← all repositories
gtxx3600/GPTSession2CPAandSub2API

A Swiss Army knife for ChatGPT session smuggling

Browser-side converter that turns a ChatGPT web login session into importable auth JSON for seven different API proxy tools.

1.2k stars JavaScript Other AI
GPTSession2CPAandSub2API
Velocity · 7d
+38
★ / day
Trend
steady
star history

What it does

You paste or drop a ChatGPT web session JSON into a single-page browser app, pick a target format, and get back ready-to-import auth credentials. It supports seven downstream tools: CPA, sub2api, Cockpit, 9router, Codex, AxonHub, and Codex-Manager. All parsing and conversion happens locally; nothing is uploaded or stored.

The interesting bit

The tool solves a specific friction: ChatGPT web sessions don’t include OAuth refresh_tokens, so standard Codex OAuth flows that demand phone binding break. By extracting accessToken from the web session and, when needed, fabricating placeholder JWT claims for missing id_tokens, it lets Plus subscribers sidestep that gate and feed their session into proxy infrastructure anyway. The README is unusually candid about the “撸羊毛” (wool-pulling) economics driving this.

Key highlights

  • Accepts five input formats: ChatGPT web session, 9router OAuth, native Codex auth.json, AxonHub auth.json, and Codex-Manager batch JSON
  • Derives missing metadata (email, account ID, plan type, expiry) by decoding the JWT payload of accessToken
  • Outputs are tailored per target: CPA gets synthetic id_token claims; sub2api gets auto_pause_on_expired; AxonHub gets __missing_refresh_token__ as an explicit placeholder
  • Pure static HTML/JS; works offline by opening docs/index.html
  • Explicitly Plus-only: Free-tier access_tokens lack model-calling permissions, and the tool won’t change that

Caveats

  • No refresh_token means access tokens expire and die; automatic renewal is impossible with web-session-derived credentials
  • The README warns that Free accounts are useless here, and the Discord pitch for “free GPT羊毛 info” suggests the surrounding ecosystem is volatile

Verdict

Worth bookmarking if you operate or resell through CPA/sub2api/Codex-style proxies and need to onboard ChatGPT Plus sessions without OAuth gymnastics. Skip it if you’re a standard API user with normal key access — this is infrastructure glue for a specific gray-market pipeline.

heatdrop uses Google Analytics to see which pages get read — nothing else. Your call. How we handle data.