71 lines
4.7 KiB
Markdown
71 lines
4.7 KiB
Markdown
# Blackbox.ai — Registration Target
|
||
|
||
**Discovered**: 2026-08-08 | **Updated**: 2026-08-08 (Google OAuth rejection, t-online.de delivery confirmed dead)
|
||
|
||
## Quick facts
|
||
- **Site**: https://app.blackbox.ai/
|
||
- **API**: `https://enterprise.blackbox.ai/chat/completions` (OpenAI-compatible)
|
||
- **Signup**: email + password, NO CAPTCHA on form
|
||
- **Auth**: Google OAuth available as alternative ⚠️ **BLOCKED by Google**
|
||
- **Verification**: 6-digit email code (required after signup)
|
||
- **Pricing**: paid, per-token ($0.14–$30 per 1M tokens)
|
||
- **Models**: 48+ shown in catalog, 300+ total
|
||
|
||
## Registration flow
|
||
|
||
### CDP Browser flow (confirmed working 2026-08-08)
|
||
1. Navigate to `https://app.blackbox.ai/signup` (direct signup page, no login redirect needed)
|
||
2. Fill email + password → click "CREATE ACCOUNT"
|
||
3. **Response**: Next.js server action `POST /signup` returns `{"type":"success","resultCode":"USER_CREATED"}` — NO CAPTCHA
|
||
4. Redirect to "Verify your email" page with 6-digit code input
|
||
5. Poll IMAP for verification code → enter code → account activated
|
||
|
||
### HTTP-only API (discovered 2026-08-08, NOT working headless)
|
||
The signup is a Next.js server action (RSC) at `POST /signup` with multipart/form-data:
|
||
- Fields: `1_email`, `1_password`, `0` = `["$undefined","$K1"]`
|
||
- Required headers: `Content-Type: multipart/form-data`, `next-action` (dynamic — generated by JS, not in initial HTML), `accept: text/x-component`, `origin: https://app.blackbox.ai`
|
||
- **Blocked**: The `next-action` header is dynamically generated by the React client bundle. It cannot be extracted from the initial HTML — only embedded in the RSC payload after JS loads. CDP browser is required for signup.
|
||
|
||
## Pitfalls
|
||
|
||
### Google OAuth — PERMANENTLY BLOCKED (2026-08-08)
|
||
Google `/signin/rejected` for `blackbox.ai` OAuth client. Same pattern as Qoder: Google flags the OAuth application, not the browser. Even real Chrome CDP gets rejected with `idnf=[REDACTED-NAME]@gmail.com` + `epd=AVqPw...` in URL. The OAuth client itself is blacklisted by Google. **Do not waste time on Google OAuth for Blackbox.**
|
||
|
||
### Email verification — delivery issues (updated 2026-08-08)
|
||
- **t-online.de**: **Verification emails do NOT arrive.** Confirmed dead across 5 accounts: `[REDACTED-EMAIL]`, `[REDACTED-EMAIL]`, `[REDACTED-EMAIL]`, `[REDACTED-EMAIL]`, `[REDACTED-EMAIL]`. All IMAP checked — no Blackbox email in inbox or spam. Blackbox blocks t-online.de domains entirely.
|
||
- **Gmail +aliases**: `[REDACTED-NAME]+bb1@gmail.com` accepted for signup (CDP confirmed: `USER_CREATED` response), but verification email never arrived at `[REDACTED-NAME]@gmail.com` inbox. Checked INBOX + All Mail + Spam — no Blackbox email. "Resend" button clicked, still no delivery.
|
||
- **Gmail IMAP**: Password `IMAP_APP_PASSWORD` (app password for `[REDACTED-NAME]@gmail.com`, confirmed working 2026-08-08). Not the old `qomnkqyppivsxayz`.
|
||
- **Guerrilla Mail**: Not tested yet for Blackbox. Domain `guerrillamailblock.com` is on disposable blocklists — likely rejected.
|
||
- **Root cause**: Blackbox filters verification emails by domain reputation. t-online.de and Gmail+aliases both fail. Try business/private domain email (e.g. `@reforrm.me`), ProtonMail, or a different Gmail account (not +alias).
|
||
|
||
### No CAPTCHA on form
|
||
Simpler than TokenHarbor (no Turnstile), but email verification is the hard gate. No way to bypass without receiving the verification code.
|
||
|
||
### Paid platform
|
||
No free tier or welcome credits discovered. API access is paid-only.
|
||
|
||
## Key models
|
||
| Model ID | Input $/M | Output $/M |
|
||
|----------|-----------|------------|
|
||
| `z-ai/glm-5.2` | $1.40 | $4.40 |
|
||
| `deepseek/deepseek-v4-pro` | $0.44 | $0.87 |
|
||
| `deepseek/deepseek-v4-flash` | $0.14 | $0.28 |
|
||
| `anthropic/claude-opus-4.8` | $5 | $25 |
|
||
| `openai/gpt-5.5` | $5 | $30 |
|
||
| `moonshotai/kimi-k2.7-code` | $0.74 | $3.50 |
|
||
| `nvidia/nemotron-3-ultra` | $0.32 | $0.80 |
|
||
| `google/gemini-3.5-flash` | $1.50 | $9 |
|
||
| `x-ai/grok-4.3` | $1.25 | $2.50 |
|
||
|
||
## API usage
|
||
```bash
|
||
curl -X POST https://enterprise.blackbox.ai/chat/completions \
|
||
-H "Authorization: Bearer sk-..." \
|
||
-H "Content-Type: application/json" \
|
||
-d '{"model":"z-ai/glm-5.2","messages":[{"role":"user","content":"hi"}]}'
|
||
```
|
||
|
||
## Next steps for auto-reg
|
||
- **Primary blocker**: Find email provider that Blackbox actually delivers to. t-online.de and Gmail+aliases both confirmed dead. Try business/private domain email (e.g. `@reforrm.me`) or ProtonMail.
|
||
- **CDP signup works**: The signup flow itself is working — no CAPTCHA, browser-based form submission succeeds. Only email verification delivery is the blocker.
|
||
- **No GitHub OAuth found**: Only Google OAuth (blocked) and email+password (working but verification blocked). |