autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/lobehub-pool/references/cloud-registration-working.md

@@ -0,0 +1,74 @@
+# Cloud LobeHub Registration — Working Method
+
+## Discovery (2026-07-02)
+
+### Turnstile
+
+- **Sitekey:** `0x4AAAAAACxm5ZI_WCU13SgI`
+- **Found in:** `/_spa-auth/assets/index.auth-CAy4V6bY.js` → variable `vg`
+- **2captcha key:** `[REDACTED-KEY]`
+
+### Registration Endpoint
+
+```
+POST https://app.lobehub.com/api/auth/sign-up/email?fp=[REDACTED-KEY]&referral=fQXk8Gr5
+Headers:
+  Origin: https://app.lobehub.com
+  Referer: https://app.lobehub.com/signup?referral=fQXk8Gr5
+  Content-Type: application/json
+  X-Captcha-Response: <turnstile_token_from_2captcha>
+Body: {"email": "...", "password": "...", "name": "..."}
+```
+
+### CRITICAL: curl_cffi Required
+
+The Turnstile token from 2captcha must be sent via `curl_cffi` with `impersonate="chrome124"`. Plain `httpx`/`requests` will get `CAPTCHA_FAILED` because Clerk validates the TLS fingerprint matches the Turnstile solver's browser.
+
+```python
+from curl_cffi import requests as curl_requests
+
+# BEFORE: pip install curl_cffi
+# WARNING: requires impersonate="chrome124" — without it CAPTCHA_FAILED
+
+resp = curl_requests.post(
+    "https://app.lobehub.com/api/auth/sign-up/email?fp=...&referral=fQXk8Gr5",
+    json={"email": email, "password": pw, "name": name},
+    headers={
+        "Origin": "https://app.lobehub.com",
+        "Referer": "https://app.lobehub.com/signup?referral=fQXk8Gr5",
+        "Content-Type": "application/json",
+        "X-Captcha-Response": turnstile_token,
+        "User-Agent": "Mozilla/5.0 ... Chrome/[REDACTED-IP] ..."
+    },
+    impersonate="chrome124"  # ← THIS IS THE KEY
+)
+```
+
+### Verified: 9 accounts registered via this method
+
+Account format in `lobehub_cloud_accounts.json`:
+```json
+{
+  "email": "[REDACTED-EMAIL]",
+  "password": "random14char",
+  "name": "user",
+  "session_token": "",
+  "created_at": "2026-07-02T...",
+  "referral": "fQXk8Gr5"
+}
+```
+
+### Issue: Email Verification Required
+
+After registration, login returns `EMAIL_NOT_VERIFIED` (403). Accounts need:
+1. IMAP access to read verification email from LobeHub
+2. Click verification link or extract code
+
+This is NOT yet automated. Cloud accounts are registered but not activated.
+
+### Previous (deprecated) attempts
+
+- `X-Captcha-Response` as body field → CAPTCHA_REQUIRED (wrong field name)
+- `cf-turnstile-response` body field → CAPTCHA_REQUIRED
+- Plain `httpx` without impersonation → CAPTCHA_FAILED
+- MCP Playwright browser → Cloudflare blocks datacenter IP