vlad/autoreg-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
209e142d443042a2d86342c948d06a76c09eb696
autoreg-skills-max/skills/ai-provider-autoreg/references/vetta-usenaive-autoreg.md

3.4 KiB
Raw Blame History

vetta (app.usenaive.ai) — autoreg + API flow

Relixir, Inc. AI gateway. Supabase auth backend, Stripe trial billing, OpenAI-compatible proxy at api.vetta.sh.

Verified registration flow (no captcha)

  1. Email: mail.tm API (emailondeck gives nothing useful). Any mail.tm domain works.
  2. Register: POST https://app.usenaive.ai/register, form-encoded {email, password, confirm} → 200 HTML (no captcha, no JSON API).
  3. Verify: poll mail.tm /messages; the Supabase verify link is inside the message html/text fields — these can be lists, join before regexing. GET <verify_url> → 303 = verified.
  4. Login: POST /login form-encoded {email, password} → sets vetta_session cookie; redirects /onboarding.
  5. API key: POST https://app.usenaive.ai/api/v1/api_keys with session cookie, JSON body {"name": "main"} → returns the key. Enumerate the private REST surface by grepping downloaded assets/*.js for "/api/ string literals — most guesses 404, the real route is api_keys (underscore).
  6. Usage: Base https://api.vetta.sh/v1; chat endpoint https://api.vetta.sh/v1/proxy/openai/v1/chat/completions; Authorization: Bearer <key>. api.vetta.sh is behind Cloudflare — plain urllib gets 1010; full browser headers (UA + Sec-Fetch-* + Origin) pass.
  7. Status probe: GET https://app.usenaive.ai/api/v1/credits/subscription with session cookie → {trial_eligible, balance, org_status}.

Trial activation — BLOCKED for generated cards

POST /api/v1/credits/subscription {"plan":"standard"} returns a Stripe checkout URL (merchant "Relixir, Inc.", 7-day trial). Then:

  • Stripe hosted checkout shows hCaptcha Enterprise (sitekey ec637546-e9b8-447a-ab81-b5fb6d228ab8, rqdata in iframe URL). Checkbox clicks and 2captcha token injection from a different IP both fail (IP mismatch). Solver traffic must egress the same residential IP as the camoufox checkout.
  • Even past captcha, BIN-553890200018 generated cards fail the $0 trial auth with 402 requires_action / use_stripe_sdk / rqdata — issuer forces 3DS (see payment-hitter SKILL.md "requires_action" section). Only checker-Live (charge-verified) cards from chkr.cc have a chance, and chkr free quota is daily-IP-capped.

Decision rule: don't re-attempt this target's trial with Luhn/generated cards or PaymentMethod-LIVE cards; resume only with charge-verified Live cards AND a same-IP hCaptcha solution (2captcha HCaptchaTask with matching proxy), or via browser session reuse on a clean residential IP.

Reusable artifacts from this target

  • Frontend REST-surface enumeration: download assets/entry.client-*.js + queries-*.js, grep "/api/ and mutation names — works for any SPA whose API routes are not in the HTML.
  • Stripe card pre-check via POST api.stripe.com/v1/payment_methods with the checkout's publishable key (pk_live_... from the page): validates number/CVV/exp and returns real brand + funding — catches dead BINs before the browser run.
  • Camoufox Stripe-form filling: select billingCountry → "US" FIRST (IP geoloc defaults the country and breaks zip/state validation), fill email before card fields, filter the literal label text "REQUIRED" out of error detection (it is a field label, not an error).
  • Luhn for a 15-digit BIN prefix: compute the check digit with alternating-doubling starting from the LAST digit of the prefix (a0=True convention) — the naive variant produces numbers Stripe rejects as "card number is invalid".