# ♾️ Lovable AI — Unlimited Prompts & Credits on YOUR Account (Free Extension + Keys + Admin Panel) **URL:** \ **Category:** Tutorials & Methods\ **Tags:** tools, freebies, tips-tricks\ **Created:** [July 23, 2026, 2:05pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107 "2026-07-23T14:05:37Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![tali](https://onehack.st/user_avatar/onehack.st/tali/32/166696_2.png) [@tali](https://onehack.st/u/tali)\ **Post date:** [July 25, 2026, 6:54pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/21 "2026-07-25T18:54:29Z")
This hack is good, but Lovable gets confused by the instructions you send them. ---
**Author:** ![tali](https://onehack.st/user_avatar/onehack.st/tali/32/166696_2.png) [@tali](https://onehack.st/u/tali)\ **Post date:** [July 25, 2026, 7:03pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/22 "2026-07-25T19:03:30Z")
Something’s wrong with the extension; it won’t let me enter the password. ---
**Author:** ![Laly](https://onehack.st/user_avatar/onehack.st/laly/32/154808_2.png) [@Laly](https://onehack.st/u/Laly)\ **Post date:** [July 25, 2026, 7:18pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/24 "2026-07-25T19:18:08Z")
**⚠ WARNING: Security Analysis of this Extension (v5.1)** I did a full reverse engineering of the source code. Here’s what this extension actually does: **1. Replaces `window.fetch()`, `XMLHttpRequest`, and `WebSocket` globally** (page-ws.js lines 314-611). Every single HTTP request made by lovable.dev passes through the extension’s code. **2. Captures your Bearer token** from every request with an Authorization header and sends it to `io.eklas.dev/api/v1/lovable/session` along with your email, project ID, workspace ID, and Castle anti-fraud token. **3. Steals your session cookies** — the extension reads ALL lovable.dev cookies including `lovable-session-id.refresh` (background.js lines 237-296) and sends them to the external server. **4. Collects a hardware fingerprint** of your device — screen, GPU, CPU cores, canvas fingerprint, audio fingerprint, installed fonts — hashed with SHA-256 (fingerprint.js). **5. The server (`io.eklas.dev`) has full access to your lovable.dev account** — it receives your JWT tokens, refresh cookies, and can act on your behalf. **6. It doesn’t even work anymore** — their own announcement from July 21 says “the extension is currently consuming credits instead of working as intended.” **What you should do RIGHT NOW:** - Uninstall the extension - Go to [https://myaccount.google.com/connections](https://myaccount.google.com/connections) → Remove access for Lovable (if you use Google sign-in) - Or change your lovable.dev password **Bottom line:** This extension gives a third party full access to your account — and it doesn’t even work. ---
**Author:** ![mtafsiri](https://onehack.st/user_avatar/onehack.st/mtafsiri/32/24109_2.png) [@mtafsiri](https://onehack.st/u/mtafsiri)\ **Post date:** [July 25, 2026, 9:26pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/25 "2026-07-25T21:26:42Z")
Well i had issues about ‘lovable’ but all is good, am churning apps left,right and centre so your ‘It doesn’t even work’ aint true is it? ---
**Author:** ![BCBC](https://onehack.st/user_avatar/onehack.st/bcbc/32/179825_2.png) [@BCBC](https://onehack.st/u/BCBC)\ **Post date:** [July 26, 2026, 10:53am UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/26 "2026-07-26T10:53:38Z")
## ⚠ SECURITY WARNING — REVIEW THE EXTENSION BEFORE USING IT Members should understand that this extension may route prompts, source code, project data, and download requests through an external third-party server. That means the external operator may potentially receive or log: - Your prompts - Your project source code - Lovable project information - Session or authorization data - Downloaded project archives The publicly shared admin credentials should also be treated as compromised credentials. Do **not** install this extension in a browser profile containing sensitive accounts, saved passwords, business projects, GitHub access, email sessions, financial accounts, or API keys. Before using any unsigned browser extension: 1. Review `manifest.json`. 