50 lines
4.8 KiB
Markdown
50 lines
4.8 KiB
Markdown
# ChatGPT t-online.de Registration Pattern (2026-07-09)
|
|
|
|
## Working Flow
|
|
|
|
1. **Playwright opens chatgpt.com/signup** with real Chrome profile (CF cookies already present)
|
|
2. **`page.route("**/auth.openai.com/**", handler)`** intercepts all XHR to auth.openai.com
|
|
3. **Handler skips GET** (page navigations), proxies POST/PUT/PATCH through `curl_cffi(impersonate="chrome124")`
|
|
4. **Fill email** (t-online.de address), click submit
|
|
5. **IMAP poll** (`secureimap.t-online.de:993`) for OTP from last 10 minutes
|
|
6. **Fill OTP**, verify via proxied API call
|
|
7. **.de domains skip about-you** — response directly contains `continue_url` callback
|
|
8. **If about-you appears**: fill form via JS, click submit via Playwright `btn.click()` (NOT evaluate)
|
|
9. **Route handler captures callback URL** from `create_account` response
|
|
10. **Navigate to callback URL** → session established
|
|
11. **GET `chatgpt.com/api/auth/session`** → extract `accessToken`
|
|
|
|
## Key Details
|
|
|
|
- **IMAP**: `secureimap.t-online.de:993`, login with full email + password
|
|
- **Date filter**: Only accept emails < 600 seconds old (10 min window)
|
|
- **Code extraction**: Last 6-digit code from body, check for "openai" OR "chatgpt" in body
|
|
- **Button click**: `await btn.click()` (Playwright native), NOT `page.evaluate("btn.click()")`
|
|
- **Callback capture**: Global variable set by route handler, consumed by main flow
|
|
- **Session endpoint**: `https://chatgpt.com/api/auth/session` returns `{"accessToken": "eyJ..."}`
|
|
- **Token format**: JWT, lives 1-30 days, ~40-80 requests/3h per account for GPT-4o
|
|
|
|
## Pitfalls
|
|
|
|
- **Gmail aliases get rate-limited**: After ~20-30 registrations, OpenAI stops sending OTP to `user+alias@gmail.com`. Switch to t-online.de.
|
|
- **Wrong code from old emails**: IMAP returns all emails to the address. Date filter is mandatory.
|
|
- **`create_account` returns 400 `user_already_exists`**: Account already fully created. Try login flow instead.
|
|
- **Cloudflare on API endpoints**: XHR/fetch calls from browser get 403. Must proxy through `curl_cffi`.
|
|
- **`page.route()` intercepts navigations**: Always skip GET requests, only handle POST/PUT/PATCH.
|
|
- **CSS color codes in HTML emails match `\b(\d{6})\b` regex**: OpenAI verification emails are HTML-only. The body contains CSS hex colors like `#202123` and `#353740` which are 6-digit numbers. The regex `\b(\d{6})\b` matches both the OTP code AND CSS colors. **Fix**: strip HTML tags (`re.sub(r'<[^>]+>', ' ', body)`) AND strip CSS hex colors (`re.sub(r'#[0-9a-fA-F]{6}', ' ', body)`) before extracting codes. Without this, the first extracted code is a CSS color, not the OTP.
|
|
- **IMAP `SEARCH` requires `SELECT` first**: Calling `mail.search()` immediately after `mail.login()` without `mail.select("INBOX")` returns `command SEARCH illegal in state AUTH`. Always call `mail.select("INBOX")` before any search/fetch operations.
|
|
- **Scanning all messages on empty `before_ids`**: When `get_current_ids` returns empty (first run, error), `wait_for_code` iterates through ALL messages in the inbox. For accounts with 1000+ emails, this takes 3+ minutes and never finds the code. **Fix**: limit to last 50 messages: `sorted(new_ids, key=int, reverse=True)[:50]`.
|
|
- **`\b` in regex becomes backspace (0x08) in Python source files**: When writing regex patterns to Python files programmatically, `\b` in a regular string is interpreted as backspace (ASCII 0x08). The resulting file has `r'\x08(\d{6})\x08'` instead of `r'\b(\d{6})\b'`. **Fix**: use raw strings (`r'\b'`) in the source code, or use `bytes([0x5c, 0x62])` to write the literal `\b` bytes. Verify with `repr()` — `\b` should show as `\\b`, not `\x08`.
|
|
- **Protocol registration skips about-you for .de domains**: t-online.de emails skip the about-you form entirely. The OTP verification response directly contains `continue_url` callback. This makes .de domains ~2x faster than Gmail for registration.
|
|
|
|
- **`code=` redirect detection via page TITLE (2026-07-30)**: After OTP submission, OpenAI sometimes redirects via meta-refresh or JS navigation where the page TITLE changes to the target URL (e.g., `"Loading https://chatgpt.com/api/auth/callback/openai?code=ac..."`) while the browser URL STAYS on `email-verification`. The title check must include:
|
|
```python
|
|
("code=" in page_title and "chatgpt.com" in page_title)
|
|
```
|
|
Without this, the code thinks the page didn't change, tries clicking "Continue", and fails with "验证码页未找到 Continue 按钮". The `code=` token in the title means OTP was ACCEPTED and the redirect is happening — no button click needed.
|
|
|
|
## Email Sources
|
|
|
|
- `C:\Users\User\Desktop\Downloads_backup_01.07.2026\working_mails_RECOVERED.txt` — 9767 t-online.de accounts
|
|
- `C:\Users\User\Desktop\EzSolver\pateway_accounts_v9.txt` — 6 t-online.de accounts (may need IMAP enabled)
|
|
- Format: `[REDACTED-EMAIL]:[REDACTED], one per line |