LobeHub Cloud Internal Chat Endpoint (2026-07-05)

Discovery

POST https://app.lobehub.com/webapi/chat/lobehub is exposed but requires a live browser session with Cloudflare clearance (cf_clearance) and a valid Better Auth session cookie. Direct curl from a datacenter IP fails with 403/500 even with a valid API key.

The programmatic chat path discovered via Playwright network capture is the tRPC call:

POST https://app.lobehub.com/trpc/lambda/aiAgent.execAgent?batch=1
GET  https://app.lobehub.com/trpc/lambda/message.getMessages

Execute agent

import requests, json, time

s = requests.Session()
# ... login first (see cloud-apikey-trpc-bypass-2026-07-05.md) ...

r = s.post("https://app.lobehub.com/trpc/lambda/aiAgent.execAgent?batch=1", headers={
    "Origin": "https://app.lobehub.com",
    "Referer": "https://app.lobehub.com/",
    "Content-Type": "application/json",
}, json={
    "0": {
        "json": {
            "agentId": "agt_CuyRvAsGEBtc",
            "appContext": {
                "agentDocumentId": None,
                "defaultTaskAssigneeAgentId": None,
                "documentId": None,
                "groupId": None,
                "orchestrationRole": None,
                "scope": None,
                "taskId": None,
                "threadId": None,
                "topicId": None,
            },
            "prompt": "Say hi in one word",
            "deviceId": None,
            "fileIds": [],
            "parentMessageId": None,
            "resumeApproval": None,
            "selectedToolIds": None,
            "trigger": None,
            "userInterventionConfig": {"approvalMode": "manual", "allowList": []},
        },
        "meta": {
            "values": {
                "appContext.agentDocumentId": ["undefined"],
                "appContext.defaultTaskAssigneeAgentId": ["undefined"],
                "appContext.documentId": ["undefined"],
                "appContext.groupId": ["undefined"],
                "appContext.orchestrationRole": ["undefined"],
                "appContext.scope": ["undefined"],
                "appContext.taskId": ["undefined"],
                "appContext.threadId": ["undefined"],
                "appContext.topicId": ["undefined"],
                "deviceId": ["undefined"],
                "parentMessageId": ["undefined"],
                "resumeApproval": ["undefined"],
                "selectedToolIds": ["undefined"],
                "trigger": ["undefined"],
            },
            "v": 1,
        },
    }
}, timeout=60)

data = r.json()[0]["result"]["data"]["json"]
topic_id = data["topicId"]
message_id = data["messageId"]

Poll for response

for attempt in range(15):
    time.sleep(3)
    r = s.get("https://app.lobehub.com/trpc/lambda/message.getMessages", params={
        "batch": "1",
        "input": json.dumps({"0": {"json": {
            "agentId": "agt_CuyRvAsGEBtc",
            "isolatedTopic": True,
            "topicId": topic_id,
        }}}},
        headers={"Origin": "https://app.lobehub.com", "Referer": "https://app.lobehub.com/"},
        timeout=15,
    )
    msgs = r.json()[0]["result"]["data"]["json"]
    for msg in msgs:
        print(msg.get("role"), msg.get("content"))

Observed models in chat UI

gpt-5.4-mini
gpt-5.5
claude-sonnet-5
claude-fable-5
nano-banana-2-lite
seedance-2.0

Notes

/api/v1/models and /api/v1/chat/completions are not functional entry points for Cloud.
A full OpenAI-compatible proxy would need to wrap aiAgent.execAgent + message.getMessages polling.
This was verified from DO server [REDACTED-IP]; local/DC IPs are blocked by Cloudflare for the tRPC endpoints too unless session + cf_clearance cookies are present.

3.7 KiB Raw Blame History