How to Integrate Lovable with LastPass

LastPass Enterprise API authentication uses two values: your Account Number and a Provisioning Hash. Both are found in the LastPass Admin Console. The provisioning hash is a long alphanumeric string that acts as your API secret — treat it with the same care as a password. To obtain your credentials: log in to the LastPass Admin Console (admin.lastpass.com). Click on the Settings gear icon in the left sidebar. Navigate to Advanced → Enterprise API. If you do not see an API hash, click 'Generate' to create one. Copy both the Account Number (a numeric ID) and the Provisioning Hash. These are the two values you need for every LastPass API call. Note: the LastPass Enterprise API uses a custom authentication method rather than standard Bearer tokens. Each API request includes the account number and hash in the request body (as form parameters or JSON fields, depending on the endpoint). This is different from most REST APIs that use headers — your Edge Function needs to handle this correctly. Now store these in Lovable: open your Lovable project, click '+' to open the panels, select Cloud, then navigate to Secrets. Click 'Add Secret' and create: - LASTPASS_ACCOUNT_NUMBER: your numeric account number - LASTPASS_PROVISIONING_HASH: your provisioning hash Never paste the provisioning hash into Lovable's chat interface — it is as sensitive as a master password. Always use the Secrets panel.

The LastPass Enterprise API base URL is https://lastpass.com/enterpriseapi.php and uses a form-encoded or JSON POST body for authentication and parameters rather than URL query parameters. Each request includes the 'cid' (company ID / account number), 'provhash' (provisioning hash), 'cmd' (the API command like 'getuserdata' or 'getsharedfolderdata'), and any additional parameters the command requires. The Edge Function wraps this API in a RESTful interface that your React frontend can call cleanly. The function reads credentials from Secrets, constructs the LastPass API POST request with the appropriate 'cmd' value, and returns the parsed response. Command examples for common tasks: - getuserdata: returns all users in the account with security scores - getsharedfolderdata: returns all shared folders with member lists - getgroups: returns all groups and their members - reporting: returns event audit logs (requires additional date parameters) Because the LastPass API uses command-based POSTs rather than REST paths, the Edge Function allowlist is based on command names rather than URL paths. Only permit read-only commands in the allowlist — commands like 'adduser' or 'deleteuser' should require additional authentication if you choose to expose them.

1import { serve } from 'https://deno.land/std@0.168.0/http/server.ts'
2
3const corsHeaders = {
4  'Access-Control-Allow-Origin': '*',
5  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
6}
7
8// Only allow read-only LastPass API commands
9const ALLOWED_COMMANDS = ['getuserdata', 'getsharedfolderdata', 'getgroups', 'reporting']
10
11serve(async (req) => {
12  if (req.method === 'OPTIONS') {
13    return new Response('ok', { headers: corsHeaders })
14  }
15
16  if (req.method !== 'POST') {
17    return new Response(
18      JSON.stringify({ error: 'Only POST requests are supported' }),
19      { status: 405, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
20    )
21  }
22
23  try {
24    const accountNumber = Deno.env.get('LASTPASS_ACCOUNT_NUMBER')
25    const provHash = Deno.env.get('LASTPASS_PROVISIONING_HASH')
26
27    if (!accountNumber || !provHash) {
28      return new Response(
29        JSON.stringify({ error: 'Missing LastPass credentials in Secrets' }),
30        { status: 500, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
31      )
32    }
33
34    const body = await req.json()
35    const { cmd, ...additionalParams } = body
36
37    if (!cmd || !ALLOWED_COMMANDS.includes(cmd)) {
38      return new Response(
39        JSON.stringify({ error: 'Command not permitted', allowed: ALLOWED_COMMANDS }),
40        { status: 403, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
41      )
42    }
43
44    const lastpassPayload = {
45      cid: accountNumber,
46      provhash: provHash,
47      cmd,
48      ...additionalParams,
49    }
50
51    const response = await fetch('https://lastpass.com/enterpriseapi.php', {
52      method: 'POST',
53      headers: {
54        'Content-Type': 'application/json',
55      },
56      body: JSON.stringify(lastpassPayload),
57    })
58
59    const data = await response.json()
60
61    // LastPass returns status 'OK' or 'FAIL' in the response body
62    if (data.status === 'FAIL') {
63      return new Response(
64        JSON.stringify({ error: 'LastPass API error', message: data.message }),
65        { status: 400, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
66      )
67    }
68
69    return new Response(
70      JSON.stringify(data),
71      { headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
72    )
73  } catch (error) {
74    return new Response(
75      JSON.stringify({ error: error.message }),
76      { status: 500, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
77    )
78  }
79})

