lpm login, logout, and whoami command reference

Use these commands to authenticate private installs and publishing, check your account, or remove saved credentials.

lpm login [--npm | --github | --gitlab | --login-registry <URL>] [--token <TOKEN>] [--save-env-token]
lpm whoami
lpm logout [--npm] [--github] [--gitlab] [--logout-registry <URL>] [--all] [--revoke]

Public package installs do not require login. LPM CLI supports npm, LPM.dev Registry, and private registries through registry configuration.

Quickstart

lpm login
lpm whoami
lpm install @lpm.dev/owner.package

The aliases lpm l and lpm lo select login and logout.

Command	Purpose
`login`	Create a browser session or select a third-party credential.
`whoami`	Check the selected LPM-compatible registry account and local credential sources.
`logout`	Remove selected local credentials; optionally revoke the browser session.

These commands manage credentials outside lpm.json. Project environment mappings do not configure login.

Saved logins belong to the LPM home: ~/.lpm, or the directory that LPM_HOME names. Each LPM home keeps its own logins, including its entries in the OS credential store. After you change LPM_HOME, run lpm login again. See credential storage.

Choose a registry

Target	Command	Credential behavior
LPM.dev Registry	`lpm login`	Create or reuse a refresh-backed browser session.
npm	`lpm login --npm`	Save an explicit token, `NPM_TOKEN`, or an npm web-login token.
GitHub Packages	`lpm login --github`	Use an environment token, `gh`, or a saved fallback.
GitLab Packages	`lpm login --gitlab`	Use an environment token, `glab`, or a saved fallback.
Custom npm-compatible registry	`lpm login --login-registry <URL>`	Save a token scoped to that registry URL and path.

Choose one login target. Explicit tokens require a third-party target; plain browser login rejects --token.

LPM_TOKEN does not become a third-party login token. Use the provider's environment variable or pass its token explicitly.

lpm login

Complete authentication in the browser, then select Authorize CLI. The local callback must complete within two minutes.

If the BROWSER environment variable is set, LPM CLI opens the page with the command that it names. Otherwise LPM CLI uses the system browser. The BROWSER value works the same on macOS, Linux, and Windows:

Separate more than one command with :, or with ; on Windows. LPM CLI tries each command in order.
Use %s where the URL goes. Without %s, LPM CLI adds the URL as the last argument.
If a command exits with an error within two seconds, LPM CLI tries the next one. If all of them fail, LPM CLI shows the URL so that you can open it yourself.

For example, BROWSER=false lpm login opens no browser and shows the URL.

If the browser does not open, copy the displayed URL into a browser. JSON mode suppresses this manual URL.

LPM CLI verifies and saves the returned session. Future protected commands can refresh its access token automatically.

An account keeps up to 20 active lpm login sessions, one for each sign-in. If you sign in when the account has 20, LPM.dev ends the session that was used least recently, as lpm logout --revoke does.

If the LPM.dev Registry cannot complete the sign-in at once, lpm login tries again for up to 30 seconds. If the Registry still cannot complete it, run lpm login again.

A valid saved refresh-backed session skips browser authentication. An access token without a refresh credential does not satisfy this check.

To switch accounts, clear the saved session first:

lpm logout
lpm login

For another LPM-compatible registry, use the same URL throughout:

lpm login --registry https://registry.example.com
lpm whoami --registry https://registry.example.com

--registry selects the browser-login service. --login-registry instead stores a token for an npm-compatible registry.

The authorization-code exchange has a 30-second timeout and refuses redirects. If it fails, correct the registry connection and restart login.

lpm login --npm

The command chooses credentials in this order:

--token
NPM_TOKEN
npm web login

Web login requires an interactive terminal. Complete its browser flow within five minutes.

To save a token without a browser:

lpm login --npm --token <TOKEN>
NPM_TOKEN=<TOKEN> lpm login --npm --json

These commands save the credential for https://registry.npmjs.org. Explicit-token storage does not verify the token with npm.

For CI, pass the token directly to the package command when persistent storage is unnecessary:

NPM_TOKEN=<TOKEN> lpm install
NPM_TOKEN=<TOKEN> lpm publish --npm

For supported CI providers, see npm Trusted Publishing.

Use an existing host CLI session:

gh auth login --hostname github.com
lpm login --github

glab auth login
lpm login --gitlab

Provider	Credential order
GitHub	`--token`, `GITHUB_TOKEN`, `gh`, saved fallback.
GitLab	`--token`, `GITLAB_TOKEN`, `CI_JOB_TOKEN`, `glab`, saved fallback.

These login commands report credential availability. They do not verify the credential or its permissions with the provider.

Environment and host CLI credentials remain transient:

GITHUB_TOKEN=<TOKEN> lpm login --github --json
GITLAB_TOKEN=<TOKEN> lpm login --gitlab --json
CI_JOB_TOKEN=<TOKEN> lpm login --gitlab --json

To save a fallback token:

lpm login --github --token <TOKEN>
lpm login --gitlab --token <TOKEN>

To import a long-lived environment token:

GITHUB_TOKEN=<TOKEN> lpm login --github --save-env-token
GITLAB_TOKEN=<TOKEN> lpm login --gitlab --save-env-token

--save-env-token cannot accompany --token. It requires a GitHub or GitLab target.

LPM CLI refuses to save CI_JOB_TOKEN, which belongs to one CI job. A missing import variable returns credential_import_unavailable; a rejected import returns credential_import_rejected.

lpm login --login-registry https://npm.example.com/team/ --token <TOKEN>

Use the registry URL from your .npmrc. The saved credential belongs to that URL and path; /team/ does not authenticate /other/.

Custom publishing accepts equivalent URLs with or without a trailing slash. Keep usernames and passwords outside registry URLs.

