Automated Account Signup

Relevant source files

The following files were used as context for generating this wiki page:

• new_signup.py
• oauth_auth.py
• cursor_register_manual.py
• manual_custom_auth.py
• delete_cursor_google.py
• totally_reset_cursor.py

The Automated Account Signup system is a core feature designed to automate the creation of new Cursor accounts. It leverages browser automation to simulate human interaction with the Cursor registration web interface, handling various authentication methods, including manual form filling and OAuth 2.0 with providers like Google and GitHub.

The system is built to handle complexities in the registration process, such as security verifications (Cloudflare Turnstile) and email-based confirmation codes. It supports both fully automated registration using temporary email services and semi-automated flows where the user can provide their own credentials or interact with the browser directly. The ultimate goal is to obtain a valid session token, which is then stored for use by the main application.

System Architecture and Core Components

The signup process is orchestrated by several Python scripts that manage different aspects of the registration, from browser setup to authentication and post-signup actions. The primary library used for browser automation is DrissionPage.

The general flow involves:

1. Setting up and launching a browser instance.
2. Navigating to the Cursor signup page.
3. Filling out the registration form with either generated or user-provided details.
4. Handling security challenges like Cloudflare Turnstile.
5. Retrieving and submitting a verification code sent via email.
6. Extracting the session token upon successful registration.
7. Storing the account credentials and token.

The following diagram illustrates the high-level signup workflow.

This diagram shows the different paths for manual, OAuth, and custom authentication, all leading to a successful account setup.
Sources: new_signup.py, oauth_auth.py, manual_custom_auth.py

Browser Automation and Setup

The system relies on DrissionPage to control a Chromium-based browser, simulating user actions. The setup is handled primarily within new_signup.py and oauth_auth.py.

Driver Configuration

The setup_driver function in new_signup.py is responsible for configuring and launching the browser instance.

• It reads browser settings from the configuration file, including the browser type (e.g., chrome, edge) and executable path.
• It launches the browser in non-headless mode to simulate human operation.
• It can load a browser extension from the turnstilePatch directory, which is intended to assist with bypassing a security verification.
• It tracks the process IDs of the browser instances it launches to ensure they can be cleaned up later.

Sources: new_signup.py:126-200

Browser and Profile Management

For OAuth-based flows, managing browser profiles is crucial to reuse existing logged-in sessions (e.g., a Google account). The OAuthHandler class in oauth_auth.py manages this.

• Profile Discovery: The _get_available_profiles method scans the browser's user data directory to find all available user profiles. It reads the Local State file to get the human-readable names of these profiles.
• Profile Selection: The _select_profile method presents a list of discovered profiles to the user, allowing them to choose which one to use for the authentication flow. This is important for users who have multiple Google or GitHub accounts.
• Process Cleanup: Before launching a new browser instance, the _kill_browser_processes function terminates any existing processes for the selected browser to avoid conflicts.

The diagram below shows the class structure for handling OAuth.

This diagram shows that CursorGoogleAccountDeleter inherits from OAuthHandler, reusing its browser and profile management capabilities.
Sources: oauth_auth.py:27-313, delete_cursor_google.py:19-21

Authentication Flows

The system supports multiple methods for account creation and authentication.

Manual Registration

This is the most detailed flow, handled by cursor_register_manual.py and new_signup.py. It automates the entire web form submission process.

1. Account Details: User details (name, email, password) are either generated randomly using the Faker library or provided by the user.
2. Form Filling: The fill_signup_form function in new_signup.py populates the first name, last name, and email fields on the Cursor signup page.
3. Password Submission: After the initial form, the fill_password function enters the chosen password.
4. Verification: The script waits for and submits a 6-digit verification code. This can be done automatically if a temporary email service is configured, or manually by the user.

The sequence diagram below details the interactions during a manual registration.

OAuth-based Registration (Google/GitHub)

This flow, managed by OAuthHandler in oauth_auth.py, leverages the user's existing Google or GitHub session to create a Cursor account.

1. Browser Setup: A browser is launched using a specific user profile selected by the user, which should already be logged into the OAuth provider.
2. Navigation: The script navigates to the Cursor signup page and clicks the "Sign in with Google" or "Sign in with GitHub" button.
3. User Interaction: The user may need to select their account or approve the authorization request in the browser.
4. Token Extraction: After a successful OAuth redirect, the script waits for the WorkosCursorSessionToken cookie to appear and extracts the session token from it.
5. Information Update: The extracted token and the associated email are used to update the local authentication database.

