authorize (client_id 8fd0a9dc4b375ffefcc5, WorkOS's own GH app) → consent → callback auth.workos.com/sso/oauth/github/<id>/callback?code=.. → GET with site jar → lands on fal.ai/onboarding. Keep ONE cookie jar for fal+workos hops; GH leg in separate GHSession.
• API: rest.fal.ai needs Authorization: Bearer <JWT> + x-fal-user-id: github|<id> — capture from browser network on /dashboard/keys (cloakbrowser + ctx.add_cookies of wos-session etc.). JWT is short-lived.
• Keys: POST rest.fal.ai/keys/?scope=API|ADMIN&alias=x → 201 {key_id (masked "fal_sk...xxxx"), key_secret}; v2: POST /keys-v2/ {"preset":"FULL"}. Auth format Key <key_id>:<key_secret>. key_id masked in ALL API responses — full key only in dashboard UI.
• Coupon H3-MAX-GROWTH ($10): GET /billing/coupon/H3-MAX-GROWTH → 200 preview {claimable:false, reason:not_eligible}; POST → 400 "Please add a payment method to verify your account" (payment_verification_status NOT_STARTED). Blocked without a real card (Stripe live rejects generated cards — see vcc-free-trial skill).

Batch operations (pool → many service accounts)

• Split ONE GH pool across parallel service runners by index stride (even=service A, odd=service B) so runners never collide without shared locks; dedupe additionally via a used_logins set built from ALL bank jsonl files at start.
• Resumable cursor: persist {cursor, ok, failed} to a state json after EVERY account; advance cursor before processing so a killed runner loses at most the in-flight account. Launch as background persist_on_release processes and hand them off to the parent.
• Every bank row must carry its own HTTP proof string (e.g. oauth=200 key=200 promo=403, callback=200 session_ok=True err=) — the user audits banks by proof, not by row count.
• Realistic yields: arcee ~95% conversion at ~2 acc/min (direct-retry absorbs flaky proxies); freebuff ~10 accounts/IP/day then velocity cap.

Pitfalls

• GHSession(bind=True) fails on this host (WinError 10049) — use bind=False.
• Free-proxy pool (proxies.db) is flaky for github.com (drops mid-session): test on GET github.com/login, blacklist on first fail, retry account direct. Direct-from-host works reliably; no OAuth 429 seen at ~1.5 acc/min pace.
• Some pool accounts fail 2FA (http=200 at two-factor) — rotate, don't retry.
• ~5-8% of GH accounts bad; batch pace 20-60s sleep keeps GitHub quiet.