ClickUp Registration — Full Reverse Engineering (2026-07-02, updated 2026-08-09)

API Endpoints

Endpoint	Method	Purpose
`https://id.app.clickup.com/user/v1/user`	POST	Register new account
`https://id.app.clickup.com/verification/v1/email?email=...`	GET	Check if email is taken
`https://id.app.clickup.com/login/v1/login`	POST	Login (404 on direct call — browser-only)
`https://app.clickup.com/signup`	GET	Signup page (Angular SPA)
`https://app.clickup.com/settings/apps`	GET	API key generation page

Registration Payload

POST https://id.app.clickup.com/user/v1/user
{
    "username": "...",
    "email": "...",
    "password": "...",
    "recaptchaV3Token": "<token>",
    "timezone": "Europe/Moscow",
    "signupSource": "web"
}

reCAPTCHA Enterprise v3 — Two Sitekeys (2026-08-09 update)

ClickUp использует ДВА разных sitekey:

Signup page (app.clickup.com): 6Lf6D0YoAAAAAEgVBxwLwC_gxFaDBPyYZX19ocU1
- В iframe: src*="recaptcha/enterprise/anchor?k=6Lf6D0Yo..."
- Доступен через grecaptcha.enterprise.execute(widgetId)
- Токен с этого sitekey НЕ принимается API id.app.clickup.com
Auth domain (id.app.clickup.com): 6LfM4UUoAAAAAPMJ8udCVQ8_oHhRbL4HbCMIIxsb
- Используется для API-запросов
- grecaptcha.enterprise.execute(sitekey, {action:'signup'}) — токен тоже отклонён

Что FAILED (8 подходов, все возвращают RECAP_001/003)

2captcha userrecaptcha (min_score=0.1-0.9, enterprise=1): token solved but rejected
ShardX anti-detect browser: RECAP_003
Real Chrome GUI: RECAP_003
Real Chrome CDP: RECAP_003
Patchright: RECAP_003
nodriver: RECAP_003
Browser-generated token (grecaptcha.enterprise.execute): RECAP_001
Token from page's widget (widgetId=100000 on signup page): RECAP_001

Root Cause

reCAPTCHA Enterprise v3 is IP-reputation-gated. Datacenter IPs auto-rejected regardless of browser fingerprint quality or token validity. The RECAP_001/003 error is returned by ClickUp's backend after Google's reCAPTCHA verification fails.

Angular Form Structure

Signup page — Angular SPA (_ngcontent-ng-c..., cu3button, cu3-type attributes). Форма сабмитится через Angular event system, не через нативный form.submit(). Прямой fetch() к API тоже отклонён.

Google OAuth — тоже заблокирован

Google OAuth через CDP возвращает /signin/rejected с idnf=<email> и epd=<code>. Google детектит automation даже в real Chrome (CDP-режим).

Email Check Response

GET https://id.app.clickup.com/verification/v1/email?email=user@gmail.com
{
    "email_taken": false,
    "domain_is_owned": false,
    "skipCaptcha": false,
    "google_sso": false,
    "policies": []
}

API Token Format

Format: pk_<digits>_<32 uppercase alnum>
Auth header: Authorization: pk_...
Never expires
Generated at: https://app.clickup.com/settings/apps

MCP Server

Built at C:\Users\User\clickup_mcp_server.py (15 tools, 481 lines). Raw stdio JSON-RPC, zero dependencies. Requires CLICKUP_API_TOKEN env var.

Files Created

C:\Users\User\clickup_mcp_server.py — 15-tool MCP server
C:\Users\User\clickup_autoreg.py — 2captcha-based API registration
C:\Users\User\clickup_reverse.py — reverse proxy (20143) for api.clickup.com
C:\Users\User\clickup_nodriver_signup.py — nodriver-based signup (unfinished)

3.6 KiB Raw Blame History Unescape Escape