autoreg-skills-max/skills/ai-provider-autoreg/references/hero-sms-protocol-autoreg.md

hero-sms.com (partners.hero-sms.com) — protocol autoreg + SPA cookie-auth pattern

Status 2026-10-12: full reg flow WORKS (register 200 → email → password set → login 200). BUSINESS VERDICT: signup gives $0 balance (GET /internal/user/balances → {"data":{"usd":0}}) — keys are useless without top-up (~$3.6/number). Do NOT farm hero-sms for free SMS; only reuse if the account already has credit.

Generalizable pattern: SPA protocol autoreg with httpOnly-cookie auth

Applies to any Vite/React SPA panel behind Cloudflare Turnstile where external HTTP fails:

1. Reverse the API from INSIDE the page — external fetches get 403 (CF), in-page fetch() of the JS bundle chunks does not. List chunks via [...document.querySelectorAll('script[src]')], fetch the index chunk, regex lazy-chunk names, fetch each and grep for /api/, /internal/, endpoint literals. Guessing chunk hashes fails — always extract real names from the index bundle at runtime.
2. Drive the API with in-page fetch(..., {credentials:'include'}) via frame.evaluate(async...) — inherits CF clearance and cookies. Never replay from Python requests against the same endpoints (CF 403/1010).
3. Auth token may live ONLY in an httpOnly cookie. If the login 200 body is just {status, needTwoFA, message} — do NOT hunt for JWTs in body/localStorage; the next in-page fetch with credentials:'include' is already authenticated. Verify by calling a cheap authed endpoint (balances) instead of declaring login-fail.
4. Turnstile: camoufox solves it natively — just poll input[name=cf-turnstile-response] value (up to ~180s, it is flaky run-to-run). Fallback: captcha sidecar on :8877 (POST /solve {type:'turnstile', sitekey, url, real_page:true}), inject returned token into the hidden input, then read it back. Sitekey comes from .cf-turnstile[data-sitekey] in DOM.
5. Password-policy gotcha: create-password pages silently keep the Submit button disabled when the password violates policy (min 8 chars, upper+lower+digit+special from !@#$%^&+.?*). Always generate policy-compliant passwords and poll button .disabled before/while clicking — a None click result means validation, not a missing selector.
6. Fill password inputs with real keyboard (page.click(sel) + keyboard.type), not JS value injection — React controlled components ignore dispatchEvent-only fills.
7. Confirmation email can be delayed >5 min on some runs (t-online). If reg succeeded but no mail: keep the pending account in the bank — the create-token from the email link stays valid across runs, so a recovery pass can finish password+login for old tokens later (resend endpoint POST /internal/auth/mail-confirmation exists but payload shape unresolved — 422 on {email:...}).

hero-sms protocol map (partners-api.hero-sms.com)

• Base: https://partners-api.hero-sms.com, headers Content-Type: application/json, lang: ru
• POST /internal/registration {type: 2, email, cf-turnstile-response} → 200 {status:success} (type 2 = Protocol; enum from types chunk)
• Email from Hero SMS → link https://partners.hero-sms.com/auth/create/<token>?lang=ru = create-password page (NOT a separate confirm step). Regex the link from IMAP HTML body.
• Create-password page: 2 visible input[type=password] (password + repeat), Submit button text Создать.
• POST /internal/auth/confirm-password with {token, password} variants → 422 (payload shape unresolved) — UI submit is the working path.
• POST /internal/partner/auth/login {email, password, cf-turnstile-response} → 200 {status:success, needTwoFA:false} + httpOnly cookie. Fresh turnstile token required per login.
• GET /internal/user/balances (cookie) → {data:{usd:N}}
• GET /internal/user/api-key → 405 Method Not Allowed on GET; key retrieval via dashboard UI (profile → key eye-toggle), not resolved headlessly.
• GET /internal/user → 404.

Scripts + bank

• Working scripts: C:/Users/User/tmp/hero_reg9.py (full flow), hero_recover2.py (cookie login → balances). Bank: tmp/hero_reg_accounts.jsonl (email/password/mail_pass per record; latest record per email wins).
• Mail pool: Desktop/avtoreg/working_mails.txt t-online canonical addresses (dash-aliases dead for delivery), used-list tmp/hero_reg_used.txt.
• Run: PYTHONPATH="" Python311/python.exe hero_reg9.py (~5-8 min/account: turnstile waits dominate).
• 2 live accounts banked: [REDACTED-EMAIL], [REDACTED-EMAIL] (balance $0).