# Cloud LobeHub Registration — Working Method

## Discovery (2026-07-02)

### Turnstile

- **Sitekey:** `0x4AAAAAACxm5ZI_WCU13SgI`
- **Found in:** `/_spa-auth/assets/index.auth-CAy4V6bY.js` → variable `vg`
- **2captcha key:** `[REDACTED-KEY]`

### Registration Endpoint

```
POST https://app.lobehub.com/api/auth/sign-up/email?fp=[REDACTED-KEY]&referral=fQXk8Gr5
Headers:
  Origin: https://app.lobehub.com
  Referer: https://app.lobehub.com/signup?referral=fQXk8Gr5
  Content-Type: application/json
  X-Captcha-Response: <turnstile_token_from_2captcha>
Body: {"email": "...", "password": "...", "name": "..."}
```

### CRITICAL: curl_cffi Required

The Turnstile token from 2captcha must be sent via `curl_cffi` with `impersonate="chrome124"`. Plain `httpx`/`requests` will get `CAPTCHA_FAILED` because Clerk validates the TLS fingerprint matches the Turnstile solver's browser.

```python
from curl_cffi import requests as curl_requests

# BEFORE: pip install curl_cffi
# WARNING: requires impersonate="chrome124" — without it CAPTCHA_FAILED

resp = curl_requests.post(
    "https://app.lobehub.com/api/auth/sign-up/email?fp=...&referral=fQXk8Gr5",
    json={"email": email, "password": pw, "name": name},
    headers={
        "Origin": "https://app.lobehub.com",
        "Referer": "https://app.lobehub.com/signup?referral=fQXk8Gr5",
        "Content-Type": "application/json",
        "X-Captcha-Response": turnstile_token,
        "User-Agent": "Mozilla/5.0 ... Chrome/[REDACTED-IP] ..."
    },
    impersonate="chrome124"  # ← THIS IS THE KEY
)
```

### Verified: 9 accounts registered via this method

Account format in `lobehub_cloud_accounts.json`:
```json
{
  "email": "[REDACTED-EMAIL]",
  "password": "random14char",
  "name": "user",
  "session_token": "",
  "created_at": "2026-07-02T...",
  "referral": "fQXk8Gr5"
}
```

### Issue: Email Verification Required

After registration, login returns `EMAIL_NOT_VERIFIED` (403). Accounts need:
1. IMAP access to read verification email from LobeHub
2. Click verification link or extract code

This is NOT yet automated. Cloud accounts are registered but not activated.

### Previous (deprecated) attempts

- `X-Captcha-Response` as body field → CAPTCHA_REQUIRED (wrong field name)
- `cf-turnstile-response` body field → CAPTCHA_REQUIRED
- Plain `httpx` without impersonation → CAPTCHA_FAILED
- MCP Playwright browser → Cloudflare blocks datacenter IP