How to Integrate Bolt.new with LastPass

Before writing any code, it is essential to understand the exact scope of the LastPass API so you build the right solution for your use case. The LastPass Enterprise Admin API (available at lastpass.com/enterprise_apidoc.php) provides these operations: create users, delete users, update user group memberships, disable/enable user accounts, list users and groups, and retrieve usage reports. All of these are user management operations — creating accounts in the LastPass system and organizing them. The API does NOT provide: reading vault contents (impossible by design — zero-knowledge encryption), writing passwords to vaults, authenticating users for your web application, issuing JWT tokens or session credentials, or any form of SSO/SAML integration from a developer API. The API is authenticated via a hashed combination of your LastPass Enterprise account number and a provisioning hash, sent as an HTTP POST parameter. There is no OAuth flow, no Bearer tokens — just a simple API key approach. API calls are POST requests to https://lastpass.com/enterpriseapi.php with a JSON body containing the command and credentials. If your use case is: 'I want my Bolt app to have user accounts and login' — use Auth0, Supabase Auth, or Clerk. These are designed for app authentication. LastPass is for storing credentials that humans use via their browser extension or mobile app, not for app-to-app authentication. If your use case is: 'I need to automate employee onboarding/offboarding in LastPass Enterprise' — then the Enterprise Admin API is exactly right, and this tutorial covers that path in the steps below.

1// The LastPass Enterprise API endpoint
2// POST https://lastpass.com/enterpriseapi.php
3// Content-Type: application/json
4//
5// All requests follow this structure:
6// {
7//   "cid": "your_company_account_number",
8//   "provhash": "your_provisioning_hash",
9//   "cmd": "command_name",
10//   "data": { ...command-specific data... }
11// }
12//
13// Available commands:
14// - getuserdata: list all users and their info
15// - batchadd: create new users
16// - batchdelete: delete/deactivate users
17// - groupuseradd: add user to a group
18// - groupuserdelete: remove user from group
19//
20// There is NO command to:
21// - read vault contents
22// - authenticate app users
23// - issue tokens for your web app

For enterprise user provisioning, retrieve your LastPass API credentials from the LastPass Enterprise Admin Dashboard. Log into your LastPass Enterprise admin console at lastpass.com/enterpriseadmin/. Navigate to Advanced → Enterprise API. Here you will find your Company Account Number (a numeric ID) and can generate a Provisioning Hash — a long hexadecimal string that authenticates API requests. The Provisioning Hash grants full administrative control over your LastPass Enterprise account: it can create, modify, and delete any user. Treat it like a root password. Store it only in server-side environment variables and never include it in client-side code, commit it to version control, or log it. In your Bolt project, add these to the .env file: LASTPASS_ACCOUNT_NUMBER (the numeric company ID) and LASTPASS_PROVISION_HASH (the hex provisioning hash). Both are used in every API request and should be server-side only — no NEXT_PUBLIC_ prefix. The LastPass Enterprise API does not have a sandbox or test environment. All API calls affect your live LastPass enterprise account. For testing, create a set of test user email addresses that you control (e.g., testuser1+lastpass@yourcompany.com) and use those for development. Clean up test users after development to avoid billing for unused accounts. Note that during development in Bolt's WebContainer, outbound HTTPS POST requests to https://lastpass.com/enterpriseapi.php work fine — the WebContainer supports outbound HTTP/HTTPS. Incoming webhooks (LastPass can push event notifications to a URL) require a deployed endpoint and cannot reach the WebContainer.