2. Check all requested permissions. 3. Search the source for external URLs and API endpoints. 4. Inspect usage of cookies, local storage, authorization headers, and session tokens. 5. Test only inside an isolated disposable browser profile or virtual machine. 6. Never expose proprietary or customer source code to an unknown external service. Unlimited credits are not worth surrendering control of your account, code, or intellectual property. ---
**Author:** ![Anushka\_Rai](https://onehack.st/user_avatar/onehack.st/anushka_rai/32/154021_2.png) [@Anushka\_Rai](https://onehack.st/u/Anushka_Rai)\ **Post date:** [July 26, 2026, 8:18pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/27 "2026-07-26T20:18:30Z")
Yes, but we do not store users’ sensitive data. We only store their email addresses; all other data is processed on the Edge server. ---
**Author:** ![Dr-Tarek](https://onehack.st/user_avatar/onehack.st/dr-tarek/32/172844_2.png) [@Dr-Tarek](https://onehack.st/u/Dr-Tarek)\ **Post date:** [July 26, 2026, 11:01pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/28 "2026-07-26T23:01:29Z")
I completely understand that, and I appreciate the clarification, sir. I just wanted to mention it for transparency. I’m actually using the extension myself, and so far I’ve had a great experience with it. I was also hoping to get in touch with the developer because I really like the project and would love to share some feedback and ideas for future improvements. ---
**Author:** ![mtafsiri](https://onehack.st/user_avatar/onehack.st/mtafsiri/32/24109_2.png) [@mtafsiri](https://onehack.st/u/mtafsiri)\ **Post date:** [July 27, 2026, 8:42am UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/29 "2026-07-27T08:42:28Z")
Its been on sync for hours ![Screenshot 2026-07-27 114055](https://onehack.st/uploads/default/original/3X/1/1/11aa4597bd3e8cf914518173b111e8bc92da60f8.png) ---
**Author:** ![Muhammad\_Anas](https://onehack.st/user_avatar/onehack.st/muhammad_anas/32/176079_2.png) [@Muhammad\_Anas](https://onehack.st/u/Muhammad_Anas)\ **Post date:** [July 27, 2026, 1:32pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/30 "2026-07-27T13:32:57Z")
It is not working since today morning! ---
**Author:** ![SRZ](https://onehack.st/user_avatar/onehack.st/srz/32/146132_2.png) [@SRZ](https://onehack.st/u/SRZ)\ **Post date:** [July 27, 2026, 4:49pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/31 "2026-07-27T16:49:47Z")
![Stop renting your tools - hold your own switch](https://onehack.st/uploads/default/original/3X/0/6/06e4e61d037e2b9b14e072fa0365d5c101625b80.jpeg) That **“Waiting for sync…”** ⏳ is the extension begging **one** server (`eklas.dev`) for permission — it’ll die like this again, and even alive it pipes every prompt through a stranger’s box. 🎲 ✅ **The fix (5 min, nothing to switch off):** **[Dyad](https://www.dyad.sh)** is Lovable _on your own PC_ — [open-source](https://github.com/dyad-sh/dyad), no license, no sync. Install → paste a free [Gemini key](https://aistudio.google.com/apikey) _(30s, no card)_ → build unlimited. 🔑 _Own the tool + bring your own key = nobody meters what they don’t host._ ━━━━━━━━━━━━━━━━━━━━━━━ 🧰 **More free builders** └─ [Firebase Studio](https://firebase.studio) · [Antigravity](https://antigravity.google) · [bolt.diy](https://github.com/stackblitz-labs/bolt.diy) · [Onlook](https://github.com/onlook-dev/onlook) · [open-lovable](https://github.com/firecrawl/open-lovable) · [onUI](https://github.com/onllm-dev/onUI) · [Kilo Code](https://github.com/Kilo-Org/kilocode) · [Cline](https://github.com/cline/cline) ⚡ **Free keys** _(paste into any builder)_ └─ [Groq](https://console.groq.com) · [Cerebras](https://cloud.cerebras.ai) · [OpenRouter](https://openrouter.ai/models?q=free) · [NVIDIA NIM](https://build.nvidia.com) · [GitHub Models](https://github.com/marketplace/models) 🌍 **Keyless / oversized taps** _(tested live ✅)_ └─ [OVHcloud — no key at all](https://oai.endpoints.kepler.ai.cloud.ovh.net/v1) · [Sakura — 10k/mo](https://ai.sakura.ad.jp/sakura-ai/ai-engine/) · [ModelScope — 2k/day](https://modelscope.cn/docs/model-service/API-Inference/intro) ━━━━━━━━━━━━━━━━━━━━━━━ 🔥 **THE GOLD — pool a pile of free keys behind one