AICC KEY

Automated AICC (api.ai.cc) account + API key (sk-…) farmer with referral support, browser-solved Cloudflare Turnstile, CloakMail OTP, and persistent token export.


Target	https://api.ai.cc (AICC / New-API fork)
Output	OpenAI-compatible keys: `sk-…`
Base URL	`https://api.ai.cc` or `https://api.ai.cc/v1`
Default referral	`aff=pn4P` → `https://api.ai.cc/register?aff=pn4P`
Primary browser	Camoufox (Firefox stealth)
Mail	CloakMail catch-all (`@ireng.my.id` / configurable)
Language	Python 3.10+

Security notice
This repository contains tooling only. Never commit tokens.txt, accounts.jsonl, passwords, or live API keys. The included .gitignore blocks farm outputs by default.

What this does

End-to-end pipeline per account:

register?aff=CODE
    → solve Turnstile (Camoufox + explicit widget inject)
    → request email OTP (CloakMail)
    → POST /api/user/register
    → POST /api/user/login
    → list / create API token
    → export sk-<48char>
    → optional GET /v1/models health check

Proven on bare-metal / OCI aarch64 + Xvfb (2026-07-24):

Referral binding: inviter_id set when aff=pn4P
New-user quota: 50000 internal units (~$0.10 at quota_per_unit=500000)
Default token auto-created, group auto, prefix sk-
Working models on free tier (sample): deepseek-v3.2, kimi-k2.6, glm-5.2

Quick start

1. Requirements

# system
python3 --version   # 3.10+
# Xvfb recommended for headed Camoufox on servers
sudo apt-get install -y xvfb   # Debian/Ubuntu

2. Install

git clone https://github.com/<you>/AICC-KEY.git
cd AICC-KEY

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

# download Camoufox browser binary
python3 -m camoufox fetch

Optional Chromium fallback:

playwright install chromium

3. Run

# 1 account (default aff=pn4P, Camoufox, auto Xvfb headed)
python3 aicc_farm.py

# 5 accounts
python3 aicc_farm.py -n 5 --aff pn4P --delay 5 --retries 2

# with residential proxy (recommended if Turnstile rate-limits DC IPs)
python3 aicc_farm.py -n 10 --proxy 'http://user:pass@host:port'
# or host:port:user:pass
python3 aicc_farm.py -n 10 --proxy 'host:port:user:pass'

Keys land in:

./tokens.txt          # one sk-… per line
./accounts_ok.jsonl   # full success records
./accounts.jsonl      # all attempts (ok + fail)

How it works

┌─────────────┐    ┌──────────────────┐    ┌─────────────────┐
│  aicc_farm  │───▶│ Camoufox browser │───▶│ api.ai.cc SPA   │
│  (Python)   │    │ + Turnstile inject│    │ register/login  │
└──────┬──────┘    └──────────────────┘    └────────┬────────┘
       │                                            │
       │  OTP poll                                  │ REST /api/*
       ▼                                            ▼
┌──────────────────┐                       ┌─────────────────┐
│ CloakMail REST   │                       │ New-API backend │
│ email.ireng.my.id│                       │ session+token   │
└──────────────────┘                       └─────────────────┘

Multi-account isolation

For -n > 1 (or retries), each attempt runs in a fresh Python subprocess (--once mode). This avoids Camoufox/Playwright:

Error: It looks like you are using Playwright Sync API inside the asyncio loop.

High-level steps inside `farm_one()`

Launch Camoufox (or Playwright Chromium).
Open https://api.ai.cc/register?aff=<code> and force localStorage.aff.
Wait for /api/status → inject explicit Turnstile widget with sitekey from status.
Poll window.__aicc_ts_token / cf-turnstile-response.
GET /api/verification?email=…&turnstile=…
Poll CloakMail inbox; parse OTP from HTML (<strong>…</strong> or near 验证码).
POST /api/user/register?turnstile=… with aff_code.
Navigate /login, new Turnstile, POST /api/user/login?turnstile=….
GET /api/user/self → quota / inviter_id / own aff_code.
GET /api/token/?p=1&size=20 → prefix keys with sk- if missing.
Optional GET /v1/models with Authorization: Bearer sk-….

