UNIKEY.AI (getunikey.ai) — New API Fork Analysis

Date: 2026-08-09 Site: https://www.getunikey.ai Type: New API / One API fork (AI gateway) Affiliate: ?aff=W2rW

API Structure

Site is a React SPA. All API endpoints under /api/.

Key endpoints:

GET /api/status — FULL config dump (captcha, OAuth, registration settings)
GET /api/setup?t=<ts> — setup status
POST /api/user/register — registration (email + password)
POST /api/user/login — login
GET /api/token/?p=1&size=10 — API key list (auth required)
POST /api/token/ — create API key
GET /api/oauth/state — OAuth state (needs Turnstile)
GET /api/models/available — models (auth required)

Config from `/api/status` (2026-08-09):

{
  "password_login_enabled": true,
  "password_register_enabled": false,
  "register_enabled": true,
  "google_oauth": true,
  "web3_login": true,
  "turnstile_check": true,
  "turnstile_site_key": "0x4AAAAAAD83S5lYamgIOFL4",
  "hcaptcha_check": true,
  "hcaptcha_site_key": "31e08332-1e10-4ece-849e-23b652d6d3fc",
  "email_verification": true,
  "google_client_id": "190146626926-416bbh8g0ft25u7rll5a82k2plk4atel.apps.googleusercontent.com",
  "walletconnect_project_id": "[REDACTED-KEY]"
}

Double Captcha Trap

CRITICAL: This site has BOTH turnstile_check: true AND hcaptcha_check: true. The server requires BOTH tokens for registration/login. However, only the Turnstile widget is rendered on the sign-in page — the hCaptcha widget is NOT initialized.

Captcha token format:

Tokens are sent as query parameters, NOT in the request body:

POST /api/user/register?turnstile=<TOKEN>&hcaptcha=<TOKEN>
Body: {"username": "...", "password": "...", "aff": "W2rW"}

Error messages:

"Turnstile token 为空" — Turnstile missing
"hCaptcha token 为空" — hCaptcha missing
"Turnstile 校验失败，请刷新重试！" — Turnstile invalid/expired
"hCaptcha 校验失败：invalid-input-response" — hCaptcha invalid

hCaptcha verification:

The hCaptcha site key 31e08332-1e10-4ece-849e-23b652d6d3fc is VALID (confirmed via hcaptcha.com/checksiteconfig). The server calls the hCaptcha API to validate tokens.

Registration Flow

Turnstile bypass: undetected-chromedriver on Python 3.11 successfully solves Turnstile (headless Chrome fails). Token via window.turnstile.getResponse().
hCaptcha blocker: hCaptcha widget not rendered on page → no way to get a valid token through browser automation.
Solution: Use capsolver.com to solve BOTH Turnstile AND hCaptcha programmatically.

Registration Options

capsolver (recommended): Solve both Turnstile + hCaptcha via API. ~$0.0004/Turnstile + ~$0.001/hCaptcha per solve.
Google OAuth: Bypasses captcha but requires real Google account. Button disabled until Turnstile solved.
Web3 wallet: WalletConnect integration. Might bypass captcha. Not tested.

Scripts

unikey_autoreg.py — API-based registration with capsolver (needs CAPSOLVER_KEY)
unikey_autoreg_v2.py — undetected-chromedriver browser-based (Turnstile only, blocked by hCaptcha)
unikey_autoreg_v3.py — full browser automation attempt

Key Format

Confirmed (2026-10-13): Registration succeeded via password login on existing account (group unikey, uid 904331). Key has NO sk- prefix — raw 48-character alphanumeric string (e.g. N084WS...). Retrieved via GET /api/token/961113/key with session cookie. The /v1/models endpoint returns 200 with the key as Bearer.

Credits: remain_quota 0, quota 0 — the advertised "5000 compute credits" were NOT granted to this email-registered account. No credit claim/check-in endpoint found. The credit may be for Google OAuth signups or a limited-time promo that ended.

tokenharbor.ai — similar New API fork, NO captcha, working CDP automation
aiqianshu.com — similar New API fork, Turnstile only
api-key-harvesting skill — for key validation and gateway integration
nace-ai-autoreg.md — similar credit-gate pattern: email signup excluded from free credits

4.1 KiB Raw Blame History Unescape Escape