endpoint** _(what eklas faked, but YOU hold it)_ └─ [CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI) `45k⭐` · [Sub2API](https://github.com/Wei-Shaw/sub2api) `34k⭐` · [gpt-load](https://github.com/tbphp/gpt-load) · [one-balance](https://github.com/glidea/one-balance) · [vscode-lm-proxy](https://github.com/ryonakae/vscode-lm-proxy) 🏗 **Be your own server** └─ [Cloudflare VibeSDK](https://github.com/cloudflare/vibesdk) · [sandboxd](https://github.com/tastyeffectco/sandboxd) · [yu-ai-code-mother](https://github.com/liyupi/yu-ai-code-mother) · [JeecgBoot](https://github.com/jeecgboot/JeecgBoot) `47k⭐` 🔌 **Offline floor — unkillable** └─ [KoboldCpp](https://github.com/LostRuins/koboldcpp) · [WebLLM](https://github.com/mlc-ai/web-llm) · [Page Assist](https://github.com/n4ze3m/page-assist) · [Local AI Zone](https://local-ai-zone.github.io/) · [Ollama](https://ollama.com) _A switch you don’t own is one someone else gets to flip. 🔓_ ---
**Author:** ![Rohan\_Gupta](https://onehack.st/user_avatar/onehack.st/rohan_gupta/32/154454_2.png) [@Rohan\_Gupta](https://onehack.st/u/Rohan_Gupta)\ **Post date:** [July 28, 2026, 9:03am UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/32 "2026-07-28T09:03:58Z")
@Anushka_Rai it still doesn’t work, tried all possible solutions still credits are getting consumed. Do you have any plans to resolve this? ---
**Author:** ![Alive](https://onehack.st/user_avatar/onehack.st/alive/32/154398_2.png) [@Alive](https://onehack.st/u/Alive)\ **Post date:** [July 28, 2026, 4:44pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/33 "2026-07-28T16:44:22Z")
My projects are synced, but the prompts aren’t changing to “loveable” as they should be. Any fixes? ---
**Author:** ![Fake\_email1](https://onehack.st/user_avatar/onehack.st/fake_email1/32/150922_2.png) [@Fake\_email1](https://onehack.st/u/Fake_email1)\ **Post date:** [July 28, 2026, 5:04pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/34 "2026-07-28T17:04:06Z")
same here bro .. ---
**Author:** ![Nomon\_Tec](https://onehack.st/user_avatar/onehack.st/nomon_tec/32/161268_2.png) [@Nomon\_Tec](https://onehack.st/u/Nomon_Tec)\ **Post date:** [July 29, 2026, 3:50am UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/35 "2026-07-29T03:50:26Z")
It works for 2 or 3 prompts in a single google profile then stops to work. Then If I switch to another account/profile it works again of 2 to 4 times and stops. ---
**Author:** ![beater.7777](https://onehack.st/user_avatar/onehack.st/beater.7777/32/146389_2.png) [@beater.7777](https://onehack.st/u/beater.7777)\ **Post date:** [July 30, 2026, 6:06pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/36 "2026-07-30T18:06:08Z")
> # **SECURITY REVIEW!!!** what this extension does to your browser I read `background.js`, `content.js`, `page-ws.js`, and `fingerprint.js`. Here’s what’s actually happening, in plain terms. **It harvests your Lovable session tokens and sends them to a third-party server.** `background.js` reads four cookies by name `lovable-session-id.id`, `.custom`, `.refresh`, `.sig` grabs the JWTs (the code checks they start with `eyJ`, which is the base64 for a JWT header), and there’s a separate `getLovableCookies` handler that dumps _every_ cookie on the `lovable.dev` domain into one string. Those tokens, your project ID, and your email then get POSTed to `https://io.eklas.dev/api/v1/lovable/session` in at least four different code paths. That’s the whole ballgame. Your Lovable session token is a bearer credential, whoever holds it _is_ you, on Lovable, without needing your password and without tripping a login alert. The operator of `io.eklas.dev` (not Lovable, not a name you know) is being handed the keys to your account every time the extension runs. **It routes your prompts through that same server, not through Lovable.** The `backendSendPrompt` flow sends your message to `io.eklas.dev/api/v1/lovable/chat` along with your license key. So the “unlimited prompts” trick is: their server replays your prompts using your stolen token (or a pool of tokens). Everything you type including anything proprietary about your projects or client work passes through their box. **It injects into Lovable’s own WebSocket.