How to Integrate Replit with LastPass

Before writing any code, you need to enable API access in your LastPass Admin Console and collect your credentials. Log in to the LastPass Admin Console at lastpass.com/enterprise_console. In the left sidebar, navigate to Advanced Options, then select Enterprise API. If API access is not yet enabled, click Enable API Access and confirm. Once enabled, you will see your Account Number (the numeric ID for your enterprise account) and you will need to create a Provisioning Hash — this is a separate credential used specifically for user provisioning calls. To generate your Provisioning Hash, go to Admin Console > Company Settings > General and look for the Provisioning API section. Copy the hash displayed there. You will also need your standard API key, which is shown in the Enterprise API page. Note that the LastPass API uses a combination of your Account Number plus the API key for authentication headers, while provisioning operations use the Provisioning Hash. Keep both values safe — you will add them to Replit Secrets in the next step. Never paste these credentials directly into your code files, as Replit's Secret Scanner will flag them and they could be exposed if your Repl is made public.

Replit Secrets is the correct and secure place to store your LastPass credentials. Never hardcode API keys in your source files — Replit's Secret Scanner monitors your code and will warn you if it detects exposed credentials, but it's best practice to use Secrets from the start. Open your Replit project. In the left sidebar, click the lock icon (🔒) labeled Secrets. Click the + New Secret button. Create three secrets: set LASTPASS_ACCOUNT_NUMBER to your numeric account ID, LASTPASS_API_KEY to your API key value, and LASTPASS_PROVISIONING_HASH to your provisioning hash. Each secret is encrypted at rest and injected into your server process as environment variables at runtime. In your Python code, access them with os.environ['LASTPASS_API_KEY']. In Node.js, use process.env.LASTPASS_API_KEY. If you add secrets while your Repl is already running, stop and restart it — secrets are only injected at process startup. You can verify the secrets are loaded by adding a quick startup log: console.log('API key loaded:', !!process.env.LASTPASS_API_KEY) which prints true without exposing the value.

1# Python — verify secrets are loaded at startup
2import os
3
4required_secrets = ['LASTPASS_ACCOUNT_NUMBER', 'LASTPASS_API_KEY', 'LASTPASS_PROVISIONING_HASH']
5for secret in required_secrets:
6    value = os.environ.get(secret)
7    if not value:
8        raise EnvironmentError(f'Missing required secret: {secret}')
9    print(f'{secret}: loaded ({len(value)} chars)')
10
11print('All LastPass secrets loaded successfully.')

The LastPass Enterprise API accepts POST requests to https://lastpass.com/enterpriseapi.php. All requests send a JSON body containing the command name, your account number, and authentication credentials. The response is always JSON. User provisioning calls (create user, delete user, manage groups) use your Provisioning Hash for the apikey field. Reporting and audit calls use your standard API key. Understanding this distinction is important — using the wrong key will return an authentication error. Below is a complete client implementation in both Python and Node.js. The Python version uses the requests library (pre-installed on Replit), and the Node.js version uses the built-in fetch API available in Node 18+. Both implementations follow the same pattern: build the request body with your credentials and command parameters, POST to the API endpoint, and parse the JSON response. Error handling checks for both HTTP errors and API-level error responses returned with a 200 status code.

1# Python LastPass Enterprise API client
2import os
3import requests
4import json
5
6ACCOUNT_NUMBER = os.environ['LASTPASS_ACCOUNT_NUMBER']
7API_KEY = os.environ['LASTPASS_API_KEY']
8PROV_HASH = os.environ['LASTPASS_PROVISIONING_HASH']
9API_URL = 'https://lastpass.com/enterpriseapi.php'
10
11def lp_request(command, use_provisioning=False, **params):
12    """Send a command to the LastPass Enterprise API."""
13    payload = {
14        'cid': ACCOUNT_NUMBER,
15        'provhash': PROV_HASH if use_provisioning else API_KEY,
16        'cmd': command,
17        'data': params
18    }
19    response = requests.post(API_URL, json=payload, timeout=30)
20    response.raise_for_status()
21    result = response.json()
22    if result.get('status') == 'FAIL':
23        raise ValueError(f"LastPass API error: {result.get('error', 'Unknown error')}")
24    return result
25
26# Provision a new user
27def add_user(email, firstname, lastname):
28    return lp_request('adduser', use_provisioning=True,
29        username=email, firstname=firstname, lastname=lastname)
30
31# Deactivate a user (0=delete, 1=disable, 2=transfer vault)
32def deactivate_user(email, delete_action=1):
33    return lp_request('deleteuser', use_provisioning=True,
34        username=email, deleteaction=delete_action)
35
36# Get all users
37def list_users():
38    return lp_request('getuserdata', use_provisioning=True)
39
40# Get audit events for date range
41def get_events(from_date, to_date):
42    return lp_request('reporting', use_provisioning=False,
43        from_=from_date, to=to_date)
44
45if __name__ == '__main__':
46    users = list_users()
47    print(f"Total users: {len(users.get('Users', {}))}")

