autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/lobehub-pool/references/cloud-api-key-blocked-2026-07-04.md

@@ -0,0 +1,55 @@
+# Cloud API Key — Blocked at /api/v1 (2026-07-04)
+
+## Discovery
+
+API keys were successfully created via tRPC `apiKey.createApiKey` (bypassing `api_key_manage: false` feature flag). The key format is `id:hash:secret` (three colon-separated hex strings).
+
+## Blocked
+
+The key does NOT work with `https://app.lobehub.com/api/v1`:
+
+- `GET /api/v1/models` → 500 `{"error":"Authentication required"}` (Cloudflare)
+- `POST /api/v1/chat/completions` → 404 (Not Found)
+
+Even with valid Cloudflare clearance cookies (`cf_clearance`, `cf_bm`) and Better Auth session cookies (`__Secure-better-auth.session_token`), the endpoint rejects the key.
+
+## Attempted Auth Formats
+
+All returned 500 "Authentication required":
+- `Authorization: Bearer <key>`
+- `Authorization: Bearer sk-lh-<key>`
+- `Authorization: Bearer lb-<key>`
+- `x-api-key: <key>`
+- `x-api-key: [REDACTED]
+- `api-key: <key>`
+- Query param: `?key=<key>`
+
+## Attempted API Endpoints
+
+All returned 404:
+- `https://api.lobehub.com/v1/models` (DEPLOYMENT_NOT_FOUND on Vercel)
+- `https://cloud.lobehub.com/v1/models` (DEPLOYMENT_NOT_FOUND)
+- `https://lobehub.com/api/v1/models`
+- `https://app.lobehub.com/api/v1/chat/completions`
+- `https://app.lobehub.com/api/chat`
+
+## Key Details
+
+- **X-Matched-Path:** `/api/v1/[[...route]]` — confirms the route exists
+- **Server:** cloudflare — Cloudflare is intercepting
+- **Access-Control-Allow-Origin:** * — CORS is open
+- The endpoint exists but auth is rejected before reaching the app
+
+## Hypothesis
+
+1. The API key is NOT for an OpenAI-compatible endpoint — it may be for the LobeHub Agent API
+2. Cloudflare may require a specific header or cookie that we haven't identified
+3. The API key may need to be "activated" or the account may need a paid plan
+4. The correct API base URL may be different from `app.lobehub.com/api/v1`
+
+## Next Steps
+
+- Test the key with the LobeHub Agent API (different endpoint)
+- Check if the key works after upgrading the account plan
+- Look for API documentation in the LobeHub source code
+- Try the key through the LobeHub CLI tool