Sources: oauth_auth.py:316-411, 413-470

Manual Custom Authentication

For advanced users who already have a valid token, manual_custom_auth.py provides a way to inject this information directly into the application's database.

1. User Input: The script prompts the user to enter their access_token/refresh_token and an associated email address.
2. Token Verification: It attempts to validate the token by calling check_user_authorized.
3. Database Update: If the user confirms, the script initializes a CursorAuth object and calls update_auth to directly write the provided credentials into the local state.vscdb SQLite database.

This flow bypasses browser automation entirely.

Sources: manual_custom_auth.py:27-118

Verification Handling

The signup process involves multiple verification steps, which the system is designed to handle.

Cloudflare Turnstile Bypass

The Cursor website uses Cloudflare Turnstile to prevent bots. The handle_turnstile function in new_signup.py is designed to pass this check.

• It looks for the Turnstile iframe (@id=cf-turnstile).
• It attempts to click the checkbox within the iframe to trigger the verification.
• It uses a browser extension located in turnstilePatch to aid in this process.
• It includes retry logic and checks for success by looking for the appearance of subsequent form elements (like a password field).

The following diagram shows the logic for handling the Turnstile challenge.

Email Verification Code Retrieval

After submitting the password, a 6-digit code is sent to the user's email.

• Manual Mode: In cursor_register_manual.py, the get_verification_code function prompts the user to manually enter the code from their email inbox.
• Automated Mode: If TempMailPlus is enabled in the configuration, the script will use the TempMailPlusTab class to automatically check the temporary email inbox, retrieve the code, and submit it.

Sources: cursor_register_manual.py:86-101, new_signup.py:347-451

Post-Registration Actions

After a successful registration and token acquisition, several final steps are performed.

Account Information Storage

The _save_account_info method in cursor_register_manual.py is responsible for persisting the new account's credentials.

1. It first calls update_cursor_auth to save the email and token to the application's SQLite database (state.vscdb).
2. It then uses an AccountManager instance to save the email, password, and token to a human-readable text file for the user's reference.

Sources: cursor_register_manual.py:157-183

Machine ID Reset

A critical step in the process is resetting the machine ID to ensure a fresh state for the application. This is handled by the MachineIDResetter class, which is invoked after the account information is saved. This class modifies various system and application files to generate and apply new unique identifiers.

Key files and locations modified include:

• storage.json: Contains various telemetry and device IDs.
• state.vscdb: The SQLite database where machine IDs are also stored.
• System-specific identifiers, such as the Windows Registry (MachineGuid) or macOS com.apple.platform.uuid.plist.

Sources: cursor_register_manual.py:173-176, totally_reset_cursor.py:302-530

Configuration

The behavior of the signup scripts is controlled by settings in a config.ini file, typically located in the user's Documents folder under .cursor-free-vip.

Section	Key	Description	Source File
Browser	default_browser	Specifies the browser to use (e.g., chrome, edge).	oauth_auth.py
Browser	chrome_path	The file path to the browser's executable.	new_signup.py:132
Timing	page_load_wait	Random wait time range (e.g., 1-3) for page loads.	new_signup.py:118-124
Timing	input_wait	Random wait time range after typing in an input field.	new_signup.py:118-124
Turnstile	handle_turnstile_time	Fixed wait time used during Turnstile handling.	new_signup.py:211
TempMailPlus	enabled	A boolean (true/false) to enable or disable the TempMailPlus service for automatic email verification.	cursor_register_manual.py:113-115
TempMailPlus	email	The email address to use with TempMailPlus.	cursor_register_manual.py:116

Sources: new_signup.py:126-141, cursor_register_manual.py:112-118

Conclusion

The Automated Account Signup system is a sophisticated module that combines browser automation, multiple authentication strategies, and robust error handling to streamline the creation of Cursor accounts. By abstracting the complexities of web interactions, security challenges, and platform-specific configurations, it provides a reliable and flexible way to manage user accounts for the application. Its support for manual, OAuth, and custom token authentication makes it adaptable to various user needs and scenarios.