# Cloud API Key — Blocked at /api/v1 (2026-07-04) ## Discovery API keys were successfully created via tRPC `apiKey.createApiKey` (bypassing `api_key_manage: false` feature flag). The key format is `id:hash:secret` (three colon-separated hex strings). ## Blocked The key does NOT work with `https://app.lobehub.com/api/v1`: - `GET /api/v1/models` → 500 `{"error":"Authentication required"}` (Cloudflare) - `POST /api/v1/chat/completions` → 404 (Not Found) Even with valid Cloudflare clearance cookies (`cf_clearance`, `cf_bm`) and Better Auth session cookies (`__Secure-better-auth.session_token`), the endpoint rejects the key. ## Attempted Auth Formats All returned 500 "Authentication required": - `Authorization: Bearer ` - `Authorization: Bearer sk-lh-` - `Authorization: Bearer lb-` - `x-api-key: ` - `x-api-key: [REDACTED] - `api-key: ` - Query param: `?key=` ## Attempted API Endpoints All returned 404: - `https://api.lobehub.com/v1/models` (DEPLOYMENT_NOT_FOUND on Vercel) - `https://cloud.lobehub.com/v1/models` (DEPLOYMENT_NOT_FOUND) - `https://lobehub.com/api/v1/models` - `https://app.lobehub.com/api/v1/chat/completions` - `https://app.lobehub.com/api/chat` ## Key Details - **X-Matched-Path:** `/api/v1/[[...route]]` — confirms the route exists - **Server:** cloudflare — Cloudflare is intercepting - **Access-Control-Allow-Origin:** * — CORS is open - The endpoint exists but auth is rejected before reaching the app ## Hypothesis 1. The API key is NOT for an OpenAI-compatible endpoint — it may be for the LobeHub Agent API 2. Cloudflare may require a specific header or cookie that we haven't identified 3. The API key may need to be "activated" or the account may need a paid plan 4. The correct API base URL may be different from `app.lobehub.com/api/v1` ## Next Steps - Test the key with the LobeHub Agent API (different endpoint) - Check if the key works after upgrading the account plan - Look for API documentation in the LobeHub source code - Try the key through the LobeHub CLI tool