1// lib/lastpass.ts
2const ACCOUNT_ID = process.env.LASTPASS_ACCOUNT_NUMBER!;
3const PROV_HASH = process.env.LASTPASS_PROVISION_HASH!;
4
5interface LastPassUser {
6  username: string;
7  fullname: string;
8  mpstrength: string;
9  sites: string;
10  notes: string;
11  formfills: string;
12  applications: string;
13  attachments: string;
14  groups: string[];
15}
16
17interface LastPassResponse {
18  status: string;
19  count?: number;
20  Users?: Record<string, LastPassUser>;
21}
22
23async function lastpassRequest(
24  cmd: string,
25  data?: Record<string, unknown>
26): Promise<LastPassResponse> {
27  const res = await fetch('https://lastpass.com/enterpriseapi.php', {
28    method: 'POST',
29    headers: { 'Content-Type': 'application/json' },
30    body: JSON.stringify({
31      cid: ACCOUNT_ID,
32      provhash: PROV_HASH,
33      cmd,
34      data,
35    }),
36  });
37  if (!res.ok) {
38    throw new Error(`LastPass API error: ${res.status} ${await res.text()}`);
39  }
40  return res.json();
41}
42
43export async function listUsers(): Promise<LastPassUser[]> {
44  const result = await lastpassRequest('getuserdata', { getgroups: true });
45  return Object.values(result.Users ?? {});
46}
47
48export async function createUser(
49  email: string,
50  firstName: string,
51  lastName: string
52): Promise<LastPassResponse> {
53  return lastpassRequest('batchadd', {
54    op: [{ username: email, firstname: firstName, lastname: lastName }],
55  });
56}
57
58export async function deleteUser(
59  username: string,
60  deleteAction: 0 | 1 | 2 = 0
61): Promise<LastPassResponse> {
62  // deleteAction: 0=deactivate, 1=delete keep data, 2=delete all data
63  return lastpassRequest('batchdelete', {
64    op: [{ username, deleteaction: deleteAction }],
65  });
66}
67
68export async function addUserToGroup(
69  username: string,
70  groupName: string
71): Promise<LastPassResponse> {
72  return lastpassRequest('groupuseradd', {
73    op: [{ username, groupname: groupName }],
74  });
75}

With the LastPass client utility ready, create the Next.js API routes that your Bolt frontend will call for user provisioning operations. These routes wrap the LastPass API calls with proper input validation, error handling, and authentication to ensure only authorized administrators can trigger provisioning actions. The most important provisioning operations are: creating a LastPass account when a new employee joins (triggered from HR system or admin dashboard), adding the new user to the appropriate group based on their department or role, and deactivating or deleting the account when an employee leaves. These three actions cover the core employee lifecycle from a LastPass perspective. Input validation is critical here: the username is an email address, so validate email format before calling the API. Group names must match exactly the group names configured in LastPass Enterprise — a typo means the user is not added to their correct group. Consider fetching the list of available groups from the API and using a dropdown selector in the UI to prevent typos. For the admin UI side, build a simple table of current LastPass users fetched from the getuserdata command, a form to add new users with first name, last name, email, and group selection, and action buttons for deactivating users. Bolt can scaffold this entire admin panel UI from a prompt — describe the table, form, and action buttons and it will generate production-quality React components.

1// app/api/lastpass/users/route.ts
2import { NextResponse } from 'next/server';
3import { listUsers, createUser } from '@/lib/lastpass';
4
5function checkAdminKey(request: Request): boolean {
6  return request.headers.get('x-admin-key') === process.env.ADMIN_API_KEY;
7}
8
9export async function GET(request: Request) {
10  if (!checkAdminKey(request)) {
11    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
12  }
13  try {
14    const users = await listUsers();
15    return NextResponse.json(users);
16  } catch (error: unknown) {
17    const e = error as { message: string };
18    return NextResponse.json({ error: e.message }, { status: 500 });
19  }
20}
21
22export async function POST(request: Request) {
23  if (!checkAdminKey(request)) {
24    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
25  }
26  try {
27    const { email, firstName, lastName } = await request.json();
28    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
29    if (!email || !emailRegex.test(email)) {
30      return NextResponse.json({ error: 'Invalid email address' }, { status: 400 });
31    }
32    if (!firstName?.trim() || !lastName?.trim()) {
33      return NextResponse.json({ error: 'First and last name are required' }, { status: 400 });
34    }
35    const result = await createUser(email, firstName.trim(), lastName.trim());
36    return NextResponse.json(result, { status: 201 });
37  } catch (error: unknown) {
38    const e = error as { message: string };
39    return NextResponse.json({ error: e.message }, { status: 500 });
40  }
41}

