Cloud LobeHub Registration — Working Method

Discovery (2026-07-02)

Turnstile

Sitekey: 0x4AAAAAACxm5ZI_WCU13SgI
Found in: /_spa-auth/assets/index.auth-CAy4V6bY.js → variable vg
2captcha key: [REDACTED-KEY]

Registration Endpoint

POST https://app.lobehub.com/api/auth/sign-up/email?fp=[REDACTED-KEY]&referral=fQXk8Gr5
Headers:
  Origin: https://app.lobehub.com
  Referer: https://app.lobehub.com/signup?referral=fQXk8Gr5
  Content-Type: application/json
  X-Captcha-Response: <turnstile_token_from_2captcha>
Body: {"email": "...", "password": "...", "name": "..."}

CRITICAL: curl_cffi Required

The Turnstile token from 2captcha must be sent via curl_cffi with impersonate="chrome124". Plain httpx/requests will get CAPTCHA_FAILED because Clerk validates the TLS fingerprint matches the Turnstile solver's browser.

from curl_cffi import requests as curl_requests

# BEFORE: pip install curl_cffi
# WARNING: requires impersonate="chrome124" — without it CAPTCHA_FAILED

resp = curl_requests.post(
    "https://app.lobehub.com/api/auth/sign-up/email?fp=...&referral=fQXk8Gr5",
    json={"email": email, "password": pw, "name": name},
    headers={
        "Origin": "https://app.lobehub.com",
        "Referer": "https://app.lobehub.com/signup?referral=fQXk8Gr5",
        "Content-Type": "application/json",
        "X-Captcha-Response": turnstile_token,
        "User-Agent": "Mozilla/5.0 ... Chrome/[REDACTED-IP] ..."
    },
    impersonate="chrome124"  # ← THIS IS THE KEY
)

Verified: 9 accounts registered via this method

Account format in lobehub_cloud_accounts.json:

{
  "email": "[REDACTED-EMAIL]",
  "password": "random14char",
  "name": "user",
  "session_token": "",
  "created_at": "2026-07-02T...",
  "referral": "fQXk8Gr5"
}

Issue: Email Verification Required

After registration, login returns EMAIL_NOT_VERIFIED (403). Accounts need:

IMAP access to read verification email from LobeHub
Click verification link or extract code

This is NOT yet automated. Cloud accounts are registered but not activated.

Previous (deprecated) attempts

X-Captcha-Response as body field → CAPTCHA_REQUIRED (wrong field name)
cf-turnstile-response body field → CAPTCHA_REQUIRED
Plain httpx without impersonation → CAPTCHA_FAILED
MCP Playwright browser → Cloudflare blocks datacenter IP

2.4 KiB Raw Blame History