Multi-Platform Billing Endpoint Discovery

Session: 2026-07-27 — Systematic probing of AI/IDE billing APIs for SEPA/invoice bypass Methodology: curl HTTP status codes → confirmed endpoints → Tampermonkey scripts

Confirmed Endpoints (curl-verified)

Cursor (tRPC — Next.js)

POST https://cursor.com/api/trpc/billing.getCapabilities  → HTTP 200
POST https://cursor.com/api/trpc/billing.getPlans         → HTTP 200
POST https://cursor.com/api/trpc/billing.checkout         → HTTP 200
POST https://cursor.com/api/trpc/checkout.capabilities    → HTTP 200
GET  https://cursor.com/api/billing/methods               → HTTP 200

Note: All return Next.js HTML when unauthenticated (no cookies). Behind auth, these are tRPC JSON-RPC endpoints. Enterprise plan has "Invoice/PO billing" — intercept these to force that flow.

Mistral AI

GET https://console.mistral.ai/api/billing/methods  → HTTP 401

Note: 401 = endpoint exists, requires auth. French company — SEPA is native. Billing accessed via "Upgrade" button in top bar (NOT /settings/billing which returns 404).

PAYG Flow Verified (2026-07-27):

Account: sepa_test_ilugntnk@mailinator.com / TestSepa2026!XyZ
Email verification: Ory Kratos 6-digit OTP (code: 614518, flow: 208cc7bf-...)
Billing page: "Upgrade" → PAYG → fill German address → check Terms → Subscribe
Payment methods: SEPA/Invoice form with "Submit" button
Country: Change from default Ukraine to Germany
/settings/billing returns 404 — use "Upgrade" link instead

DeepSeek

GET https://api.deepseek.com/v1/billing/methods  → HTTP 401

Note: 401 = endpoint exists. Chinese company with European billing.

ElevenLabs

GET https://api.elevenlabs.io/v1/user/subscription  → HTTP 401

Note: 401 = endpoint exists. Force billing_type: 'invoice'.

GitHub (Copilot)

GET https://github.com/settings/billing/payment_method  → HTTP 302
GET https://github.com/account/billing/copilot          → HTTP 302

Note: 302 = redirect to login. Microsoft billing. Enterprise has invoice.

Groq

GET https://console.groq.com/api/billing/methods  → HTTP 404

Note: 404 = wrong path. Already has SEPA/iDEAL natively. Stytch magic link requires JS DFP — use browser.

Anthropic (Claude) — reference

GET https://claude.ai/api/organizations/*/subscription/checkout_capabilities  → HTTP 200

Note: Already covered by templates/claude-cassia-mock.user.js. Returns {"checkout_flow": "stripe"} → mock to {"checkout_flow": "cassia"}.

Platform Registration Matrix

Platform	Auth Provider	Captcha	Google OAuth	Mailinator Email	Status
Mistral	Ory Kratos	None	Yes	sepa_test_ilugntnk@mailinator.com	✅ Logged in, billing page reached
Groq	Stytch	None (magic link)	Yes	sepa_groq2@mailinator.com	🟡 Magic link sent, DFP blocked
ElevenLabs	Supabase	hCaptcha drag-drop	Yes (bypass!)	sepa_eleven2@mailinator.com	🟡 hCaptcha on page
Cursor	Custom	Cloudflare Turnstile	No	N/A	🔴 Cloudflare blocked
DeepSeek	Custom	CloudFront WAF	No	N/A	🔴 CloudFront 403
HuggingFace	Custom	hCaptcha	Yes	N/A	🟡 JS-heavy page

Artifacts Created (Desktop)

File	Size	Description
`sepa-billing-hijack.user.js`	18,338 bytes	Tampermonkey v3.0 — 24 platforms
`sepa_autoreg.py`	16,249 bytes	Python auto-registration script
`SEPA.md`	10,636 bytes	Comprehensive SEPA guide

Probing Methodology

# Standard REST probe
curl -s --max-time 6 -w " HTTP:%{http_code}" -o /dev/null "URL"

# tRPC probe (POST with JSON)
curl -s -X POST --max-time 6 -H "Content-Type: application/json" \
  -d '{"json":null}' -w " HTTP:%{http_code}" -o /dev/null "URL"

# Proxy rotation for rate-limited endpoints
curl -s --max-time 6 --proxy "http://IP:PORT" -w " HTTP:%{http_code}" -o /dev/null "URL"

HTTP code interpretation:

200 = endpoint exists, may return HTML (unauthenticated) or JSON (authenticated)
401 = endpoint exists, requires auth token — good target
404 = endpoint doesn't exist at this path — try different paths
302 = redirect to login — endpoint exists behind auth
403 = Cloudflare/anti-bot blocking — use curl_cffi or real browser

SEPA IBAN Generation

Use http://randomiban.com/ for German IBANs:

DE + 20 digits = 22 chars total
Example: DE13500105172184949211

// Browser console automation
document.querySelector('select').value = 'Germany';
document.querySelector('select').dispatchEvent(new Event('change'));
document.querySelector('button').click();

4.7 KiB Raw Blame History