autoreg-skills-max/skills/github-oauth-automation/references/gorouter-registration.md

gorouter.app Registration

Updated 2026-07-30. Sign-up via GitHub OAuth. $70 signup bonus. Tor SOCKS5 for Cloudflare bypass.

URL

• Sign-in (use for first-time OAuth): https://gorouter.app/sign-in
• Sign-up: https://gorouter.app/sign-up?aff=6lhB — GitHub OAuth from here silently redirects back to sign-in for new accounts
• API Keys: /dashboard/keys
• Dashboard: /dashboard/overview

Flow

1. Navigate to https://gorouter.app/sign-in
2. Click "GitHub" → OAuth flow → login + 2FA → authorize → dashboard
3. Balance ~$70 auto-credited
4. Navigate to keys page via sidebar click (SPA routing — DO NOT use page.goto)
5. API key page: https://gorouter.app/keys

CRITICAL: API Key Masking

gorouter masks keys in ALL API responses — GET, POST, everything. The full key is NEVER returned by the API. Even POST /api/token/ (create) returns a masked key in the response.

The only way to get the full key is:

1. During creation: the UI toast/modal shows the full key exactly once. Click the copy button and read from clipboard.
2. Clipboard extraction: click the masked key button in the table → key is copied to clipboard → read with navigator.clipboard.readText().

Do NOT rely on API response interception for full keys — every endpoint returns sk-Yt0p**********Fg4C pattern.

API response structure (all keys masked):

{
  "data": {
    "page": 1,
    "page_size": 20,
    "total": 2,
    "items": [
      {"id": 5471, "key": "Yt0p**********Fg4C", "name": "key-Chunkuot-1", "status": 1, ...}
    ]
  },
  "success": true,
  "message": "success"
}

Cloudflare Bypass: Tor SOCKS5

tor.exe --SOCKSPort 9050 --ControlPort 9051 --DataDirectory /tmp/tor_data

Verify: curl -s --socks5 localhost:9050 https://gorouter.app/sign-in | wc -c (0 = dead)

Playwright: browser.new_context(proxy={"server": "socks5://127.0.0.1:9050"})

Circuit cycling: ControlPort 9051 → AUTHENTICATE\r\n → SIGNAL NEWNYM\r\n

SPA Routing (Next.js)

gorouter uses client-side routing — page.goto("/dashboard/keys") stays on /dashboard/overview. Navigate by clicking sidebar links:

# CORRECT: click sidebar link
link = page.locator("a:has-text('Ключи API')").first
await link.click()
# URL becomes https://gorouter.app/keys

# WRONG: page.goto does nothing
await page.goto("https://gorouter.app/dashboard/keys")
# URL stays https://gorouter.app/dashboard/overview

Fallback: page.evaluate("window.location.href = '/dashboard/keys'") triggers a full page reload.

Playwright Click Interception

Overlay divs (<form>, <div data-slot="sheet-portal">) intercept Playwright .click(). Escalation chain:

1. page.locator("button:has-text('Submit')").click() — fails, intercepted
2. page.evaluate("() => { document.querySelector('button').click() }") — works
3. page.keyboard.press("Enter") — works for form submissions

Always try JS clicks before timing out on intercepted Playwright clicks.

API Key Endpoint

Correct: POST /api/token/ body {"name": "k"}

• Response: {"data":{"key":"sk-Yt0p**********Fg4C","id":5471,...}} — KEY IS MASKED
• List: GET /api/token/?p=1&size=10 — all keys masked

Wrong: POST /api/user/keys → "Invalid URL", POST /api/keys → {key:null}

Browser Tool vs Local Playwright

Hermes browser tool (Browserbase): Often shows empty pages for gorouter — Cloudflare detection is aggressive on Browserbase IPs. Use only for quick inspection, not mass automation.

Local Playwright: Works reliably. Chrome must be visible (headless=False). IP may get rate-limited after ~5-10 OAuth flows.

New Account Rejection

Fresh GitHub accounts silently rejected. After OAuth, gorouter redirects to /sign-in (no error). Only previously-registered accounts work.

Account Format

email:password:[REDACTED] — field is seed_2fa(NOT2fa_seed). RAR v5: rarfile+UnRAR.exe`.

Endpoints

• API: https://gorouter.app/v1/chat/completions — Authorization: Bearer <key>
• Status: GET /api/status
• Playground: /playground (session cookie)

Downtime

• 2026-07-29: CF 521 (backend down)
• 2026-07-30: CF WAF block — resolved via Tor