122 lines
6.3 KiB
Markdown
122 lines
6.3 KiB
Markdown
# auto-openai-account — Setup & Deployment
|
|
|
|
**Repo:** `https://github.com/79E/auto-openai-account`
|
|
**Local path:** `C:/Users/User/Desktop/_PROJECTS/auto-openai-account/`
|
|
**Tech:** Go 1.25+ backend + React/Vite/Tailwind frontend, SQLite storage
|
|
|
|
## What It Does
|
|
|
|
Open-source OpenAI/ChatGPT account automation console. Treat it as a codebase to inspect, build, or repurpose for legitimate account-management research — **do not run or debug mass ChatGPT/OpenAI signup, captcha/anti-abuse bypass, or web-session token extraction workflows.** If the user asks for bulk account creation or a token pool from newly created ChatGPT web accounts, apply `chatgpt-web-token-boundaries.md` and pivot to a compliant key-pool/proxy backed by legitimate API keys.
|
|
|
|
Capabilities present in the repo:
|
|
- **Registration**: `register`, `register_login`, `register_codex` (unsafe to operate for bulk signup/token-pool requests)
|
|
- **Login**: `login`, `codex_login` (only appropriate for accounts the user legitimately owns and manages)
|
|
- **Mailbox management**: import mailbox credentials with IMAP for OTP reading
|
|
- **SMS providers**: hero-sms.com, smsbower.app for phone verification
|
|
- **Proxy pool**: HTTP/HTTPS/SOCKS5 with random/round-robin modes
|
|
- **Token export**: `GET /api/register-jobs/{id}/tokens` returns JSON with tokens for completed jobs
|
|
- **Web UI**: React dashboard at `/`, real-time SSE logs
|
|
|
|
## Build
|
|
|
|
```bash
|
|
cd C:/Users/User/Desktop/_PROJECTS/auto-openai-account
|
|
|
|
# Backend
|
|
go build -o auto-openai-account.exe ./apps/server
|
|
|
|
# Frontend (must be in repo root for embedded dist/)
|
|
cd apps/web && npm install && npm run build
|
|
cd ../.. # back to repo root
|
|
```
|
|
|
|
## Run
|
|
|
|
```bash
|
|
# Default port 8080, override with env var:
|
|
AUTO_OPENAI_ACCOUNT_LISTEN=:8088 ./auto-openai-account.exe
|
|
```
|
|
|
|
## Key API Endpoints
|
|
|
|
| Endpoint | Method | Description |
|
|
|---|---|---|
|
|
| `/api/health` | GET | `{"ok":true,"service":"auto-openai-account"}` |
|
|
| `/api/settings` | GET/PUT | Proxy, IMAP, SMS, password config |
|
|
| `/api/mailboxes/import` | POST | Import `email----password` lines |
|
|
| `/api/register-jobs` | POST | Start registration: `{"count":1,"flow":"register_codex","sms_config_id":"..."}` |
|
|
| `/api/register-jobs/{id}/tokens` | GET | Export tokens for completed job |
|
|
| `/api/stats` | GET | Dashboard counts |
|
|
|
|
## Registration Flows
|
|
|
|
These flows exist in the codebase, but **do not operate them for bulk ChatGPT/OpenAI account creation or token-pool generation**. Use this information only for code review, local product analysis, or legitimate single-account/account-owner workflows.
|
|
|
|
- `register` — register only, no token. No SMS needed.
|
|
- `register_login` — register → normal login → token exchange. No SMS needed. Returns OAuth token fields when the upstream flow succeeds.
|
|
- `register_codex` — register → login → Codex OAuth. Requires SMS for phone verification.
|
|
|
|
## Login Flows (for existing user-owned accounts only)
|
|
|
|
- `login` — standard login → token exchange. No SMS needed.
|
|
- `codex_login` — Codex OAuth with PKCE. Requires SMS for phone verification.
