111 lines
4.2 KiB
Markdown
111 lines
4.2 KiB
Markdown
# Blackbox.ai Registration & API
|
|
|
|
## Registration Flow
|
|
|
|
Blackbox.ai (`app.blackbox.ai`) — multi-agent orchestration platform with 48+ AI models, paid API access.
|
|
|
|
### Signup Mechanism
|
|
|
|
- Signup page: `https://app.blackbox.ai/signup`
|
|
- **NO CAPTCHA** on the signup form — just email + password
|
|
- **Next.js server action**: The form submits via `POST /signup` with `multipart/form-data` and `text/x-component` accept header
|
|
- Response: `{"type":"success","resultCode":"USER_CREATED"}` (RSC format)
|
|
- **NO browser needed** for the POST itself, but the `next-action` header is dynamically generated from the page — cannot be hardcoded for HTTP-only signup
|
|
|
|
### HTTP Signup Attempt (Partial)
|
|
|
|
The signup endpoint is `POST https://app.blackbox.ai/signup` with body:
|
|
```
|
|
------WebKitFormBoundary...
|
|
Content-Disposition: form-data; name="1_email"
|
|
|
|
email@domain.com
|
|
------WebKitFormBoundary...
|
|
Content-Disposition: form-data; name="1_password"
|
|
|
|
password
|
|
------WebKitFormBoundary...
|
|
Content-Disposition: form-data; name="0"
|
|
|
|
["$undefined","$K1"]
|
|
------WebKitFormBoundary...--
|
|
```
|
|
|
|
Required headers:
|
|
- `Content-Type: multipart/form-data; boundary=...`
|
|
- `next-action: <40-char hex from page>` — **dynamically generated, not in initial HTML**
|
|
- `Accept: text/x-component`
|
|
- `Origin: https://app.blackbox.ai`
|
|
|
|
Without a valid `next-action` header, the server returns a generic 400 error. The action ID is client-side generated and changes per session.
|
|
|
|
### Email Verification (BLOCKER)
|
|
|
|
- After signup, sent to "Verify your email" page (6-digit code)
|
|
- **t-online.de emails DO NOT receive verification emails from Blackbox** — tested with multiple accounts (asmoky, kevinfischer05, daniel.brueck, eric.foeller)
|
|
- **Gmail also does not receive** — tested with `[REDACTED-NAME]+bb1@gmail.com` (no email found in inbox)
|
|
- Email may be delayed or filtered by domain. Alternative email providers (Outlook, ProtonMail) untested.
|
|
- Login returns 500 Internal Server Error when account is unverified — verification is a hard requirement
|
|
|
|
### Google OAuth (BLOCKED)
|
|
|
|
- Google sign-in button on login/signup pages
|
|
- **Google blocks OAuth for Blackbox via CDP**: navigates to `accounts.google.com/v3/signin/rejected` with "browser or app may be unsafe"
|
|
- This happens even in the user's real Chrome via CDP (not just headless)
|
|
- Google client_id: `985058387028-iaa60lr5e586kvhjp085qcojv3jv2p7h.apps.googleusercontent.com`
|
|
|
|
## API Access
|
|
|
|
### Endpoint
|
|
|
|
- API base: `https://enterprise.blackbox.ai/chat/completions`
|
|
- OpenAI-compatible format
|
|
- Paid tier only — requires verified account with billing
|
|
|
|
### Models (48+)
|
|
|
|
Documented at `https://www.blackbox.ai/models`. Notable models:
|
|
- `z-ai/glm-5.2` ($1.40/$4.40 per MTok)
|
|
- `deepseek/deepseek-v4-pro` ($0.44/$0.87)
|
|
- `anthropic/claude-opus-4.8` ($5/$25)
|
|
- `openai/gpt-5.5` ($5/$30)
|
|
- `moonshotai/kimi-k2.7-code` ($0.74/$3.50)
|
|
- `nvidia/nemotron-3-ultra` ($0.32/$0.80)
|
|
- `google/gemini-3.5-flash` ($1.50/$9)
|
|
- `x-ai/grok-4.3` ($1.25/$2.50)
|
|
- `anthropic/claude-sonnet-5` ($3/$15)
|
|
- `anthropic/claude-opus-5` ($15/$75)
|
|
|
|
## Integration Strategy
|
|
|
|
### Working Approach
|
|
|
|
1. Use CDP Chrome to fill signup form (no CAPTCHA — works)
|
|
2. Account is created immediately (`USER_CREATED`)
|
|
3. Verification email — **unsolved for t-online.de and Gmail**
|
|
4. Alternative: use a different email provider that Blackbox accepts
|
|
|
|
### CDP Signup Pattern (Working)
|
|
|
|
```python
|
|
# Navigate to signup
|
|
page.goto("https://app.blackbox.ai/signup")
|
|
|
|
# Fill form
|
|
page.fill('input[type="email"]', email)
|
|
page.fill('input[type="password"]', password)
|
|
|
|
# Click CREATE ACCOUNT
|
|
page.click('button:has-text("CREATE ACCOUNT")')
|
|
|
|
# Wait for verify page
|
|
page.wait_for_selector('text=Verify your email')
|
|
```
|
|
|
|
### Pitfalls
|
|
|
|
- **No API-only signup**: The `next-action` header is session-bound and dynamically generated — HTTP-only signup is not feasible
|
|
- **Email domain blocking**: Blackbox appears to filter/block t-online.de and Gmail alias addresses for verification emails
|
|
- **Google OAuth blocking**: Google considers Blackbox's OAuth integration "unsafe" and blocks sign-in via CDP
|
|
- **Verification is hard requirement**: Unverified accounts cannot login (500 error on `/api/auth/callback/credentials`)
|
|
- **CSRF token**: Available at `/api/auth/csrf` but login requires verification first |