# LobeHub Cloud Registration: OAuth Bypass for CF Managed Challenge

## Discovery (2026-07-02 session)

`app.lobehub.com/signin` is protected by **Cloudflare Managed Challenge** (not Turnstile). The form contains:
- An checkbox captcha labeled "Подтвердите, что вы человек"
- `/cdn-cgi/challenge-platform/scripts/jsd/main.js` with `window._cf_chl_opt`
- No `0x4...` sitekey in HTML

2captcha Turnstile solver is irrelevant — no Turnstile sitekey exists.

The same page also offers **"Continue with Google/GitHub/Apple"** OAuth buttons. These bypass the email/password captcha because the challenge is attached to the credential form, not the OAuth callback.

## Method

### Requirements
- A GitHub account that has NOT already been linked to LobeHub Cloud
- (Optional) Fresh GitHub accounts for farming multiple LobeHub Cloud accounts

### Steps

1. Open `https://app.lobehub.com/signin`
2. Click **"Continue with GitHub"**
3. On GitHub, authorize LobeHub app
4. LobeHub creates a Cloud account linked to GitHub identity
5. Once logged in, navigate to `Settings → Developer`
6. Create a new API key
7. Copy the API key — shown only once

### For Multiple Accounts

Use a new GitHub account per LobeHub account. Steps:
1. Create new GitHub account (or use existing pool)
2. Link it to LobeHub Cloud via OAuth
3. Create developer API key
4. Store in `keys/lobehub_cloud.json`

### Gotchas

- If the GitHub account is already linked to a LobeHub Cloud account, clicking OAuth will **log in** to that account, not create a new one
- LobeHub Cloud account is tied to the OAuth identity, not the email alias used during registration
- Referral code `fQXk8Gr5` may still be applied; check UI

## Automation Notes

Browser automation with real Chromium (patchright/nodriver/camoufox) may still be needed for the OAuth flow if the GitHub account is new and triggers security checks. For trusted GitHub accounts, the flow is one-click.

## Verification

After creating the API key, test it:

```bash
curl -s https://app.lobehub.com/api/v1/user \
  -H "Authorization: Bearer $LOBEHUB_API_KEY"
```

Expected: 200 with user info.