Nexotoken.net — Domain Whitelist & Turnstile Autoreg

Service: nexotoken.net (AI API gateway, ~40 models, $3/7days promo) Base API: https://www.nexotoken.net/api Auth: FingerprintJS visitorId + Cloudflare Turnstile on BOTH send-code and register

Critical: Email Domain Whitelist

Nexotoken enforces a DOMAIN WHITELIST for registration. POST /api/auth/send-code returns 400 validation_error for blocked domains:

Domain	Status	Error
t-online.de	✅ ACCEPTED	200 success
icloud.com	✅ ACCEPTED	200 success
qq.com / foxmail.com / 163.com / 126.com	✅ ACCEPTED	(listed in error as examples)
gmail.com	❌ BLOCKED	"Google 邮箱请使用 Google 快捷登录，暂不支持邮件验证码注册"
voidash.bond	❌ BLOCKED	"当前平台仅支持主流邮箱域名注册"
outlook.com	❌ BLOCKED	same whitelist error
hotmail.com	❌ BLOCKED	same whitelist error

Decision: use t-online.de pool (C:/Users/User/Desktop/avtoreg/working_mails.txt) with IMAP at secureimap.t-online.de:993.

Probe new domains: solve 1 Turnstile via sidecar, call send-code, read the error.

Registration Flow (HTTP-only)

Turnstile: sitekey 0x4AAAAAADkmZg-ZC-lJ2DRw, page https://www.nexotoken.net/register
- Sidecar: POST http://127.0.0.1:8877/solve {"type":"turnstile","url":"...","sitekey":"...","real_page":true}
Send-code: POST /api/auth/send-code {email, turnstileToken, fingerprint, acq: null}
- fingerprint = FingerprintJS visitorId (32-char hex; server may validate — use random hex, not static)
- Response: {success:true, data:{registrationSession:"..."}}
OTP: read 6-digit code from email (IMAP: filter by "nexotoken" keyword)
Register: POST /api/auth/register {username, email, password, displayName, verificationCode, registrationSession, turnstileToken, fingerprint}
- Requires FRESH Turnstile token (the one from send-code may be consumed)
- Response: {success:true, data:{token:"...", user:{...}}}
Token: Bearer token from register response → stored in localStorage as token
Balance: GET /api/user/balance (auth required)
API keys: probe /api/keys, /api/user/keys, /api/api-keys

Endpoints Discovered

/api/auth/send-code — send verification code
/api/auth/register — complete registration
/api/auth/login — login (username + password + turnstile)
/api/auth/verify — verify session
/api/user/balance — credit balance
/api/user/stats — usage stats
/api/models/featured — featured models
/api/models/providers — provider list
/api/public/model-status — public model status

Turnstile Double Requirement

Both send-code AND register require valid Turnstile tokens — the same token cannot be reused. Obtain a fresh token for each step.

Base URL

https://www.nexotoken.net/api — all paths are relative to this base. The request helper prepends /api to all paths.

3.0 KiB Raw Blame History