92 lines
3.6 KiB
Markdown
92 lines
3.6 KiB
Markdown
# ClickUp Registration — Full Reverse Engineering (2026-07-02, updated 2026-08-09)
|
||
|
||
## API Endpoints
|
||
|
||
| Endpoint | Method | Purpose |
|
||
|----------|--------|---------|
|
||
| `https://id.app.clickup.com/user/v1/user` | POST | Register new account |
|
||
| `https://id.app.clickup.com/verification/v1/email?email=...` | GET | Check if email is taken |
|
||
| `https://id.app.clickup.com/login/v1/login` | POST | Login (404 on direct call — browser-only) |
|
||
| `https://app.clickup.com/signup` | GET | Signup page (Angular SPA) |
|
||
| `https://app.clickup.com/settings/apps` | GET | API key generation page |
|
||
|
||
## Registration Payload
|
||
|
||
```json
|
||
POST https://id.app.clickup.com/user/v1/user
|
||
{
|
||
"username": "...",
|
||
"email": "...",
|
||
"password": "...",
|
||
"recaptchaV3Token": "<token>",
|
||
"timezone": "Europe/Moscow",
|
||
"signupSource": "web"
|
||
}
|
||
```
|
||
|
||
## reCAPTCHA Enterprise v3 — Two Sitekeys (2026-08-09 update)
|
||
|
||
ClickUp использует ДВА разных sitekey:
|
||
|
||
1. **Signup page** (`app.clickup.com`): `6Lf6D0YoAAAAAEgVBxwLwC_gxFaDBPyYZX19ocU1`
|
||
- В iframe: `src*="recaptcha/enterprise/anchor?k=6Lf6D0Yo..."`
|
||
- Доступен через `grecaptcha.enterprise.execute(widgetId)`
|
||
- Токен с этого sitekey НЕ принимается API `id.app.clickup.com`
|
||
|
||
2. **Auth domain** (`id.app.clickup.com`): `6LfM4UUoAAAAAPMJ8udCVQ8_oHhRbL4HbCMIIxsb`
|
||
- Используется для API-запросов
|
||
- `grecaptcha.enterprise.execute(sitekey, {action:'signup'})` — токен тоже отклонён
|
||
|
||
### Что FAILED (8 подходов, все возвращают RECAP_001/003)
|
||
|
||
1. **2captcha `userrecaptcha`** (min_score=0.1-0.9, enterprise=1): token solved but rejected
|
||
2. **ShardX anti-detect browser**: RECAP_003
|
||
3. **Real Chrome GUI**: RECAP_003
|
||
4. **Real Chrome CDP**: RECAP_003
|
||
5. **Patchright**: RECAP_003
|
||
6. **nodriver**: RECAP_003
|
||
7. **Browser-generated token** (grecaptcha.enterprise.execute): RECAP_001
|
||
8. **Token from page's widget** (widgetId=100000 on signup page): RECAP_001
|
||
|
||
### Root Cause
|
||
|
||
reCAPTCHA Enterprise v3 is **IP-reputation-gated**. Datacenter IPs auto-rejected regardless of browser fingerprint quality or token validity. The `RECAP_001/003` error is returned by ClickUp's backend after Google's reCAPTCHA verification fails.
|
||
|
||
### Angular Form Structure
|
||
|
||
Signup page — Angular SPA (`_ngcontent-ng-c...`, `cu3button`, `cu3-type` attributes). Форма сабмитится через Angular event system, не через нативный `form.submit()`. Прямой `fetch()` к API тоже отклонён.
|
||
|
||
### Google OAuth — тоже заблокирован
|
||
|
||
Google OAuth через CDP возвращает `/signin/rejected` с `idnf=<email>` и `epd=<code>`. Google детектит automation даже в real Chrome (CDP-режим).
|
||
|
||
## Email Check Response
|
||
|
||
```json
|
||
GET https://id.app.clickup.com/verification/v1/email?email=user@gmail.com
|
||
{
|
||
"email_taken": false,
|
||
"domain_is_owned": false,
|
||
"skipCaptcha": false,
|
||
"google_sso": false,
|
||
"policies": []
|
||
}
|
||
```
|
||
|
||
## API Token Format
|
||
|
||
- Format: `pk_<digits>_<32 uppercase alnum>`
|
||
- Auth header: `Authorization: pk_...`
|
||
- Never expires
|
||
- Generated at: https://app.clickup.com/settings/apps
|
||
|
||
## MCP Server
|
||
|
||
Built at `C:\Users\User\clickup_mcp_server.py` (15 tools, 481 lines). Raw stdio JSON-RPC, zero dependencies. Requires `CLICKUP_API_TOKEN` env var.
|
||
|
||
## Files Created
|
||
|
||
- `C:\Users\User\clickup_mcp_server.py` — 15-tool MCP server
|
||
- `C:\Users\User\clickup_autoreg.py` — 2captcha-based API registration
|
||
- `C:\Users\User\clickup_reverse.py` — reverse proxy (20143) for api.clickup.com
|
||
- `C:\Users\User\clickup_nodriver_signup.py` — nodriver-based signup (unfinished) |