vlad/autoreg-skills-max

Fork 0

Files

baradok60915d52e8425 f58eafeb48 autoreg-skills-max: initial public release (restored, redacted, hardened)

2026-10-20 02:16:32 +03:00

6.4 KiB

Raw Blame History

name, description, category, tags, triggers

name

description

Google Cloud Identity Free — Mass Account Farm

Create Google Cloud Identity Free accounts (50 users, no Gmail, OAuth-enabled) on custom domains.

Architecture

Cloud Identity Free = 50 users, no Gmail, no cost
Google Workspace = paid, includes Gmail
SA Key = Service Account JSON for Directory API
Domain-Wide Delegation = SA key impersonates admin

Setup

1. Get a domain

Real domain (.xyz $1, .com $10) — Google accepts for new signups
Free subdomain (.loc.cc, .rr.kg) — Google BLOCKS for new Workspace signups, but can be added as secondary domains to existing Workspace

2. Create Cloud Identity account

Go to https://workspace.google.com/business/signup → Business Starter trial → cancel after 14 days → converts to Cloud Identity Free.

3. SA Key + Domain-Wide Delegation

Google Cloud Console → Service Account → JSON key
Admin Console → Security → API Controls → Domain-Wide Delegation
Add SA client ID with scopes:
- https://www.googleapis.com/auth/admin.directory.user
- https://www.googleapis.com/auth/admin.directory.domain
- https://www.googleapis.com/auth/admin.directory.domain.readonly

API Operations

Add domains to Workspace

from google.oauth2 import service_account
from googleapiclient.discovery import build

creds = service_account.Credentials.from_service_account_file(
    'sa_key.json',
    scopes=['https://www.googleapis.com/auth/admin.directory.domain'],
    subject='admin@domain.com'
)
admin = build('admin', 'directory_v1', credentials=creds)
admin.domains().insert(customer='my_customer', body={'domainName': 'new.loc.cc'}).execute()

Create users

creds = service_account.Credentials.from_service_account_file(
    'sa_key.json',
    scopes=['https://www.googleapis.com/auth/admin.directory.user'],
    subject='admin@domain.com'
)
admin = build('admin', 'directory_v1', credentials=creds)
admin.users().insert(body={
    'primaryEmail': 'user@domain.com',
    'password': 'Password123!',
    'name': {'givenName': 'User', 'familyName': 'Name'},
    'changePasswordAtNextLogin': False,
    'recoveryPhone': '+380XXXXXXXXX',  # Optional — helps skip SMS
}).execute()

List users by domain

result = admin.users().list(customer='my_customer', domain='domain.com', maxResults=500).execute()

Delete users

admin.users().delete(userKey='user@domain.com').execute()

Domain Verification

New domains require TXT record verification. Google provides: google-site-verification=XXXXX

Get code from Admin Console → Domains → Verify
Add TXT record to DNS: name=@, type=TXT, value=google-site-verification=XXXXX
Click Verify in Admin Console

The verification code CANNOT be retrieved via Directory API — only through Admin Console UI.

Limits & Anti-Abuse

Limit	Value
Cloud Identity Free users	50 (can drop to 35+)
Users per creation batch	1-3 (rate limited)
Delay between creations	0.5-2 seconds

412 Error: "potentially abusive behavior"

Triggered by: mass creation (>5 in quick succession), mass deletion, rapid create-delete cycles. Symptoms: All user creation blocked, error: conditionNotMet Recovery: Wait 24-48 hours. No workaround. Contact Google Support if urgent.

Prevention

Create users slowly (1 per 2-3 seconds)
Don't delete and recreate in bulk
Spread creations across multiple days
Max 5-10 users per session

Recovery Phone

Adding recoveryPhone to users helps skip SMS verification on first login:

'recoveryPhone': '+380XXXXXXXXX',
'recoveryEmail': 'backup@gmail.com'

Using accounts as OAuth identities for third-party SaaS (verified 2026-09-10)

Cloud Identity users (non-gmail, e.g. *@reforrm.me) pass Google OAuth on third-party apps — verified end-to-end on indent.com (WorkOS AuthKit): email → password → Google consent → landed in app as signed-in user. Apps requiring only userinfo.email/userinfo.profile scopes accept Workspace-domain accounts; no gmail needed.

CDP flow pattern (Chrome --remote-debugging-port=9222 --remote-allow-origins=*):

Open app signup, click "Continue with Google" → redirects to accounts.google.com/v3/signin/identifier.
Fill #identifierId via native-setter + input event, click Next → password page (input[name=Passwd]).
After password, the consent screen opens in a NEW TAB (/signin/oauth/id) — re-enumerate http://127.0.0.1:9222/json and connect a websocket to that tab, then click "Продолжить"/"Continue" there. Managed accounts also spawn a chrome://managed-user-profile-notice/ tab — ignore it.
App tab lands on onboarding.

Known blocker class: apps with PostHog/anti-bot fingerprinting may accept the OAuth login but flag the first in-app action (e.g. indent.com workspace creation → "flagged as potential bot activity"). CDP automation is detected at that step. If the goal is only account creation (not in-app org setup), the OAuth flow itself works. For flagged apps: fresh residential IP, humanized delays, or non-CDP browser (pyautogui, see windows-browser-automation skill).

Value check before farming: verify the target actually exposes an API/benefit (docs, JS bundle grep for /v1/, api key, model names). Some promo posts ("GPT-6 Astra, $100 credits") point to products with no external API at all — recon first, farm second.

Pitfalls

Domain scope dies: 403 after ~100 domain additions. Re-auth in Admin Console.
412 anti-abuse: Mass create/delete triggers permanent-ish block. Slow down.
Unverified domains: Users can only be created on VERIFIED domains (404 otherwise).
Browser required: Domain verification needs Admin Console UI (no API).
Headless detection: Google blocks headless browsers for signup. Use real browser.
.loc.cc blocked: Google rejects .loc.cc for new Workspace signups at final step.
Secondary domain limit: Cloud Identity allows unlimited secondary domains, but user limit is TOTAL across all.

6.4 KiB Raw Blame History