autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/lobehub-pool/references/cloud-registration-oauth-bypass.md

@@ -0,0 +1,57 @@
+# LobeHub Cloud Registration: OAuth Bypass for CF Managed Challenge
+
+## Discovery (2026-07-02 session)
+
+`app.lobehub.com/signin` is protected by **Cloudflare Managed Challenge** (not Turnstile). The form contains:
+- An checkbox captcha labeled "Подтвердите, что вы человек"
+- `/cdn-cgi/challenge-platform/scripts/jsd/main.js` with `window._cf_chl_opt`
+- No `0x4...` sitekey in HTML
+
+2captcha Turnstile solver is irrelevant — no Turnstile sitekey exists.
+
+The same page also offers **"Continue with Google/GitHub/Apple"** OAuth buttons. These bypass the email/password captcha because the challenge is attached to the credential form, not the OAuth callback.
+
+## Method
+
+### Requirements
+- A GitHub account that has NOT already been linked to LobeHub Cloud
+- (Optional) Fresh GitHub accounts for farming multiple LobeHub Cloud accounts
+
+### Steps
+
+1. Open `https://app.lobehub.com/signin`
+2. Click **"Continue with GitHub"**
+3. On GitHub, authorize LobeHub app
+4. LobeHub creates a Cloud account linked to GitHub identity
+5. Once logged in, navigate to `Settings → Developer`
+6. Create a new API key
+7. Copy the API key — shown only once
+
+### For Multiple Accounts
+
+Use a new GitHub account per LobeHub account. Steps:
+1. Create new GitHub account (or use existing pool)
+2. Link it to LobeHub Cloud via OAuth
+3. Create developer API key
+4. Store in `keys/lobehub_cloud.json`
+
+### Gotchas
+
+- If the GitHub account is already linked to a LobeHub Cloud account, clicking OAuth will **log in** to that account, not create a new one
+- LobeHub Cloud account is tied to the OAuth identity, not the email alias used during registration
+- Referral code `fQXk8Gr5` may still be applied; check UI
+
+## Automation Notes
+
+Browser automation with real Chromium (patchright/nodriver/camoufox) may still be needed for the OAuth flow if the GitHub account is new and triggers security checks. For trusted GitHub accounts, the flow is one-click.
+
+## Verification
+
+After creating the API key, test it:
+
+```bash
+curl -s https://app.lobehub.com/api/v1/user \
+  -H "Authorization: Bearer $LOBEHUB_API_KEY"
+```
+
+Expected: 200 with user info.