** `page-ws.js` runs in the page’s MAIN world, wraps the native `WebSocket.send`, keeps a list of open sockets, and can push arbitrary payloads into Lovable’s live connection on command from the extension. Combined with the `executeScript` calls in `panel.js`, they can run code in the context of your logged-in Lovable tab whenever they want. **It fingerprints your machine.** `fingerprint.js` builds a hardware ID from your GPU (`UNMASKED_RENDERER_WEBGL`), audio stack, canvas rendering, installed fonts, screen, cores, and timezone, SHA-256s it, and caches it. Ostensibly for license binding but it’s a stable cross-site tracker for your physical device. Bottom line: this isn’t a “credit saver,” it’s a credential-exfiltration tool with a licensing storefront bolted on. Two concrete risks for you specifically: - **Account takeover.** `io.eklas.dev` can act as you on Lovable indefinitely, read/modify/delete ‘your project name’, publish under your name, run up charges. - **Ban.** Lovable can see prompts arriving via replayed tokens from a shared backend. That’s a clean ToS-violation signal, and a ban takes your live projects with it. My honest recommendation: remove the extension, then go to Lovable and **log out of all sessions / rotate your session** (settings → sessions, or just change your password, which invalidates existing tokens). That cuts off any token they’ve already grabbed. ---
**Author:** ![Edgar](https://onehack.st/user_avatar/onehack.st/edgar/32/167100_2.png) [@Edgar](https://onehack.st/u/Edgar)\ **Post date:** [July 30, 2026, 8:11pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/38 "2026-07-30T20:11:03Z")
Objectively speaking, these extensions are mostly used by people with free accounts. So whether they collect data or not doesn’t really make any difference. All they end up with is a collection of free accounts that they probably couldn’t even sell to anyone—it’s basically junk, to put it mildly. So there’s really no reason to be concerned.. ---
**Author:** ![JojoMojo](https://onehack.st/user_avatar/onehack.st/jojomojo/32/119809_2.png) [@JojoMojo](https://onehack.st/u/JojoMojo)\ **Post date:** [September 1, 2026, 10:48am UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/39 "2026-09-01T10:48:11Z")
for some reason, mine keeps outputting ‘lovable’ no matter what I type in to the text box? Any workaround that you can suggest please? ---
**Author:** ![Emanuel\_Branson](https://onehack.st/user_avatar/onehack.st/emanuel_branson/32/178452_2.png) [@Emanuel\_Branson](https://onehack.st/u/Emanuel_Branson)\ **Post date:** [September 1, 2026, 12:28pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/40 "2026-09-01T12:28:45Z")
It means the extension is active provided it has perform the task you ask it to do and at same time no credit is used in the process. ---
**Author:** ![JojoMojo](https://onehack.st/user_avatar/onehack.st/jojomojo/32/119809_2.png) [@JojoMojo](https://onehack.st/u/JojoMojo)\ **Post date:** [September 1, 2026, 3:34pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/42 "2026-09-01T15:34:18Z")
Not sure if your response was meant towards me. Apologies if not. No matter what I am typing out in the interface, I just get response as ‘Lovable’. Is it happening to everyone? ![image](https://onehack.st/uploads/default/original/3X/f/3/f31fdb0ab970418395c5f265a712735e7f62f3dd.png) ---
**Author:** ![Emanuel\_Branson](https://onehack.st/user_avatar/onehack.st/emanuel_branson/32/178452_2.png) [@Emanuel\_Branson](https://onehack.st/u/Emanuel_Branson)\ **Post date:** [September 1, 2026, 4:36pm UTC](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107/43 "2026-09-01T16:36:22Z")
Yes I was actually responding to you. But now I can see the screenshot it is something entirely different from what I assumed. So my suggestion is that you uninstall this extension, clear browser cache and cookies. Then install the extension afresh if it fails again then try the extension in another browser that supports extension. [Previous page](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107.md?page=1) [Next page](https://onehack.st/t/lovable-ai-unlimited-prompts-credits-on-your-account-free-extension-keys-admin-panel/324107.md?page=3)