Registration captcha again

[netgab]

Hi team,

want to register a new land line, without SMS support. Guess Captchas are enforced by now:

curl -X POST -H "Content-Type: application/json" http://127.0.0.1:8080/v1/register/+49123456789 --data '{"use_voice": false}'

Return data

{"error":"Captcha required for verification, use --captcha CAPTCHA\nTo get the token, go to https://signalcaptchas.org/registration/generate.html\nAfter solving the captcha, right-click on the \"Open Signal\" link and copy the link.\n"}

There are various docs here and at the signal-cli repository of AsamK, which are

• sometimes quite old (guess Signal changed stuff in the meantime)
• are a little bit confusing (at least for me).

I want to get the proper facts now (perhaps for the Wiki with exact working instructions :)

The steps on my side are now:

Open https://signalcaptchas.org/registration/generate and solve the captcha. After this a link is displayed to open signal with a URL starting with signalcaptcha://

This is the first step with a lot of variants, how to proceed from here. There are rumours, to:

1. Create (somehow) a token using the data in the link destination (no clue how to do this)
2. Just copy the full link (example value: signalcaptcha://signal-hcaptcha.<VALUE1>.registration.<VALUE2> ) and use it as data in the POST payload of the request above:

--data '{"use_voice": false, "captcha": "signalcaptcha://signal-hcaptcha.<VALUE1>.registration.<VALUE2>"}'

3. Remove signalcaptcha:// from the link above and use the remaining part in the POST payload of the request above:

--data '{"use_voice": false, "captcha": "signal-hcaptcha.<VALUE1>.registration.<VALUE2>"}'

Note: Sometimes, the link begins with signal-hcaptcha (very long VALUE2) - sometimes it is signal-hcaptcha-short.<VALUE1>.registration.<VALUE2> (short VALUE2). I could not reproduce when the captcha generator generates what variant.

There are other posts, which states to put the captcha (or parts of it?!) in single quotes. But there are no examples for this.
Would it be a JSON payload of {"use_voice": false, "captcha": "'signalcaptcha://signal-hcaptcha.<VALUE1>.registration.<VALUE2>'"}?

At the end of the day, I'm always getting the response, that an invalid captcha is given ({"error":"Invalid captcha given.\n"}). After some retries, I get rate-limited.

Does anybody have a working approach? At the moment it's a try and error approach on my side, which doesn't make any sense. There must be a single working way and not tons of non-working variants :)

I know this is probably not the problem of this project here - it's a Signal issue. But maybe someone knows how to tackle this. I got this working before, but I have a new container now and my old volume is long gone.

[netgab]

Edit: Guess it has something to do with the Signa SPQR enforcement for new registrations.
Also check out AsamK/signal-cli#1993

What I learned so far:

• Reregistration is needed
• SPQR support added with signal-cli version v0.14.1, which is currently used in signal-cli-rest-api latest release
• However, there seems to be some fixes in release v0.14.2, which does not have any stable release in signal-cli-rest-api yet (however, it's already consideren in the Dockerfile).

So I guess I'll retry it by building the Docker image locally, that signal-ci v0.14.2 is used...

[bbernhard]

you can e.g also use this image: bbernhard/signal-cli-rest-api:1775770922-ci

[netgab]

Hmmm ... does not work either. Even with the latest tag (Invalid captcha given).
Next step is to try it with the native client of AsamK. Need to somehow narrow it down why it does not work.

