# LobeHub Self-Hosted Auto-Registration Path (2026-07-01)

## Why Self-Hosted

LobeHub Cloud (app.lobehub.com) uses Clerk for auth — OAuth (Google, GitHub, Apple) only, no direct email/password. This makes bulk registration impossible without real social accounts.

**The bypass:** Self-host LobeHub via Docker Compose. It uses Better Auth, which supports standard email/password registration. This is automatable.

## Deployment

```bash
git clone https://github.com/lobehub/lobehub
cd lobehub
cp .env.example .env
# Edit .env: DATABASE_URL, AUTH_SECRET, S3 credentials
docker compose up -d
```

## Better Auth Registration

Self-hosted LobeHub exposes Better Auth endpoints:

```
POST /api/auth/sign-up/email
Body: {"email": "user@domain.com", "password": "Pass123!", "name": "User"}
Response: 200 + session cookie
```

**No CAPTCHA, no rate limit by default** — configurable via Better Auth settings.

## Email Strategy

- **Catch-all domain**: `user+<random>@reforrm.me` → all route to one inbox
- **No email verification required** by default (configurable)
- **IMAP verification**: If verification enabled, use Gmail IMAP pattern from `bulk-account-registration`

## Automation Script

```python
import requests

BASE = "https://your-lobehub-instance.com"

for i in range(10):
    email = f"user+lb{i}@reforrm.me"
    resp = requests.post(f"{BASE}/api/auth/sign-up/email", json={
        "email": email,
        "password": "Str0ng!Pass123",
        "name": f"User{i}"
    })
    if resp.status_code == 200:
        print(f"Created: {email}")
        # Extract session cookie for API access
        cookie = resp.cookies.get("auth_session")
        # Use cookie for /api/auth/session → get user ID + token
```

## Provider Access

After registration, users get access to 70+ AI providers through the LobeHub UI. API keys for individual providers (OpenAI, Anthropic, etc.) are configured in the server's `.env` — not per-user. All users share the same provider keys.

## VPS Requirement

- 2GB RAM minimum (Next.js + PostgreSQL + Redis)
- 20GB disk
- Docker + Docker Compose
- Available: 3 DigitalOcean droplets (gothbreach-abuse-1, eni-sgp1, eni-nyc1)

## Pitfalls

- Cloud version uses Clerk — can't automate registration there
- Self-hosted needs PostgreSQL (not SQLite) — adds complexity
- Provider API keys are shared across all users — one user's abuse affects everyone
- Docker Compose includes Searxng (privacy search) — optional but recommended
- Referral codes likely don't apply to self-hosted instances