# LobeHub Cloud API Key Extraction via tRPC Bypass (2026-07-05)

## Status

**Working method to obtain LobeHub Cloud API keys without UI access.**

- `api_key_manage: false` is a UI-only feature flag; the backend tRPC endpoint still works.
- `getApiKeys` returns masked keys (`sk-lh-...xxxx`).
- `createApiKey` returns the **full key exactly once** — save it immediately.

## Endpoints

```text
POST https://app.lobehub.com/api/auth/sign-in/email
GET  https://app.lobehub.com/trpc/lambda/apiKey.getApiKeys
POST https://app.lobehub.com/trpc/lambda/apiKey.createApiKey
```

## Prerequisites

- Cloud account with verified email and known password (e.g. `[REDACTED-EMAIL]` / `TqLlOlrbmv7pvM70aA1!`).
- 2captcha key and Turnstile solver for sitekey `0x4AAAAAACxm5ZI_WCU13SgI`.
- Running from a clean DO/cloud IP to avoid Cloudflare blocks.

## Login flow

```python
import requests, json

def solve_turnstile(api_key):
    r = requests.post("https://2captcha.com/in.php", data={
        "key": api_key, "method": "turnstile",
        "sitekey": "0x4AAAAAACxm5ZI_WCU13SgI",
        "pageurl": "https://app.lobehub.com", "json": 1
    })
    cid = r.json()["request"]
    for _ in range(40):
        time.sleep(4)
        r = requests.get("https://2captcha.com/res.php", params={
            "key": api_key, "action": "get", "id": cid, "json": 1
        })
        if r.json().get("status") == 1:
            return r.json()["request"]
    raise Exception("captcha timeout")

cf_token = solve_turnstile("[REDACTED-KEY]")

s = requests.Session()
r = s.post("https://app.lobehub.com/api/auth/sign-in/email", headers={
    "Origin": "https://app.lobehub.com",
    "Referer": "https://app.lobehub.com/signin",
    "Content-Type": "application/json",
    "x-captcha-response": cf_token,
}, json={"email": "[REDACTED-EMAIL]", "password": "TqLlOlrbmv7pvM70aA1!"}, timeout=15)
assert r.status_code == 200
# Session cookies are now stored in `s`.
```

## Create API key (full key returned once)

```python
r = s.post("https://app.lobehub.com/trpc/lambda/apiKey.createApiKey", headers={
    "Origin": "https://app.lobehub.com",
    "Referer": "https://app.lobehub.com/settings/developer",
    "Content-Type": "application/json",
}, json={"json": {"name": "my-key"}}, timeout=15)

key_data = r.json()["result"]["data"]["json"]
full_key = key_data["key"]  # 102 chars, hex:hex:hex
key_id   = key_data["id"]
print(full_key)
```

## List keys (masked)

```python
r = s.get("https://app.lobehub.com/trpc/lambda/apiKey.getApiKeys", headers={
    "Origin": "https://app.lobehub.com",
    "Referer": "https://app.lobehub.com/settings",
})
print(r.json())
```

## Key format

- 102-character string: `hex26:hex32:hex37`
- Example: `dea84dd5c27a37428eb8a658:[REDACTED-KEY]:4cef49218af00ad952ec0fef46fa72be85833db49e07`
- UI displays masked as `sk-lh-...xxxx`.
- **Save the create response to a file immediately.** Terminal output often truncates the last ~5 characters.

## Bulk key creation

```python
import json
keys = []
for i in range(10):
    r = s.post("https://app.lobehub.com/trpc/lambda/apiKey.createApiKey",
        headers={"Origin": "https://app.lobehub.com", "Referer": "https://app.lobehub.com/settings/developer", "Content-Type": "application/json"},
        json={"json": {"name": f"auto-{i}"}}, timeout=15)
    key = r.json()["result"]["data"]["json"]["key"]
    keys.append({"name": f"auto-{i}", "key": key})
    with open("/root/lobehub_keys.json", "w") as f:
        json.dump(keys, f, indent=2)
```

## Important caveats

- `/api/v1` and `api.lobehub.com/v1` are **not the chat endpoint** and currently fail or return Vercel errors.
- The actual chat flow uses `aiAgent.execAgent` (see `references/cloud-chat-internal-endpoint-2026-07-05.md`).
- Mass registration via t-online.de subaddressing was blocked because LobeHub verification emails never arrived in the INBOX; do not rely on t-online.de for Cloud verification.