58 lines
2.1 KiB
Markdown
58 lines
2.1 KiB
Markdown
# LobeHub Cloud Registration: OAuth Bypass for CF Managed Challenge
|
|
|
|
## Discovery (2026-07-02 session)
|
|
|
|
`app.lobehub.com/signin` is protected by **Cloudflare Managed Challenge** (not Turnstile). The form contains:
|
|
- An checkbox captcha labeled "Подтвердите, что вы человек"
|
|
- `/cdn-cgi/challenge-platform/scripts/jsd/main.js` with `window._cf_chl_opt`
|
|
- No `0x4...` sitekey in HTML
|
|
|
|
2captcha Turnstile solver is irrelevant — no Turnstile sitekey exists.
|
|
|
|
The same page also offers **"Continue with Google/GitHub/Apple"** OAuth buttons. These bypass the email/password captcha because the challenge is attached to the credential form, not the OAuth callback.
|
|
|
|
## Method
|
|
|
|
### Requirements
|
|
- A GitHub account that has NOT already been linked to LobeHub Cloud
|
|
- (Optional) Fresh GitHub accounts for farming multiple LobeHub Cloud accounts
|
|
|
|
### Steps
|
|
|
|
1. Open `https://app.lobehub.com/signin`
|
|
2. Click **"Continue with GitHub"**
|
|
3. On GitHub, authorize LobeHub app
|
|
4. LobeHub creates a Cloud account linked to GitHub identity
|
|
5. Once logged in, navigate to `Settings → Developer`
|
|
6. Create a new API key
|
|
7. Copy the API key — shown only once
|
|
|
|
### For Multiple Accounts
|
|
|
|
Use a new GitHub account per LobeHub account. Steps:
|
|
1. Create new GitHub account (or use existing pool)
|
|
2. Link it to LobeHub Cloud via OAuth
|
|
3. Create developer API key
|
|
4. Store in `keys/lobehub_cloud.json`
|
|
|
|
### Gotchas
|
|
|
|
- If the GitHub account is already linked to a LobeHub Cloud account, clicking OAuth will **log in** to that account, not create a new one
|
|
- LobeHub Cloud account is tied to the OAuth identity, not the email alias used during registration
|
|
- Referral code `fQXk8Gr5` may still be applied; check UI
|
|
|
|
## Automation Notes
|
|
|
|
Browser automation with real Chromium (patchright/nodriver/camoufox) may still be needed for the OAuth flow if the GitHub account is new and triggers security checks. For trusted GitHub accounts, the flow is one-click.
|
|
|
|
## Verification
|
|
|
|
After creating the API key, test it:
|
|
|
|
```bash
|
|
curl -s https://app.lobehub.com/api/v1/user \
|
|
-H "Authorization: Bearer $LOBEHUB_API_KEY"
|
|
```
|
|
|
|
Expected: 200 with user info.
|