vlad/autoreg-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
f58eafeb48979991591e8b4c53ff7b2c015091a7
autoreg-skills-max/skills/bulk-account-registration/references/chatgpt-tonline-registration.md

4.8 KiB
Raw Blame History

ChatGPT t-online.de Registration Pattern (2026-07-09)

Working Flow

  1. Playwright opens chatgpt.com/signup with real Chrome profile (CF cookies already present)
  2. page.route("**/auth.openai.com/**", handler) intercepts all XHR to auth.openai.com
  3. Handler skips GET (page navigations), proxies POST/PUT/PATCH through curl_cffi(impersonate="chrome124")
  4. Fill email (t-online.de address), click submit
  5. IMAP poll (secureimap.t-online.de:993) for OTP from last 10 minutes
  6. Fill OTP, verify via proxied API call
  7. .de domains skip about-you — response directly contains continue_url callback
  8. If about-you appears: fill form via JS, click submit via Playwright btn.click() (NOT evaluate)
  9. Route handler captures callback URL from create_account response
  10. Navigate to callback URL → session established
  11. GET chatgpt.com/api/auth/session → extract accessToken

Key Details

  • IMAP: secureimap.t-online.de:993, login with full email + password
  • Date filter: Only accept emails < 600 seconds old (10 min window)
  • Code extraction: Last 6-digit code from body, check for "openai" OR "chatgpt" in body
  • Button click: await btn.click() (Playwright native), NOT page.evaluate("btn.click()")
  • Callback capture: Global variable set by route handler, consumed by main flow
  • Session endpoint: https://chatgpt.com/api/auth/session returns {"accessToken": "eyJ..."}
  • Token format: JWT, lives 1-30 days, ~40-80 requests/3h per account for GPT-4o

Pitfalls

  • Gmail aliases get rate-limited: After ~20-30 registrations, OpenAI stops sending OTP to user+alias@gmail.com. Switch to t-online.de.

  • Wrong code from old emails: IMAP returns all emails to the address. Date filter is mandatory.

  • create_account returns 400 user_already_exists: Account already fully created. Try login flow instead.

  • Cloudflare on API endpoints: XHR/fetch calls from browser get 403. Must proxy through curl_cffi.

  • page.route() intercepts navigations: Always skip GET requests, only handle POST/PUT/PATCH.

  • CSS color codes in HTML emails match \b(\d{6})\b regex: OpenAI verification emails are HTML-only. The body contains CSS hex colors like #202123 and #353740 which are 6-digit numbers. The regex \b(\d{6})\b matches both the OTP code AND CSS colors. Fix: strip HTML tags (re.sub(r'<[^>]+>', ' ', body)) AND strip CSS hex colors (re.sub(r'#[0-9a-fA-F]{6}', ' ', body)) before extracting codes. Without this, the first extracted code is a CSS color, not the OTP.

  • IMAP SEARCH requires SELECT first: Calling mail.search() immediately after mail.login() without mail.select("INBOX") returns command SEARCH illegal in state AUTH. Always call mail.select("INBOX") before any search/fetch operations.

  • Scanning all messages on empty before_ids: When get_current_ids returns empty (first run, error), wait_for_code iterates through ALL messages in the inbox. For accounts with 1000+ emails, this takes 3+ minutes and never finds the code. Fix: limit to last 50 messages: sorted(new_ids, key=int, reverse=True)[:50].

  • \b in regex becomes backspace (0x08) in Python source files: When writing regex patterns to Python files programmatically, \b in a regular string is interpreted as backspace (ASCII 0x08). The resulting file has r'\x08(\d{6})\x08' instead of r'\b(\d{6})\b'. Fix: use raw strings (r'\b') in the source code, or use bytes([0x5c, 0x62]) to write the literal \b bytes. Verify with repr() — \b should show as \\b, not \x08.

  • Protocol registration skips about-you for .de domains: t-online.de emails skip the about-you form entirely. The OTP verification response directly contains continue_url callback. This makes .de domains ~2x faster than Gmail for registration.

  • code= redirect detection via page TITLE (2026-07-30): After OTP submission, OpenAI sometimes redirects via meta-refresh or JS navigation where the page TITLE changes to the target URL (e.g., "Loading https://chatgpt.com/api/auth/callback/openai?code=ac...") while the browser URL STAYS on email-verification. The title check must include:

    ("code=" in page_title and "chatgpt.com" in page_title)

    Without this, the code thinks the page didn't change, tries clicking "Continue", and fails with "验证码页未找到 Continue 按钮". The code= token in the title means OTP was ACCEPTED and the redirect is happening — no button click needed.

Email Sources

  • C:\Users\User\Desktop\Downloads_backup_01.07.2026\working_mails_RECOVERED.txt — 9767 t-online.de accounts
  • C:\Users\User\Desktop\EzSolver\pateway_accounts_v9.txt — 6 t-online.de accounts (may need IMAP enabled)
  • Format: `[REDACTED-EMAIL]:[REDACTED], one per line