[bbernhard]

In normal mode you can also enable the debug mode (https://github.com/bbernhard/signal-cli-rest-api/blob/master/doc/DEBUG.md) that way you can connect directly into the container and run the signal-cli commands directly without the REST API wrapper involved. You might also want to add the -v commandline flag to the signal-cli command to get more debug output (see https://github.com/AsamK/signal-cli/blob/master/man/signal-cli.1.adoc)

[netgab]

So, I tried it directly within the container and the registration was successful:

Enter container bash

bash

sudo docker compose exec signal-cli-rest-api bash
su signal-api

Now for the interesting part - the registration:

signal-cli -v --config /home/.local/share/signal-cli -u +4312345 register

# Hint to do a captcha verification. After the captcha is solved and the token is generated (copy link)
signal-cli -v --config /home/.local/share/signal-cli -u +4312345 register --captcha signalcaptcha://<LONG-TEXT>

Now signal-cli raises an exception like:

2026-04-19T05:48:07.124Z [main] DEBUG org.asamk.signal.util.IOUtils - XDG_RUNTIME_DIR not set, falling back to temp dir
2026-04-19T05:48:07.129Z [main] DEBUG org.asamk.signal.App - Starting signal-cli 0.14.2
2026-04-19T05:48:07.840Z [main] INFO  com.zaxxer.hikari.HikariDataSource - HikariPool-1 - Starting...
2026-04-19T05:48:07.912Z [main] INFO  com.zaxxer.hikari.pool.HikariPool - HikariPool-1 - Added connection org.sqlite.jdbc4.JDBC4Connection@76318a7d
2026-04-19T05:48:07.913Z [main] INFO  com.zaxxer.hikari.HikariDataSource - HikariPool-1 - Start completed.
2026-04-19T05:48:09.412Z [main] INFO  com.zaxxer.hikari.HikariDataSource - HikariPool-1 - Shutdown initiated...
2026-04-19T05:48:09.413Z [main] INFO  com.zaxxer.hikari.HikariDataSource - HikariPool-1 - Shutdown completed.
Failed to register: StatusCode: 400 (InvalidTransportModeException)
org.whispersystems.signalservice.api.push.exceptions.InvalidTransportModeException: StatusCode: 400
        at org.whispersystems.signalservice.internal.push.PushServiceSocket$RequestVerificationCodeResponseHandler.handle(PushServiceSocket.java:2288)
        at org.whispersystems.signalservice.internal.push.PushServiceSocket.makeServiceRequest(PushServiceSocket.java:1429)
        at org.whispersystems.signalservice.internal.push.PushServiceSocket.requestVerificationCode(PushServiceSocket.java:315)
        at org.whispersystems.signalservice.api.registration.RegistrationApi.requestSmsVerificationCode$lambda$3(RegistrationApi.kt:74)
        at org.whispersystems.signalservice.api.NetworkResult$Companion.fromFetch(NetworkResult.kt:56)
        at org.whispersystems.signalservice.api.registration.RegistrationApi.requestSmsVerificationCode(RegistrationApi.kt:73)
        at org.asamk.signal.manager.util.NumberVerificationUtils.requestVerificationCode(NumberVerificationUtils.java:96)
        at org.asamk.signal.manager.internal.RegistrationManagerImpl.register(RegistrationManagerImpl.java:141)
        at org.asamk.signal.commands.RegisterCommand.register(RegisterCommand.java:81)
        at org.asamk.signal.commands.RegisterCommand.handleCommand(RegisterCommand.java:52)
        at org.asamk.signal.commands.CommandHandler.handleRegistrationCommand(CommandHandler.java:33)
        at org.asamk.signal.App.handleRegistrationCommand(App.java:268)
        at org.asamk.signal.App.handleCommand(App.java:177)
        at org.asamk.signal.App.init(App.java:147)
        at org.asamk.signal.Main.main(Main.java:56)

=> Failed to register: StatusCode: 400 (InvalidTransportModeException)

Someone might assume, this is an error - however, this is expected (didn't know that).
If you try again, you'll get a `Failed to register: [429] Rate Limited (RateLimitException)``

After this (InvalidTransportModeException), the last registration step works as expected:

signal-cli -v --config /home/.local/share/signal-cli -u +4312345 register --voice
=> Phone rings with PIN voice message

signal-cli -v --config /home/.local/share/signal-cli -u +4312345 verify <PIN-CODE>

I'm not a Go expert and didn't check this code properly, but I guess, that after the captcha call using the REST-API, any signal-cli exception ends with the "invalid captcha" response.