GrokRegister

Registration Console

Task Control

Access Token

Run Mode

Workers

Batch Size

Additional Target

Risk Threshold

Help

How to run and troubleshoot

Prepare Environment

Make sure the Camoufox engine is installed, an email service is available, and the CPA auth directory is writable. No extra proxy is needed when direct connection works.

Choose a Mode

Continuous Orchestration runs multiple rounds toward the additional target; Single Batch runs only the batch size. Start with 2-3 workers.

Save and Start

Enter the current panel token, save settings, then start. Additional Target is how many accounts to add beyond the current CPA count.

Review Results

Focus on the success rate by period, the Quality Test, and the log tail. Prefer residential exits and Outlook mailboxes; do not force domain mailboxes or keep raising concurrency.

Stopping a task ends the current orchestration and batch processes. Resetting the blacklist restores baseline rules; it does not erase all risk decisions.

16 items

Access token mismatch or 401

Re-enter the current panel token and save. The token is only stored in this browser's localStorage; re-enter it after changing port, device, or browser.

Task ends immediately after starting

Usually the CPA already reached the old target. Increase "Additional Target" and start again; continuous orchestration adds N beyond the current CPA baseline, while single batch runs only "Batch Size".

policy=deny or registration risk control

grok.com's botFlag / policy can no longer reliably detect risk control. The registration gate no longer skips OAuth based on it. To confirm whether an account can chat or is degraded, use "Quality Test" in the top bar with home proxies. Prefer home exits and Outlook mailboxes; do not use domain mail as the primary path; keep concurrency at 2-3 first.

What is bfs, and how does it differ from botFlagSource?

bfs is a risk claim inside the xAI access_token / SSO JWT: if the field appears in the payload the account is flagged (common value 2). It is independent of grok.com's botFlagSource / policy=deny. It is auto-detected after token exchange; you can also scan the CPA directory via "BFS check" in the console, exporting log/bfs_flagged.jsonl. Set bfs_skip_cpa to skip ingestion, bfs_disable_cpa to write disabled.

Is SSO risk control still usable?

No longer usable as a verdict. grok.com's botFlagSource / policy=deny is unreliable, and registration no longer blocks OAuth based on it. The old scan panel is kept for reference only. Use "Quality Test" instead.

How to batch-test accounts for degradation

On-ingest short test is off by default; enable quality_probe_on_register to short-test when writing CPA / Grok2API (short prompt, stops at thinking). Existing accounts can be re-tested in bulk via "Quality Test" in the top bar. Missing thinking or excessive Token/s is marked degraded; 401/403 / permission-denied is marked risk. CLI: python scripts/check_quality.py --dir cpa_auth --from-config config.json. Redacted results go to log/quality_degraded.jsonl and log/quality_risk.jsonl.

Registration stuck at captcha, profile page, or browser launch

First confirm the exact stage from the failure classification and log tail. On repeated browser launch failures, lower concurrency and check that camoufox fetch was run; profile page failures may also be an unresolved Turnstile.

No new CPA, or invalid_grant / 503

Check cpa_auto_add, the auth directory, the remote CPA address, and the admin key. invalid_grant Access denied means the OAuth exchange was rejected; 503 means CPA currently has no available xAI auth.

Model call returns permission-denied

Common cause: the token is missing referrer=grok-build, or base_url points to api.x.ai. Regenerate using the project's Authorization Code + PKCE flow and point it at the Build channel.

Cannot resolve exit IP, or proxy traffic usage is high

First test whether the proxy port is usable. Residential proxies may meter both upstream and downstream; per-GB yield has no fixed value. Lower concurrency and avoid repeated failed retries. Chained proxies should be configured in the proxy client.

Email API returns 401 or times out

For 401, check the email service's key and auth_mode. On workers.dev timeouts, fill the proxy explicitly in config instead of relying on HTTP_PROXY env vars the desktop process may not inherit.

How to configure an email service

Prefer home exits + real mailboxes like Outlook; do not use domain mail as the primary path. Open "Email Services" in the top bar, prefer Outlook RT, fill the jsonl (email + refresh_token), then save and test. Other temp-mail or self-owned domains are fallback only; domain rotation stays in the advanced settings on the same page but is easily rejected.

What does the blacklist do, and can it be cleared?

