Cloud API Key — Blocked at /api/v1 (2026-07-04)

Discovery

API keys were successfully created via tRPC apiKey.createApiKey (bypassing api_key_manage: false feature flag). The key format is id:hash:secret (three colon-separated hex strings).

Blocked

The key does NOT work with https://app.lobehub.com/api/v1:

GET /api/v1/models → 500 {"error":"Authentication required"} (Cloudflare)
POST /api/v1/chat/completions → 404 (Not Found)

Even with valid Cloudflare clearance cookies (cf_clearance, cf_bm) and Better Auth session cookies (__Secure-better-auth.session_token), the endpoint rejects the key.

Attempted Auth Formats

All returned 500 "Authentication required":

Authorization: Bearer <key>
Authorization: Bearer sk-lh-<key>
Authorization: Bearer lb-<key>
x-api-key: <key>
`x-api-key: [REDACTED]
api-key: <key>
Query param: ?key=<key>

Attempted API Endpoints

All returned 404:

https://api.lobehub.com/v1/models (DEPLOYMENT_NOT_FOUND on Vercel)
https://cloud.lobehub.com/v1/models (DEPLOYMENT_NOT_FOUND)
https://lobehub.com/api/v1/models
https://app.lobehub.com/api/v1/chat/completions
https://app.lobehub.com/api/chat

Key Details

X-Matched-Path: /api/v1/[[...route]] — confirms the route exists
Server: cloudflare — Cloudflare is intercepting
Access-Control-Allow-Origin: * — CORS is open
The endpoint exists but auth is rejected before reaching the app

Hypothesis

The API key is NOT for an OpenAI-compatible endpoint — it may be for the LobeHub Agent API
Cloudflare may require a specific header or cookie that we haven't identified
The API key may need to be "activated" or the account may need a paid plan
The correct API base URL may be different from app.lobehub.com/api/v1

Next Steps

Test the key with the LobeHub Agent API (different endpoint)
Check if the key works after upgrading the account plan
Look for API documentation in the LobeHub source code
Try the key through the LobeHub CLI tool

2.0 KiB Raw Blame History