CLI reference

python3 aicc_farm.py [options]

Flag	Default	Description
`-n / --count`	`1`	Number of accounts
`--aff`	`pn4P`	Referral / invite code
`--outdir`	script dir	Where to write outputs
`--backend`	`camoufox`	`camoufox` \| `playwright`
`--headed`	auto	Force headed (Xvfb on servers)
`--headless`	off	Force headless (often fails Turnstile)
`--proxy`	—	`http://user:pass@host:port` or `host:port:user:pass`
`--delay`	`3`	Seconds between accounts
`--retries`	`2`	Extra attempts per account (3 total)
`--mail-domain`	`ireng.my.id`	Disposable mail domain
`--no-verify`	off	Skip `/v1/models` check
`--stop-on-fail`	off	Abort batch on first failure
`--no-isolate`	off	Disable per-account subprocess isolation

Internal flags (used by the parent process, do not call manually):

--once
--result-json PATH

Environment variables

Var	Purpose
`DISPLAY`	X11 display for headed mode (auto-starts Xvfb `:99` when possible)
`AICC_TURNSTILE_PATCH`	Path to optional Chromium turnstilePatch extension

Output files

`tokens.txt`

sk-EXAMPLE000000000000000000000000000000000001
sk-EXAMPLE000000000000000000000000000000000002

One key per line. Safe to feed into routers / load balancers.

`accounts_ok.jsonl`

One JSON object per successful account:

{
  "ok": true,
  "username": "uda58c7b46b",
  "password": "…",
  "email": "aicc…@ireng.my.id",
  "user_id": 77591,
  "inviter_id": 76391,
  "aff_used": "pn4P",
  "aff_code_own": "8yJ8",
  "quota": 50000,
  "tokens": [
    {
      "id": 116389,
      "name": "… Default Token",
      "key": "sk-…",
      "status": 1,
      "group": "auto",
      "unlimited_quota": true,
      "remain_quota": 500000,
      "expired_time": -1
    }
  ],
  "created_at": "2026-07-24T15:00:00Z",
  "elapsed_s": 97.94
}

`accounts.jsonl`

Same schema, includes failures (ok: false, error: "…").

See examples/sample_accounts.jsonl for a redacted sample.

Using the generated keys

cURL

export AICC_KEY='sk-…'
export AICC_BASE='https://api.ai.cc/v1'

curl "$AICC_BASE/models" -H "Authorization: Bearer $AICC_KEY"

curl "$AICC_BASE/chat/completions" \
  -H "Authorization: Bearer $AICC_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "deepseek-v3.2",
    "messages": [{"role":"user","content":"hello"}],
    "max_tokens": 64
  }'

OpenAI Python SDK

from openai import OpenAI

client = OpenAI(
    api_key="sk-…",
    base_url="https://api.ai.cc/v1",
)

r = client.chat.completions.create(
    model="deepseek-v3.2",
    messages=[{"role": "user", "content": "hello"}],
    max_tokens=64,
)
print(r.choices[0].message.content)

Official docs

Quickstart: https://docs.ai.cc/guides/quickstart
Console tokens UI: https://api.ai.cc/console/token
Pricing / models: https://api.ai.cc/pricing

Platform reverse-engineering notes

AICC is a New-API / One-API deployment:

Signal	Value
Response header	`x-oneapi-request-id`
Client header	`New-API-User: <user_id>`
Frontend	React + Semi UI SPA
Turnstile sitekey	`0x4AAAAAAD5zsonGWQ9zhvLv`
Email verification	required
OAuth (GitHub/Google/WeChat/Passkey)	disabled on public status
Session	HttpOnly cookie (not visible in `document.cookie`)
System access token	`GET /api/user/token` (different from `sk-` API keys)

Critical API map

Step	Method	Path
Status	GET	`/api/status`
Send OTP	GET	`/api/verification?email=&turnstile=`
Register	POST	`/api/user/register?turnstile=`
Login	POST	`/api/user/login?turnstile=`
Profile	GET	`/api/user/self`
Aff code	GET	`/api/user/aff`
List tokens	GET	`/api/token/?p=1&size=20`
Create token	POST	`/api/token/`
Models	GET	`/v1/models`
Chat	POST	`/v1/chat/completions`

Register body

{
  "username": "u…",
  "password": "min 8 chars",
  "password2": "…",
  "email": "…@domain",
  "verification_code": "hex or digits",
  "aff_code": "pn4P"
}

Token create body (if default missing)

{
  "name": "default",
  "remain_quota": 0,
  "expired_time": -1,
  "unlimited_quota": true,
  "model_limits_enabled": false,
  "model_limits": "",
  "allow_ips": "",
  "group": ""
}

Pitfall: model_limits must be a string, not an array. Array →
json: cannot unmarshal array into Go struct field Token.model_limits of type string

Token key format

API list returns raw 48-char keys without sk-. Clients must use:

sk- + raw_key

Turnstile strategy

Backend	Result on bare VPS (OCI)
Playwright Chromium headless	often no widget / fail
Playwright Chromium headed + inject	error `600010`
Camoufox headed + explicit inject	works (token ~666–709 chars)

Implementation:

Load sitekey from localStorage.status.turnstile_site_key (fallback constant).
Inject #aicc-ts-host + load https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit.
turnstile.render(host, { sitekey, callback }) → window.__aicc_ts_token.
Periodic reinject every ~15s; click challenge iframe if present.
Reuse token for verification / register; fresh token for login after page navigation.

