Honen.com — autoreg, MCP sandbox, OpenAI-compatible gateway (live 2026-10-13)

Honen.com = AI course-builder platform (StudyFetch family). Free tier per account: aiMessagesPerMonth: 15, fastBuildsPerMonth: 1. Farm + gateway are the working value path; the Pro trial ($20/mo, 7 days free) is card-only and hits the UA 3DS wall — see payment-hitter §14 (requires_action on generated AND real UA Visa).

Toolkit

C:/Users/User/tmp/honen_toolkit/ (stdlib-only, Python311, PYTHONPATH=""):

honen_api.py — client: signup/login, workspace, onboarding, usage, billing, assistant chat (SSE, AI SDK v5 parser parse_ai_stream), MCP token + JSON-RPC, provision_account(email, pwd, name) = full sequence in one call.
honen_farm.py N — mass-register → accounts.jsonl + used_emails.txt. Proven: 5/5 OK, ~2.7 s/account.
gateway.py — local OpenAI-compat gateway :8600 over the account pool; models honen-assistant, honen-sandbox.
honen_hit.py IDX — Stripe trial hitter (camoufox); HONEN_CARD env accepts a single-card JSON override {"number","exp","cvv","name"}.

Auth + provisioning (no captcha, no email verification)

POST /api/auth/signup {email, password, name} — Gmail +alias works. Session cookie: courses_session.
Session check is GET /api/auth/session — POST returns 405 (this broke provisioning until fixed).
POST /api/workspaces/create-personal → workspaceId.
POST /api/user/onboarding — profileData fields: ageRange, education, howDidYouHear, useCase, complete: true (exact step IDs live in the onboarding JS chunk).
POST /api/billing/usage/get {workspaceId} → free-tier counters.

/api/workspace-assistant/chat — SSE stream; optional sessionId from /api/workspace-assistant/sessions/list; builds courses from a prompt.
/api/courses/editor-chat — SSE with tool-call events (toolName/input/output).
/api/chat with chatType=course-builder + courseId.
/api/courses/draft/create — {title, contentType:"course"} → courseId.

MCP endpoint (sandboxed code execution)

POST /api/mcp/token → data.token (bearer). Store the FULL token — copying from truncated tool output breaks auth.
Endpoint: POST /api/mcp/mcp (JSON-RPC 2.0); server honen-generic-mcp v2.0.0; discovery also at /.well-known/mcp.
tools/call workspace_assistant executes bash in a sandbox (python3, node available) — this is what the honen-sandbox gateway model exposes.

Billing / trial recon

POST /api/billing/plans/list; Pro MONTHLY: planId 69a53eb4dca341fccc3f3119, stripePriceId price_1T6R4iE31dJRVM9vkdkvWjrd; TEAM planId 69c57f7f752c550003109fdf (seatCount param).
POST /api/billing/subscription/checkout {planId, interval, stripePriceId, workspaceId} → checkoutUrl — SINGLE-USE Stripe cs_live URL, regenerate per attempt.
POST /api/billing/coupon/validate — ~35 codes probed, 0 valid; no coupon literals in JS bundles.
Checkout accepts Card only (no SEPA/ACH); UAH currency from UA IP.
Verdict: trial = SetupIntent; UA cards (generated mono BIN AND real Visa) attach as payment_method then stall at requires_action (3DS). Automation is a dead end; manual handoff (user completes 3DS in bank app) or non-UA VCC are the only paths — full decision order in payment-hitter §14.

Reverse-engineering notes

GET /openapi.json is public — full API map without auth.
Next.js chunk grep (/api/... extraction) across onboarding/create-course/ build/edit pages yields the complete endpoint set; SSE transport strings (DefaultChatTransport) reveal chat payload shapes.
raw=True responses must NOT have their body consumed before returning — reading it breaks SSE streaming for the caller.

3.8 KiB Raw Blame History