With the Edge Function deployed, build the React dashboard that surfaces LastPass security data. The most immediately useful view for security teams is the user security score report — showing which team members have low overall security scores, how many weak or reused passwords each user has, and their MFA enrollment status. Call the lastpass-proxy Edge Function with cmd: 'getuserdata' to get the full user list with security metrics. The response includes a 'Users' object (keyed by username) where each user entry contains: score (0-100 overall security score), mpstrength (master password strength), multifactor (MFA method or 'None'), sites (total passwords), weakpasswords, reusedpasswords, and neverloggedin. Process this data in the React component: sort users by security score ascending (lowest first, as these are highest risk), filter out service accounts or inactive users if needed, and display in a DataTable with color-coded score badges. For the shared folders view, call cmd: 'getsharedfolderdata' to get all shared folders. The response includes each folder's shareid, sharedfoldername, and a Users list showing who has access and their permission level (read/write/admin). This is useful for access reviews — quickly identifying which folders have too many members or the wrong permission levels.

LastPass Enterprise's reporting API returns event logs for credential access, user actions, and administrative changes. For compliance frameworks that require evidence of credential access controls (SOC 2 CC6.1, ISO 27001 A.9), having a filterable audit log viewer inside your internal Lovable tools streamlines the evidence gathering process. The LastPass reporting API command requires a date range parameter. Call it with cmd: 'reporting', startdate: '2026-01-01', enddate: '2026-03-31', and an optional username filter. The API returns events with fields including the event type (e.g., 'User logged in', 'Shared a password', 'Opened a shared folder item'), the username, the target (what was accessed), and a timestamp. Build an audit log viewer component with: - Date range picker (default to last 30 days) - Username search filter - Event type filter (login events, sharing events, folder access events) - Paginated results table - CSV export button for audit report generation For compliance reviews, the CSV export is particularly important — auditors typically want a downloadable report rather than a live dashboard view. For teams with strict compliance requirements managing LastPass across multiple client organizations, RapidDev's team can help build a multi-tenant audit log system with scheduled report generation and automated email delivery to compliance stakeholders.

One of the most repetitive IT tasks is updating shared folder permissions when employees join or leave. The LastPass Enterprise API supports adding and removing users from shared folders (commands: 'addusersandgroups' and related management commands). Building this into your Lovable app gives IT administrators a purpose-built interface without exposing them to the full complexity of the LastPass admin console. Add read-write API commands to the allowlist carefully — write operations require additional safeguards. Restrict folder management actions to authenticated users with an 'it-admin' role in Supabase. Add a confirmation dialog before any API write call, log every management action to an audit table in Supabase, and display a clear success/failure message after each operation. The shared folder management view shows each folder as a card with its current members. Clicking 'Add User' opens a modal where the IT admin can enter an email address — the component then calls the lastpass-proxy Edge Function with the appropriate management command. Similarly, a 'Remove User' button triggers the removal command with a confirmation step. For offboarding workflows, consider building a dedicated 'Offboard User' page that shows all shared folders the departing user belongs to and allows batch removal from all folders with a single action — significantly faster than removing them folder by folder in the LastPass admin console.