In an interactive terminal, omit the token to use masked input and optionally set an expiry reminder:

lpm login --login-registry https://npm.example.com/team/

JSON mode and non-interactive shells require --token. Storage does not verify the token with the remote registry.

Use credentials in CI

Browser login is not a token-import workflow. Give protected package commands the appropriate environment credential:

LPM_TOKEN=<TOKEN> lpm ci
GITHUB_TOKEN=<TOKEN> lpm install
GITLAB_TOKEN=<TOKEN> lpm install

For npm-compatible clients that need a project .npmrc, use lpm setup.

Check the active account

lpm whoami
lpm whoami --json

The command checks the selected LPM-compatible registry account. Output includes plan, MFA, Pool access, usage, scopes, credential sources, expiry warnings, and storage health.

The output rounds usage past a limit up, so that it shows as past the limit.

On Hobby, the tarballs of packages whose sales exempt them do not count toward the limit. The content that the registry derives from those packages still counts: READMEs, API docs, LLM context, skill content, and for a Swift package, its source archive, raw Package.swift, and manifest bundle. The output shows the storage that the limit counts, and shows the exempt tarballs on a separate line.

Past the storage limit, the output says what publishing does, as the registry reports it:

Report	What publishing does
Billed	LPM.dev bills storage past the included size per GiB a month, rounded up. The output also says this at the limit, where the next publish starts the billing.
Paused	Billing is not active, so the registry refuses publishes past the limit until billing is active again. While Stripe tries a failed payment again, storage that is already past the limit is still billed. It is not billed while the subscription is paused or after it ended. Past the limit, the output says which of these applies, if the registry reports it.
Blocked	Nothing bills storage past the limit, so the registry refuses publishes to your personal scope past it. On Hobby, this continues until you upgrade, or delete enough storage to go below the limit. On a Pro plan without a subscription, which staff can grant, this continues while the storage stays past the limit.

At the storage limit, any publish goes past it. The output says so where the registry refuses publishes. At or past the private-package limit, the output says that the registry refuses new private packages in your personal scope.

Some registries do not report what publishing does past the limit, or the storage that the limit counts. The output then compares the whole storage, exempt tarballs included. On Hobby, at or past the limit, the output says that this registry refuses publishes to your personal scope. Packages whose sales exempt them are the exception. Every LPM.dev Registry refuses Hobby storage past its limit. For other plans, the output says only that the storage is past the limit.

JSON output reports what the registry sent. A field is null if the registry does not send it:

storage_overage: what publishing does past the limit
storage_excess_billed: whether storage already past the limit is billed meanwhile
usage.counted_storage_bytes: the storage the limit counts

Human output masks the email address. JSON includes the full address.

The third-party registry list reports credential availability; it does not test each credential with its provider.

Without local LPM.dev Registry authentication, human output shows login guidance and succeeds. JSON mode returns an authentication error.

Log out

lpm logout
lpm logout --npm
lpm logout --github --gitlab
lpm logout --logout-registry https://npm.example.com/team/
lpm logout --all

Plain logout clears the saved session for the selected LPM-compatible registry. Third-party flags clear their selected saved credentials; you can combine them.

--all clears that LPM-compatible session and supported third-party and custom credentials. It does not select every saved browser-registry session.

GitHub and GitLab logout removes only fallbacks saved by LPM CLI. It does not sign out of gh or glab.

Revoke the LPM.dev Registry session

Normal logout changes local storage only. To also revoke the selected browser session and browser pairings:

lpm logout --revoke
lpm logout --all --revoke

Use --revoke without a third-party target, or with --all.

LPM CLI still attempts local cleanup if remote revocation fails. An incomplete selected action returns an error.

Storage and JSON output

lpm login --json
lpm login --github --json
lpm logout --all --json

Browser login returns success, username, registry, storage_backend, and storage_degraded, including when it reuses a session.

Third-party login also reports source and stored. stored identifies credentials owned by LPM CLI; transient credentials have no storage backend.

Source values include explicit-token, env:NPM_TOKEN, env:GITHUB_TOKEN, env:GITLAB_TOKEN, env:CI_JOB_TOKEN, gh, glab, and stored.

Saved credentials use the OS keychain when available. storage_degraded: true identifies the encrypted file fallback in the LPM home.

After you repair the keychain, log out and sign in again to store a new browser session there.

If the registry rejects `LPM_TOKEN`

LPM_TOKEN overrides the saved session for package commands. A rejected value returns env_token_rejected; JSON includes recovery guidance.

Replace the token, or remove the override:

unset LPM_TOKEN
lpm whoami

A new browser login does not update a shell variable or CI secret. The rejected environment token does not replace saved credentials.

If the saved session is also invalid, run lpm login.

If `LPM_TOKEN` keeps you signed in

Logout cannot remove a variable from its parent shell:

unset LPM_TOKEN
lpm logout

For CI, remove or replace the token in the job's secret configuration.

Flag	Effect
`--npm`	Select npm authentication.
`--github`	Select GitHub Packages authentication.
`--gitlab`	Select GitLab Packages authentication.
`--login-registry <URL>`	Store a custom npm-compatible registry token.
`--token <TOKEN>`	Store an explicit token for the selected third-party target.
`--save-env-token`	Import `GITHUB_TOKEN` or `GITLAB_TOKEN` into secure storage.

Logout flags

Flag	Effect
`--npm`	Clear the saved npm token.
`--github`	Clear the saved GitHub fallback.
`--gitlab`	Clear the saved GitLab fallback.
`--logout-registry <URL>`	Clear one custom registry credential.
`--all`	Clear the selected browser session and supported third-party credentials.
`--revoke`	Also revoke the selected browser session and browser pairings.

The global --registry and --json flags apply. See global flags.

lpm login, logout, and whoami