Referral / credit model

Open https://api.ai.cc/register?aff=pn4P.
Frontend stores localStorage.aff = "pn4P".
Register body includes "aff_code": "pn4P".
Server sets invitee inviter_id (verified ≠ 0, e.g. 76391 for pn4P).
Invitee receives QuotaForNewUser (observed 50000).
Inviter accrues aff_count / aff_quota (admin-configured QuotaForInviter); transfer via console wallet / POST /api/user/aff_transfer.

Each new account also gets its own invite code (aff_code_own) for chaining.

Billing units:

quota_per_unit = 500000  ≈  $1.00 USD display
50000 quota            ≈  $0.10 starting balance

Troubleshooting

Symptom	Likely cause	Fix
`Turnstile not solved … err=''`	CF challenge slow / blocked	Retry (`--retries 2`), residential `--proxy`, headed mode
`err='600010'`	Chromium automation fingerprint	Use `--backend camoufox`
Sync API inside asyncio loop	Reusing browser engine in same process	Default isolation (subprocess); avoid `--no-isolate` for batches
`Turnstile token 为空`	Missing query param	Ensure inject succeeded before API calls
`Turnstile 校验失败`	Expired / fake token	Re-solve after reload; do not reuse across long delays
`验证码错误或已过期`	Wrong OTP / timeout	OTP valid ~10 min; parser must accept hex
CloakMail empty forever	Domain / SMTP delay	Check `MAIL_API` health; wait longer (`OTP_WAIT_S`)
`分组 auto 下模型 … 无可用渠道`	Model not routed for free group	Use models that return 200 (e.g. deepseek-v3.2)
`model_limits` unmarshal error	Array payload	Send `""` string
Login OK but no `sk-`	Default token race	Script creates token if list empty

More detail: docs/troubleshooting.md.

Architecture

AICC-KEY/
├── aicc_farm.py          # main CLI + farm logic
├── requirements.txt
├── LICENSE               # MIT
├── README.md             # this file
├── examples/
│   └── sample_accounts.jsonl
└── docs/
    ├── api-reference.md  # full endpoint & payload reference
    ├── architecture.md   # internal flow diagrams
    ├── turnstile.md      # captcha deep dive
    ├── cloakmail.md      # disposable mail integration
    └── troubleshooting.md

Core modules inside aicc_farm.py:

Function	Role
`launch_browser`	Camoufox / Playwright factory
`inject_turnstile` / `wait_turnstile`	Captcha
`wait_otp` / `extract_otp`	Mail
`page_api`	Same-origin `fetch` with cookies + `New-API-User`
`farm_one`	Single-account pipeline
`farm_one_subprocess`	Isolated child process
`save_result`	JSONL + tokens append

Docs index

Doc	Content
docs/api-reference.md	Every endpoint, header, body, error message
docs/architecture.md	Sequence diagrams & state machine
docs/turnstile.md	Cloudflare Turnstile reverse notes
docs/cloakmail.md	CloakMail REST usage
docs/troubleshooting.md	Failure modes & recovery

Disclaimer

Use only in accordance with AICC / api.ai.cc Terms of Service and applicable law.
Referral farming may violate platform rules; you are solely responsible for usage.
Automated account creation can trigger anti-abuse systems; prefer residential proxies and reasonable rate limits.
Authors provide this software as-is, without warranty (see LICENSE).

License

MIT

Name		Name	Last commit message	Last commit date
Latest commit History 3 Commits
docs		docs
examples		examples
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
aicc_farm.py		aicc_farm.py
requirements.txt		requirements.txt

Folders and files

Latest commit

History

Repository files navigation

AICC KEY

Table of contents

What this does

Quick start

1. Requirements

2. Install

3. Run

How it works

Multi-account isolation

High-level steps inside farm_one()

CLI reference

Environment variables

Output files

tokens.txt

accounts_ok.jsonl

accounts.jsonl

Using the generated keys

cURL

OpenAI Python SDK

Official docs

Platform reverse-engineering notes

Critical API map

Register body

Token create body (if default missing)

Token key format

Turnstile strategy

Referral / credit model

Troubleshooting

Architecture

Docs index

Disclaimer

License

About

Topics

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

High-level steps inside `farm_one()`

`tokens.txt`

`accounts_ok.jsonl`

`accounts.jsonl`