Make an HTTP request with simple retry on network errors. Returns (response, error_string). error_string is empty on success.

Normalize a proxy URL for curl_cffi. - Strips whitespace - Converts socks:// to socks5h:// (remote DNS resolution) - Returns empty string

Request a sentinel token from OpenAI's PoW service. Args: session: curl_cffi Session instance device_id: Device UUID flow

Load registered accounts from JSON file.

Load and validate config from a YAML file. Merges with defaults so missing keys get sensible values.

Browser navigation headers (text/html accept, no content-type).

Save accounts to JSON file (atomic write).

Configure Python logging based on config + CLI verbosity.

Standard Cloudflare retry pattern. Tries the request; if Cloudflare-challenged, refreshes clearance and retries once. Raises Registra

Detect if a response is a Cloudflare challenge page.

Load pool state from disk (email_lower → {state, reason, updated_at}).

Inject clearance cookies and User-Agent into a curl_cffi session.

Generate a PKCE code_verifier and its S256 code_challenge. Returns: (code_verifier, code_challenge) — both base64url-encoded with

JSON API request headers with referer + oai-device-id + Datadog traces.

Decode a base64url-encoded string (with padding restored).

Cache access_token for 10 min to avoid rate limits during polling.

Extract 6-digit verification code from email content.

Normalize mail config for provider construction.

Create a content-based tracking reference for deduplication.

Build the credentials dict for a single sub2api account entry. Args: account: Account record with keys: email, password, acce

Create a curl_cffi Session with proxy and optional Cloudflare clearance. Args: proxy: SOCKS5/HTTP proxy URL flaresolverr_url: Fla

Decode the payload (middle segment) of a JWT without verification. Returns an empty dict on any decode error — the caller should handle missi

Extract account info from an OpenAI access token or id_token JWT. Returns a flat dict with keys matching sub2api credentials schema: email,

Request clearance from FlareSolverr for target_url. Returns a ClearanceBundle on success, None on failure.

Update pool state after registration attempt. - Success → mark as 'used' - Token invalid → mark as 'token_invalid' - Other failure → mark

Re-login to get a team-scoped access token. 1. Run OAuth authorize as login (not signup) 2. Enter password 3. Handle OTP 4. Navigate

Refresh Cloudflare clearance and apply to session. Returns True if clearance was successfully refreshed.

Stage 4: Export accounts as sub2api JSON. Uses team-scoped tokens (team_access_token) when available, falls back to personal tokens.

Stage 2: Join each account to the K12 parent workspace. Modifies account records in-place with join status.

Stage 1: Register N ChatGPT accounts. Returns list of newly registered account records.

Cache a clearance bundle.

Wait for verification code from Outlook mailbox.

Extract exp from JWT or compute fallback (now + ~10 days).

Merge overlay into base in-place, recursively.

Check if this email is available for use.

Exchange authorization code for tokens after login flow completes. After the login + workspace selection flow, the session should have been r

Handle OTP during login flow.

Submit password during login flow. The password verification endpoint may vary. We try the standard Auth0 password verification API at /api/a

Generate Datadog APM trace headers (expected by OpenAI's backend).

Check if message arrived before the code boundary timestamp.

Try to get initial Cloudflare clearance for auth.openai.com.

Release in_use state back to unused.

Select the team workspace during login flow. After OTP verification, accounts with multiple workspaces will be presented with a workspace pic

Ensure an id_token JWT contains chatgpt_account_id and account_id in its https://api.openai.com/auth claim. If either is missing, a compatibi

Build a single sub2api account entry from an account record.

Build kwargs for constructing a curl_cffi requests.Session. Args: proxy: SOCKS5/HTTP proxy URL impersonate: TLS fingerprint targe

Build a complete sub2api bundle from a list of account records. Args: accounts: List of account dicts (from registration or login) R

Create a mailbox from the Outlook token pool.

Export accounts as sub2api bundle JSON. Args: accounts: List of account records output_path: Path to write. If None, auto-generat

Write the default config.yaml to disk. Returns the path written.

Get a cached clearance bundle for the target host + proxy combo.

Check if this clearance is still fresh for the given target.

Send a single workspace join request. Args: access_token: The account's Bearer token workspace_id: Parent workspace UUID

Join multiple workspaces sequentially. Args: access_token: The account's Bearer token workspace_ids: List of parent workspace UUI

Parse outlook token pool text. Format: email----password----client_id----refresh_token (one per line)

Run the complete registration flow. Returns: {email, password, access_token, refresh_token, id_token, source_type, c

Release in_use state back to unused (if registration is abandoned).

Run the complete pipeline: register → join → re-login → export. Args: config: Full config dict from config.yaml count: Override r

Stage 3: Re-login each account with Team space selection. Gets team-scoped tokens for accounts that successfully joined. NOTE: This step requ