This project offers a research client for the x.ai/Grok web authentication flow, enabling programmatic reproduction of signup, SSO, and OAuth PKCE via pure HTTP. It targets engineers and researchers for protocol analysis, interoperability, and local integration testing, exporting credentials compatible with CLIProxyAPI.

How It Works

The client bypasses browsers, using curl_cffi for TLS/HTTP2 fingerprinting to mimic real user sessions. It handles account creation via accounts.x.ai (email verification, Turnstile), extracts SSO JWTs from cookies for OAuth reuse (fast path), or falls back to CreateSession. It then exports obtained tokens into a cli-chat-proxy.grok.com-compatible JSON file for CLIProxyAPI.

Quick Start & Requirements

Clone the repository (https://github.com/dongguatanglinux/grok-build-auth.git), set up a Python 3.9+ virtual environment, and pip install -r requirements.txt. Requires API keys for YesCaptcha (Turnstile) and optionally Tempmail.lol or a self-hosted Cloudflare D1 alias email backend. Populate .env.example with credentials.

Highlighted Details

• Protocol-First: Primarily pure HTTP, avoiding browser automation.
• SSO Session Reuse: Bypasses secondary CAPTCHA during OAuth.
• CLIProxyAPI Export: Generates credentials loadable by CLIProxyAPI.
• Concurrent Registration: Supports multi-threaded account creation.

Maintenance & Community

Contributions are welcomed for authorized scenarios. Community channels include LINUX DO for technical discussion, QQ Group 1058789350 for real-time chat, and GitHub Issues for bug reports and PRs. Maintainers have no obligation for continuous adaptation to third-party API changes.

Licensing & Compatibility

Licensed under MIT, but the NOTICE file imposes strict usage terms. Restricted to authorized scenarios (personal systems, legal CTFs, authorized research); prohibits fraud, bulk account creation/resale. Users bear full legal responsibility.

Limitations & Caveats

Dependent on third-party API stability, susceptible to breakage. High concurrency risks platform controls. SSO alone is insufficient for CLIProxyAPI auth; OAuth completion is mandatory. Playwright is an optional dependency. No support or compatibility guarantee provided.