If your goal is to add login, user accounts, and authentication to your Bolt app — rather than manage enterprise LastPass accounts — then Auth0 is the correct integration to use. Auth0 is an identity platform specifically built for web and mobile application authentication. It provides what LastPass deliberately does not: the ability to verify who a user is, issue JWT tokens, manage user sessions, and protect routes in your application. Auth0's free tier supports 7,500 monthly active users and unlimited logins — more than enough for most Bolt projects. It supports dozens of social login providers (Google, GitHub, Apple), email/password login with automatic password hashing and storage, magic link (passwordless) login, multi-factor authentication, and comprehensive user management. The Auth0 Next.js SDK (@auth0/nextjs-auth0) integrates with the App Router through a single dynamic route handler. Users are redirected to Auth0's hosted login page (you can customize its appearance), authenticate, and are redirected back to your app with a session. The SDK manages token refresh automatically. Protected routes check the session server-side using the getSession() function from the SDK. In Bolt's WebContainer, Auth0 login redirects work correctly during development because the preview URL is a real HTTPS URL that Auth0 can redirect back to. Set your Auth0 application's Allowed Callback URLs to include the Bolt preview URL. After deployment, add your Netlify or Vercel URL to the allowed list as well.

1// app/api/auth/[auth0]/route.ts
2import { handleAuth } from '@auth0/nextjs-auth0';
3export const GET = handleAuth();
4
5// app/dashboard/page.tsx
6import { getSession } from '@auth0/nextjs-auth0';
7import { redirect } from 'next/navigation';
8
9export default async function Dashboard() {
10  const session = await getSession();
11  if (!session) redirect('/api/auth/login');
12
13  const { user } = session;
14  return (
15    <div className="p-8">
16      <div className="flex items-center gap-4 mb-6">
17        {user.picture && (
18          <img
19            src={user.picture}
20            alt={user.name ?? 'User'}
21            className="w-12 h-12 rounded-full"
22          />
23        )}
24        <div>
25          <h1 className="text-2xl font-bold">{user.name}</h1>
26          <p className="text-gray-500">{user.email}</p>
27        </div>
28        <a
29          href="/api/auth/logout"
30          className="ml-auto px-4 py-2 bg-red-500 text-white rounded hover:bg-red-600"
31        >
32          Logout
33        </a>
34      </div>
35      <p>Welcome to your dashboard!</p>
36    </div>
37  );
38}

Whether you are building the LastPass Enterprise provisioning admin tool or the Auth0-authenticated dashboard, deploying to Netlify gives you a stable public URL and proper environment variable management. Deploy via Bolt's Settings → Applications → Netlify → Publish. After deployment, set environment variables in Netlify Dashboard → Site Settings → Environment Variables. For the LastPass integration: add LASTPASS_ACCOUNT_NUMBER, LASTPASS_PROVISION_HASH, and ADMIN_API_KEY. For Auth0: add AUTH0_SECRET, AUTH0_ISSUER_BASE_URL, AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET, and update AUTH0_BASE_URL to your Netlify domain. For the Auth0 integration specifically, you must add the Netlify URL to Auth0's application settings: go to Auth0 Dashboard → Applications → your app → Settings → Allowed Callback URLs and add https://your-app.netlify.app/api/auth/callback. Do the same for Allowed Logout URLs: https://your-app.netlify.app. LastPass Enterprise incoming webhooks — LastPass can push event notifications to a URL when user activity occurs — require the deployed Netlify URL. Create a POST /api/webhooks/lastpass route to receive these events. Register the URL in LastPass Enterprise Admin → Advanced → SIEM. Since Bolt's WebContainer has no public URL, webhook testing is only possible after deployment. During development, simulate webhook payloads by calling your API route directly from the Bolt preview with test JSON payloads.

1# netlify.toml
2[build]
3  command = "npm run build"
4  publish = ".next"
5
6[build.environment]
7  NODE_VERSION = "20"
8
9[[plugins]]
10  package = "@netlify/plugin-nextjs"