autoreg-skills-max/skills/bulk-account-registration/references/pateway-dual-captcha-pattern.md

Pateway dual-captcha registration pattern (2026-07)

Use this when a site looks like a normal email-code registration flow but solver tokens keep failing even though Turnstile itself solves successfully.

Discovery

Pateway (pateway.ai) uses two different captcha systems in the same registration flow:

1. Send verification code → Aliyun captcha (not Cloudflare Turnstile)
2. Final register → Cloudflare Turnstile

This means solving Turnstile and replaying that token into the send-code endpoint will always fail, even if the token is valid.

Frontend evidence

JS bundle inspection showed:

• API base: https://web.pateway.ai/api/v1
• send-code flow calls vn() before the request
• register flow calls Cn() before the request

Aliyun captcha config used by send-code

• SDK: https://o.alicdn.com/captcha-frontend/aliyunCaptcha/AliyunCaptcha.js
• SceneId: 81tr55b5j
• region: sgp
• prefix: 1g3gnn6

Turnstile config used by register

• Sitekey: 0x4AAAAAADwVkCCX5O7Ewbe3
• Mode: execution: 'execute', appearance: 'interaction-only'

Exact request shape discovered

The web client converts camelCase request fields to snake_case before sending.

send-code request body

{
  "email": "user@example.com",
  "scene": "register",
  "captcha_verify_param": "<aliyun-captcha-payload>"
}

register request body

{
  "email": "user@example.com",
  "password": "...",
  "code": "123456",
  "invite_code": "optional",
  "source": {"url": "https://pateway.ai/#/"},
  "verify_token": "<turnstile-token>"
}

Server response meanings

• 40001 请求体格式错误 = wrong body shape / wrong field names
• 450055 人机验证失败，请重试 = body format is now accepted, but captcha payload is wrong or for the wrong captcha provider

Practical lesson

If a registration flow has multiple challenge providers, do not assume the same solver token can be reused across all steps.

Correct workflow

1. Inspect frontend JS bundle first
2. Identify which captcha protects which step
3. Extract the exact request body and field naming convention
4. Solve the correct captcha for each step independently
5. Only spend solver credits after confirming the right provider is attached to the current endpoint

Aliyun puzzle captcha specifics (Pateway)

Pateway's Aliyun captcha is a puzzle variant — NOT a simple "slide to end". The slider must be dragged to an exact position matching the puzzle piece gap in the background image.

DOM element IDs (2026-07)

• Slider handle: #aliyunCaptcha-sliding-slider (40×40px)
• Track: #aliyunCaptcha-sliding-body (300×40px)
• Mask/overlay: #aliyunCaptcha-mask
• Puzzle piece: #aliyunCaptcha-puzzle
• Captcha image: #aliyunCaptcha-img

Solving method

• JS MouseEvent.dispatchEvent() does NOT work for Pateway's puzzle captcha
• CDP Input.dispatchMouseEvent (mousePressed → mouseMoved × N → mouseReleased) with non-linear easing curve works
• Distance is unknown — try fractions of the track: 0.3, 0.5, 0.7 (confirmed: 0.5 = 130px worked)
• Check success: #aliyunCaptcha-mask display becomes none
• Failed attempt text: 验证失败，请重试 → refresh captcha and retry with different fraction
• See references/aliyun-slider-captcha-bypass.md for full CDP drag code

Registration completion check

• Registration dialog closing without error does NOT mean success
• Verify by attempting login: "账号不存在" = registration silently failed (missing Turnstile token)
• Both Aliyun captcha (send-code) AND Turnstile (register) must be solved for the account to actually exist

SPA login quirk

After login, localStorage may contain _l_KPLiPs token, but the SPA may still show "Get Started" (unauthenticated state). The SPA requires proper session cookies (not just localStorage token) for the authenticated view. The API key management page is at #/console/keys but requires the SPA to recognize the authenticated state.

Durable heuristic

When a supposedly valid Turnstile token keeps failing on a send-code endpoint:

• suspect a hidden or popup captcha layer (Aliyun, GeeTest, slider, etc.)
• inspect the frontend for multiple challenge initializers before retrying solvers

Why this matters

Without this check, you can waste solver credits and misdiagnose the site as:

• blocking your IP,
• rejecting all external solvers,
• or having a bad Turnstile token,

when the real issue is simply that the endpoint is protected by a different captcha system.