89 lines
4.1 KiB
Markdown
89 lines
4.1 KiB
Markdown
# UNIKEY.AI (getunikey.ai) — New API Fork Analysis
|
||
|
||
**Date:** 2026-08-09
|
||
**Site:** https://www.getunikey.ai
|
||
**Type:** New API / One API fork (AI gateway)
|
||
**Affiliate:** `?aff=W2rW`
|
||
|
||
## API Structure
|
||
|
||
Site is a React SPA. All API endpoints under `/api/`.
|
||
|
||
### Key endpoints:
|
||
- `GET /api/status` — FULL config dump (captcha, OAuth, registration settings)
|
||
- `GET /api/setup?t=<ts>` — setup status
|
||
- `POST /api/user/register` — registration (email + password)
|
||
- `POST /api/user/login` — login
|
||
- `GET /api/token/?p=1&size=10` — API key list (auth required)
|
||
- `POST /api/token/` — create API key
|
||
- `GET /api/oauth/state` — OAuth state (needs Turnstile)
|
||
- `GET /api/models/available` — models (auth required)
|
||
|
||
### Config from `/api/status` (2026-08-09):
|
||
```json
|
||
{
|
||
"password_login_enabled": true,
|
||
"password_register_enabled": false,
|
||
"register_enabled": true,
|
||
"google_oauth": true,
|
||
"web3_login": true,
|
||
"turnstile_check": true,
|
||
"turnstile_site_key": "0x4AAAAAAD83S5lYamgIOFL4",
|
||
"hcaptcha_check": true,
|
||
"hcaptcha_site_key": "31e08332-1e10-4ece-849e-23b652d6d3fc",
|
||
"email_verification": true,
|
||
"google_client_id": "190146626926-416bbh8g0ft25u7rll5a82k2plk4atel.apps.googleusercontent.com",
|
||
"walletconnect_project_id": "[REDACTED-KEY]"
|
||
}
|
||
```
|
||
|
||
## Double Captcha Trap
|
||
|
||
**CRITICAL:** This site has BOTH `turnstile_check: true` AND `hcaptcha_check: true`. The server requires BOTH tokens for registration/login. However, only the Turnstile widget is rendered on the sign-in page — the hCaptcha widget is NOT initialized.
|
||
|
||
### Captcha token format:
|
||
Tokens are sent as **query parameters**, NOT in the request body:
|
||
```bash
|
||
POST /api/user/register?turnstile=<TOKEN>&hcaptcha=<TOKEN>
|
||
Body: {"username": "...", "password": "...", "aff": "W2rW"}
|
||
```
|
||
|
||
### Error messages:
|
||
- `"Turnstile token 为空"` — Turnstile missing
|
||
- `"hCaptcha token 为空"` — hCaptcha missing
|
||
- `"Turnstile 校验失败，请刷新重试！"` — Turnstile invalid/expired
|
||
- `"hCaptcha 校验失败：invalid-input-response"` — hCaptcha invalid
|
||
|
||
### hCaptcha verification:
|
||
The hCaptcha site key `31e08332-1e10-4ece-849e-23b652d6d3fc` is VALID (confirmed via `hcaptcha.com/checksiteconfig`). The server calls the hCaptcha API to validate tokens.
|
||
|
||
## Registration Flow
|
||
|
||
1. **Turnstile bypass**: `undetected-chromedriver` on Python 3.11 successfully solves Turnstile (headless Chrome fails). Token via `window.turnstile.getResponse()`.
|
||
2. **hCaptcha blocker**: hCaptcha widget not rendered on page → no way to get a valid token through browser automation.
|
||
3. **Solution**: Use capsolver.com to solve BOTH Turnstile AND hCaptcha programmatically.
|
||
|
||
## Registration Options
|
||
|
||
1. **capsolver** (recommended): Solve both Turnstile + hCaptcha via API. ~$0.0004/Turnstile + ~$0.001/hCaptcha per solve.
|
||
2. **Google OAuth**: Bypasses captcha but requires real Google account. Button disabled until Turnstile solved.
|
||
3. **Web3 wallet**: WalletConnect integration. Might bypass captcha. Not tested.
|
||
|
||
## Scripts
|
||
|
||
- `unikey_autoreg.py` — API-based registration with capsolver (needs `CAPSOLVER_KEY`)
|
||
- `unikey_autoreg_v2.py` — undetected-chromedriver browser-based (Turnstile only, blocked by hCaptcha)
|
||
- `unikey_autoreg_v3.py` — full browser automation attempt
|
||
|
||
## Key Format
|
||
|
||
**Confirmed (2026-10-13):** Registration succeeded via password login on existing account (group `unikey`, uid 904331). Key has NO `sk-` prefix — raw 48-character alphanumeric string (e.g. `N084WS...`). Retrieved via `GET /api/token/961113/key` with session cookie. The `/v1/models` endpoint returns 200 with the key as Bearer.
|
||
|
||
**Credits:** remain_quota 0, quota 0 — the advertised "5000 compute credits" were NOT granted to this email-registered account. No credit claim/check-in endpoint found. The credit may be for Google OAuth signups or a limited-time promo that ended.
|
||
|
||
## Related
|
||
|
||
- `tokenharbor.ai` — similar New API fork, NO captcha, working CDP automation
|
||
- `aiqianshu.com` — similar New API fork, Turnstile only
|
||
- `api-key-harvesting` skill — for key validation and gateway integration
|
||
- `nace-ai-autoreg.md` — similar credit-gate pattern: email signup excluded from free credits |