The blacklist avoids exit ASNs that keep triggering risk control. The panel's "Reset" restores the baseline rules; don't clear everything if you're unsure of the impact. Repeated hits usually mean the exit quality needs tuning.

How to import existing accounts text into CPA or sub2api

The console's "Account recovery" handles the pending queue and can scan all accounts text; accounts that already have CPA are skipped, and successful items are removed from the pending queue. The panel does not import sub2api directly; convert it to the target system's data structure.

Registered but search or a model is unavailable

Registration success does not mean all upstream capabilities are open. Confirm requests go through the Grok Build channel; search and specific model availability may still vary by account status and upstream policy.

How much trial quota, and what to do on 429

Trial quota is allocated per account upstream; the panel cannot infer the exact balance. 429 usually means quota exhausted or rate limited; wait for recovery or switch to auth that still has quota.

External Proxy Pool

Credentials stay local; the exit does not change during registration.

Waiting to load

Total

Available

Unhealthy

Cooldown

Undetected

Proxy addresses (one per line)

Supports http, https, socks5, socks5h, and host:port:user:password. Proxies are tested right after import; only healthy and enabled proxies are assigned to new accounts.

Proxy details

Not started

Status	Proxy endpoint	Exit / ASN	Latency	Recent status	Enabled	Actions
Loading proxy pool...

Mail source

Email Services

Loading current email provider configuration

Service Configuration

Not read yet

Domain rotation Advanced settings 0 domains

Count failures only when xAI explicitly rejects a domain Waiting to load

Total

Rotating

Standby

Blocked

Disabled

Domains or subdomains (one per line)

Email provider

Reject threshold

Active per provider

Cloudflare, CloudMail, MoeMail and YYDS can bind self-owned domains; 0 means no limit on active domains.

Domain details

No domains imported

Status	Domain	Provider	Rejects	Recent status	Enabled	Actions
Loading email domain rotation

Account state

SSO Risk

Disabled: grok.com botFlag / policy is no longer a risk signal. Use Quality Test instead.

Not scanned

Total

Clean

Flagged

deny

Failure

Progress

SSO list (one per line)

Interval (s)

Proxy (optional)

Deprecated. This scan only compares historical fields and cannot tell whether an account can chat or is degraded.

Scan details

Waiting to start

Email	bot	policy	risk	event	Verdict	Note
Paste SSO or select a source to start scanning

Chat quality

Quality Test

Registration probe is off by default. Test existing auth with a short prompt and stop after thinking.

Not scanned

Total

Healthy

Degraded

Risk

Failure

Progress

Concurrency

Interval (s)

Proxy (empty = home pool)

Max items (0 = recent 2000)

Scans cpa_auth, defaulting to the most recent 200 items. Click "Start test" and watch the progress on this page; don't set 0 expecting to sweep the whole library in one go.

Scan details

Waiting to start

Email	Verdict	TPS	thinking	tokens	Duration	Note
Select an auth directory to start testing

Success Rate by Period

register_results.jsonl

Current Batch

Account Recovery

Waiting for check

Quality Test

Residential Chat Test

Registration probes are off by default. The panel retests existing accounts with a short prompt and stops after thinking; 401/403 is risk.

SSO Risk (Disabled)

No longer a verdict

grok.com botFlagSource / policy=deny is no longer a risk signal and does not block registration. This remains for comparison only.

BFS Scan

JWT claim

Decode access_token from CPA / Grok2API auth and check for the bfs claim (independent of botFlagSource). New tokens are checked automatically and written to accounts/sso_bfs_flagged.txt.

Email	bfs	Source	File

Success Statistics

Date	Success	Risk	Failure

Blacklist

ASN	Note

Blacklist Update History

New ASN	Source

Worker Success / Failure

Failure Categories

Recent Successes

Time	W	Email

Recent Failures

Time	W	Type	Summary

Task Control

Prepare Environment

Choose a Mode

Save and Start

Review Results

Proxy details

Domain details

Scan details

Scan details

Success Rate by Period

Current Batch

Account Recovery

Quality Test

SSO Risk (Disabled)

BFS Scan

Success Statistics

Blacklist

Blacklist Update History

Worker Success / Failure

Failure Categories

Recent Successes

Recent Failures

Log tail