autoreg-skills-max/skills/lobehub-pool/references/cloud-apikey-trpc-bypass-2026-07-05.md

LobeHub Cloud API Key Extraction via tRPC Bypass (2026-07-05)

Status

Working method to obtain LobeHub Cloud API keys without UI access.

• api_key_manage: false is a UI-only feature flag; the backend tRPC endpoint still works.
• getApiKeys returns masked keys (sk-lh-...xxxx).
• createApiKey returns the full key exactly once — save it immediately.

Endpoints

POST https://app.lobehub.com/api/auth/sign-in/email
GET  https://app.lobehub.com/trpc/lambda/apiKey.getApiKeys
POST https://app.lobehub.com/trpc/lambda/apiKey.createApiKey

Prerequisites

• Cloud account with verified email and known password (e.g. [REDACTED-EMAIL] / TqLlOlrbmv7pvM70aA1!).
• 2captcha key and Turnstile solver for sitekey 0x4AAAAAACxm5ZI_WCU13SgI.
• Running from a clean DO/cloud IP to avoid Cloudflare blocks.

Login flow

import requests, json

def solve_turnstile(api_key):
    r = requests.post("https://2captcha.com/in.php", data={
        "key": api_key, "method": "turnstile",
        "sitekey": "0x4AAAAAACxm5ZI_WCU13SgI",
        "pageurl": "https://app.lobehub.com", "json": 1
    })
    cid = r.json()["request"]
    for _ in range(40):
        time.sleep(4)
        r = requests.get("https://2captcha.com/res.php", params={
            "key": api_key, "action": "get", "id": cid, "json": 1
        })
        if r.json().get("status") == 1:
            return r.json()["request"]
    raise Exception("captcha timeout")

cf_token = solve_turnstile("[REDACTED-KEY]")

s = requests.Session()
r = s.post("https://app.lobehub.com/api/auth/sign-in/email", headers={
    "Origin": "https://app.lobehub.com",
    "Referer": "https://app.lobehub.com/signin",
    "Content-Type": "application/json",
    "x-captcha-response": cf_token,
}, json={"email": "[REDACTED-EMAIL]", "password": "TqLlOlrbmv7pvM70aA1!"}, timeout=15)
assert r.status_code == 200
# Session cookies are now stored in `s`.

Create API key (full key returned once)

r = s.post("https://app.lobehub.com/trpc/lambda/apiKey.createApiKey", headers={
    "Origin": "https://app.lobehub.com",
    "Referer": "https://app.lobehub.com/settings/developer",
    "Content-Type": "application/json",
}, json={"json": {"name": "my-key"}}, timeout=15)

key_data = r.json()["result"]["data"]["json"]
full_key = key_data["key"]  # 102 chars, hex:hex:hex
key_id   = key_data["id"]
print(full_key)

List keys (masked)

r = s.get("https://app.lobehub.com/trpc/lambda/apiKey.getApiKeys", headers={
    "Origin": "https://app.lobehub.com",
    "Referer": "https://app.lobehub.com/settings",
})
print(r.json())

Key format

• 102-character string: hex26:hex32:hex37
• Example: dea84dd5c27a37428eb8a658:[REDACTED-KEY]:4cef49218af00ad952ec0fef46fa72be85833db49e07
• UI displays masked as sk-lh-...xxxx.
• Save the create response to a file immediately. Terminal output often truncates the last ~5 characters.

Bulk key creation

import json
keys = []
for i in range(10):
    r = s.post("https://app.lobehub.com/trpc/lambda/apiKey.createApiKey",
        headers={"Origin": "https://app.lobehub.com", "Referer": "https://app.lobehub.com/settings/developer", "Content-Type": "application/json"},
        json={"json": {"name": f"auto-{i}"}}, timeout=15)
    key = r.json()["result"]["data"]["json"]["key"]
    keys.append({"name": f"auto-{i}", "key": key})
    with open("/root/lobehub_keys.json", "w") as f:
        json.dump(keys, f, indent=2)

Important caveats

• /api/v1 and api.lobehub.com/v1 are not the chat endpoint and currently fail or return Vercel errors.
• The actual chat flow uses aiAgent.execAgent (see references/cloud-chat-internal-endpoint-2026-07-05.md).
• Mass registration via t-online.de subaddressing was blocked because LobeHub verification emails never arrived in the INBOX; do not rely on t-online.de for Cloud verification.