29 lines
3.2 KiB
Markdown
29 lines
3.2 KiB
Markdown
# MODA farm — Clerk signup + per-domain promo gate (2026-10-10)
|
|
|
|
Target: moda.app, promo CLAUDEFOUNDERS (90d Pro, 6000 cr/mo). Full API reverse: skill `saas-recon` → `references/moda-app-recon-2026-10-10.md`.
|
|
|
|
## Working signup flow (per account, fresh browser context each)
|
|
|
|
1. Open `https://moda.app/?auth_intent=signup` in cloakbrowser (CF-gated; wait out the challenge) — the signup modal renders on the homepage. `/sign-up` returns a 404 page and Clerk's env `signUpUrl` (`/sign-in?mode=signup`) renders sign-IN only; do not conclude "registration is closed" from those — probe the live homepage modal (`#sign-up-email` present + `window.Clerk.client.signUp`) before declaring signup dead.
|
|
2. Solve invisible Turnstile sitekey `0x4AAAAAAAFV93qQdS0ycilX` with **action `signup`** (sidecar `:8877` or 2captcha `method=turnstile`). Token must be action-bound — wrong/missing action → Clerk `captcha_invalid`.
|
|
3. In-page Clerk client: `signUp.create({emailAddress, password, captchaToken, unsafeMetadata:{referral_code}})`.
|
|
4. `signUp.prepareEmailAddressVerification({strategy:'email_code'})`, read code from inbox, `signUp.attemptVerification({code, strategy:'email_code'})` — strategy field is MANDATORY.
|
|
5. `setActive({session: createdSessionId})` → `session.getToken({skipCache:true})` → `POST api.moda.app/api/v1/users/me/sync` → org id.
|
|
6. `POST /api/v1/organizations/{org}/billing/redeem-promo` body `{"code":"CLAUDEFOUNDERS"}` (field `code`, not `promo_code`).
|
|
|
|
## The domain gate (farm-limiting constraint)
|
|
|
|
- Redeem on consumer mail → 403 `promo_requires_work_email`. Second account on the same email domain → `promo_domain_already_claimed`. **One claim per DOMAIN** — aliases don't help; each account needs its own domain.
|
|
- Temp-mail domains: voidash.bond worked for the first claim; several other voidash/eu.cc domains are rejected by Clerk as temp mail. Unreliable pool.
|
|
- **Durable path: own free domains with catch-all** — nodeloc `nl8.eu` (root_domain_id 2, is_free, no coupon) + MX/TXT forwardemail records via nodeloc DNS API; every alias forwards to one Gmail, matched by `To:` header. Verified E2E (MODA verification mail landed <1 min). Recipe: skill `free-domain-registration` §Catch-all inbox.
|
|
- nodeloc default account quota = 2 domains; invite rewards raise it. Mass domains = mass nodeloc accounts (Gmail +alias registration) or another registry.
|
|
|
|
## Pitfalls
|
|
|
|
- `captcha_invalid` on EVERY fresh sidecar token across retries = solver-side degradation or Clerk-side tightening; re-rolling new emails per attempt just burns inboxes. Stop, switch solver (2captcha), or wait.
|
|
- Fresh browser context per account — shared context carries Clerk session/org into the next signup (accounts silently share one org).
|
|
- JWT expires fast; cookie dumps often restore `sessions: 0`. Fresh-token path: in-page password signIn (`client.signIn.create` + `attemptFirstFactor({password, strategy:'password'})`).
|
|
- `window.Clerk.signIn(...)` does not exist — use `window.Clerk.client.signIn.create(...)`.
|
|
- Rate limit on `reset_password_email_code`: ~4 min between attempts per account.
|
|
- Files: farm scripts at C:/Users/User/tmp/moda-farm/ (accounts.jsonl sensitive — never print values).
|