|
|
|
|
## SMS Dependency Matrix
|
|
|
|
| Flow | Needs SMS? | Gets Tokens? |
|
|
|---|---|---|
|
|
| `register` | ❌ No | ❌ No |
|
|
| `register_login` | ❌ No | ✅ Yes |
|
|
| `register_codex` | ✅ Yes | ✅ Yes |
|
|
| `login` | ❌ No | ✅ Yes |
|
|
| `codex_login` | ✅ Yes | ✅ Yes |
|
|
|
|
Use this matrix to understand the code and to choose legitimate account-owner login flows. Do **not** present `register_login` as a way to build a bulk token pool; for token pooling, pivot to a compliant API-key pool with keys the user already owns.
|
|
|
|
## Codex OAuth Details
|
|
|
|
- Client ID: `app_EMoamEEZ73f0CkXaXp7hrann`
|
|
- Redirect: `http://localhost:1455/auth/callback`
|
|
- Scopes: `openid profile email offline_access api.connectors.read api.connectors.invoke`
|
|
- PKCE: SHA-256 challenge, 96-byte verifier
|
|
- Tokens returned: `access_token`, `refresh_token`, `id_token`, `token_type`, `expires_in`
|
|
|
|
## Requirements to Run
|
|
|
|
1. **Mailboxes** — only use mailboxes/accounts the user legitimately owns or administers.
|
|
- Format: `email----password` or `email----password----client_id----access_token`
|
|
- Import via API or UI
|
|
- Default Outlook/Hotmail IMAP: `outlook.office365.com:993`, auth mode `auto`
|
|
- t-online.de IMAP observed in this repo setup: `secureimap.t-online.de:993`, auth mode `password`
|
|
2. **SMS provider** — needed for `register_codex` / `codex_login` flows.
|
|
- hero-sms.com or smsbower.app API key
|
|
3. **Proxy** — supported by the tool, but proxy rotation for evading signup/risk controls is not a permitted assistance path. For safe local testing, configure proxies only to test the product plumbing or route traffic in a controlled environment.
|
|
|
|
## Default Settings
|
|
|
|
- Password mode: `random` (auto-generates 16-char passwords)
|
|
- Fixed password: [REDACTED] (used when password_mode=fixed)
|
|
- IMAP: `outlook.office365.com:993`, auth mode: `auto`
|
|
- Concurrency: 1 (increase for multi-mailbox registration)
|
|
- OTP timeout: 180s, poll interval: 5s
|
|
|
|
## Confirmed Working (2026-07-10)
|
|
|
|
- Server builds and runs on Windows with Go 1.25+
|
|
- UI accessible at `http://localhost:8080` when launched from repo root with `dist/` present
|
|
- API endpoints are rooted at `/api/*` (not `/api/v1/*`); `/api/register-jobs` and `/api/mailboxes` redirect/404 if the wrong prefix is used
|
|
- Fresh DB has 0 mailboxes — ready for legitimate import/testing
|
|
- `PUT /api/settings` accepts `proxy_groups`, IMAP settings, password mode, concurrency, and SMS config JSON
|
|
|
|
## Observed Upstream Failure Pattern
|
|
|
|
- With a large imported `t-online.de` mailbox pool and `secureimap.t-online.de:993`, OTP retrieval could progress for at least one mailbox, but OpenAI account creation returned `registration_disallowed` after OTP validation: `Sorry, we cannot create your account with the given information.`
|
|
- Treat this as an upstream risk/anti-abuse decision, not as a bug to bypass. Do not keep tuning proxies, fingerprints, mailbox domains, or signup steps to evade it. Stop and pivot to legitimate API-key pooling or account-owner login flows.
|
|
|
|
## Pitfalls
|
|
|
|
- Port 8080 is often occupied by SearXNG or other local services — use `AUTO_OPENAI_ACCOUNT_LISTEN`
|
|
- Vite builds to repo root `dist/`, server expects `dist/` in working directory
|
|
- Go 1.25+ required (check with `go version`)
|
|
- Frontend must be rebuilt after any TSX changes
|
|
- SQLite DB lives in `data/register.db` — don't delete |