For teams that prefer JavaScript, here is a complete Node.js implementation using Express to expose LastPass operations as HTTP endpoints. This pattern is useful when you want other systems (like your HR platform or a Slack bot) to trigger LastPass operations via webhook calls to your Replit server. The server exposes three routes: POST /users/provision to create new accounts, DELETE /users/:email to deactivate accounts, and GET /users to list all users. Each route reads credentials from process.env and calls the LastPass API using the native fetch function. The server binds to 0.0.0.0 on port 3000, which is required for Replit's networking to correctly expose the service. For production use, add authentication to these endpoints — for example, require a shared secret header that matches a value in your Replit Secrets. Without authentication, anyone who knows your Replit URL could trigger user provisioning. The example includes a basic API key check via the X-Webhook-Secret header.

1// Node.js Express server for LastPass Enterprise API
2const express = require('express');
3const app = express();
4app.use(express.json());
5
6const ACCOUNT_NUMBER = process.env.LASTPASS_ACCOUNT_NUMBER;
7const API_KEY = process.env.LASTPASS_API_KEY;
8const PROV_HASH = process.env.LASTPASS_PROVISIONING_HASH;
9const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET;
10const API_URL = 'https://lastpass.com/enterpriseapi.php';
11
12// Middleware: require webhook secret on all routes
13app.use((req, res, next) => {
14  if (req.headers['x-webhook-secret'] !== WEBHOOK_SECRET) {
15    return res.status(401).json({ error: 'Unauthorized' });
16  }
17  next();
18});
19
20async function lpRequest(command, useProvisioning = false, data = {}) {
21  const payload = {
22    cid: ACCOUNT_NUMBER,
23    provhash: useProvisioning ? PROV_HASH : API_KEY,
24    cmd: command,
25    data
26  };
27  const response = await fetch(API_URL, {
28    method: 'POST',
29    headers: { 'Content-Type': 'application/json' },
30    body: JSON.stringify(payload)
31  });
32  const result = await response.json();
33  if (result.status === 'FAIL') {
34    throw new Error(`LastPass API error: ${result.error}`);
35  }
36  return result;
37}
38
39// POST /users/provision — add a new user
40app.post('/users/provision', async (req, res) => {
41  const { email, firstname, lastname } = req.body;
42  if (!email) return res.status(400).json({ error: 'email required' });
43  try {
44    const result = await lpRequest('adduser', true, { username: email, firstname, lastname });
45    res.json({ success: true, result });
46  } catch (err) {
47    res.status(500).json({ error: err.message });
48  }
49});
50
51// DELETE /users/:email — deactivate a user
52app.delete('/users/:email', async (req, res) => {
53  try {
54    const result = await lpRequest('deleteuser', true, {
55      username: req.params.email, deleteaction: 1
56    });
57    res.json({ success: true, result });
58  } catch (err) {
59    res.status(500).json({ error: err.message });
60  }
61});
62
63// GET /users — list all users
64app.get('/users', async (req, res) => {
65  try {
66    const result = await lpRequest('getuserdata', true);
67    res.json(result);
68  } catch (err) {
69    res.status(500).json({ error: err.message });
70  }
71});
72
73app.listen(3000, '0.0.0.0', () => console.log('LastPass service running on port 3000'));

Once your LastPass integration is working in development, deploy it to Replit Autoscale for production reliability. Autoscale is the correct deployment type for this integration because it handles variable traffic (provisioning requests come in bursts during onboarding cycles) and scales to zero when idle, keeping costs low. To deploy, click the Deploy button in the top-right corner of your Replit editor. Select Autoscale deployment. Choose a machine size — for the LastPass API client, 0.25 vCPU and 256MB RAM is sufficient. Set the run command to node index.js (Node.js) or python app.py (Python). Click Deploy and wait 30-60 seconds for the build to complete. After deployment, Replit gives you a permanent production URL (your-repl-name.your-username.repl.co). This URL stays stable and can be registered as a webhook endpoint in your HR system or other triggers. Your Replit Secrets are automatically available in the deployed environment — you do not need to re-enter them. For high-volume provisioning (hundreds of users per batch), consider rate limiting your API calls to stay within LastPass API limits. Add a small delay between requests in batch operations using time.sleep(0.1) in Python or a delay helper in Node.js.

1# .replit deployment configuration
2# Add this to your .replit file
3
4# For Node.js:
5# [deployment]
6# run = ["node", "index.js"]
7# deploymentTarget = "cloudrun"
8#
9# [[ports]]
10# internalPort = 3000
11# externalPort = 80
12
13# For Python:
14# [deployment]
15# run = ["python", "app.py"]
16# deploymentTarget = "cloudrun"
17#
18# [[ports]]
19# internalPort = 3000
20# externalPort = 80