LobeHub Cloud Registration: OAuth Bypass for CF Managed Challenge

Discovery (2026-07-02 session)

app.lobehub.com/signin is protected by Cloudflare Managed Challenge (not Turnstile). The form contains:

An checkbox captcha labeled "Подтвердите, что вы человек"
/cdn-cgi/challenge-platform/scripts/jsd/main.js with window._cf_chl_opt
No 0x4... sitekey in HTML

2captcha Turnstile solver is irrelevant — no Turnstile sitekey exists.

The same page also offers "Continue with Google/GitHub/Apple" OAuth buttons. These bypass the email/password captcha because the challenge is attached to the credential form, not the OAuth callback.

Method

Requirements

A GitHub account that has NOT already been linked to LobeHub Cloud
(Optional) Fresh GitHub accounts for farming multiple LobeHub Cloud accounts

Steps

Open https://app.lobehub.com/signin
Click "Continue with GitHub"
On GitHub, authorize LobeHub app
LobeHub creates a Cloud account linked to GitHub identity
Once logged in, navigate to Settings → Developer
Create a new API key
Copy the API key — shown only once

For Multiple Accounts

Use a new GitHub account per LobeHub account. Steps:

Create new GitHub account (or use existing pool)
Link it to LobeHub Cloud via OAuth
Create developer API key
Store in keys/lobehub_cloud.json

Gotchas

If the GitHub account is already linked to a LobeHub Cloud account, clicking OAuth will log in to that account, not create a new one
LobeHub Cloud account is tied to the OAuth identity, not the email alias used during registration
Referral code fQXk8Gr5 may still be applied; check UI

Automation Notes

Browser automation with real Chromium (patchright/nodriver/camoufox) may still be needed for the OAuth flow if the GitHub account is new and triggers security checks. For trusted GitHub accounts, the flow is one-click.

Verification

After creating the API key, test it:

curl -s https://app.lobehub.com/api/v1/user \
  -H "Authorization: Bearer $LOBEHUB_API_KEY"

Expected: 200 with user info.

2.1 KiB Raw Blame History