lpm login, logout, and whoami

Use these commands to manage registry credentials for LPM CLI.

lpm login [--npm | --github | --gitlab | --login-registry <URL>] [--token <TOKEN>]
lpm login (--github | --gitlab) --save-env-token
lpm whoami
lpm logout [--npm | --github | --gitlab | --logout-registry <URL> | --all] [--revoke]

For example, sign in to the LPM.dev Registry and confirm the active account:

lpm login
lpm whoami

You do not need to sign in to install public packages. Sign in for private packages, publishing, and other protected registry actions.

lpm l is an alias for lpm login. lpm lo is an alias for lpm logout.

Choose a registry

Choose one registry target for each login command.

Sign in to the LPM.dev Registry

Run lpm login when an LPM.dev Registry action requires an account:

lpm login

LPM CLI opens a browser for authentication. Complete the browser flow within two minutes.

After password sign-in and any required verification, the browser loads the CLI authorization page. Select Authorize CLI to complete the local callback.

If the browser does not open, copy the URL from the terminal into a browser. A valid existing session skips the browser flow.

Use the global --registry flag with another LPM-compatible registry:

lpm login --registry https://registry.example.com
lpm whoami --registry https://registry.example.com

This use of --registry starts the normal browser login. It is different from --login-registry, which stores an npm-compatible registry token.

Sign in to npm

Start npm web login from an interactive terminal:

lpm login --npm

Complete the npm browser flow within five minutes. LPM CLI saves the token for https://registry.npmjs.org.

The command uses credentials in this order:

1. The --token value
2. The NPM_TOKEN environment variable
3. npm web login

Pass a token when a browser or interactive terminal is not available:

lpm login --npm --token <TOKEN>
NPM_TOKEN=<TOKEN> lpm login --npm

Both commands save the token. They do not configure a custom npm-compatible registry.

In CI, you can give the token directly to the package command. This method does not save the token:

NPM_TOKEN=<TOKEN> lpm install
NPM_TOKEN=<TOKEN> lpm publish --npm

Use npm Trusted Publishing when your CI provider supports it. See lpm publish for the OIDC setup.

Sign in to GitHub Packages or GitLab Packages

The login commands report whether an effective credential is available. They do not send the credential to GitHub or GitLab for validation.

LPM CLI uses GitHub credentials in this order:

1. The --token value
2. The GITHUB_TOKEN environment variable
3. The current gh session
4. A token in LPM secure storage

LPM CLI uses GitLab credentials in this order:

1. The --token value
2. The GITLAB_TOKEN environment variable
3. The CI_JOB_TOKEN environment variable
4. The current glab session
5. A token in LPM secure storage

Use an existing gh or glab session:

gh auth login --hostname github.com
lpm login --github

glab auth login
lpm login --gitlab

LPM CLI does not copy the host CLI token into its secure storage.

Environment tokens also satisfy the login commands:

GITHUB_TOKEN=<TOKEN> lpm login --github
GITLAB_TOKEN=<TOKEN> lpm login --gitlab
CI_JOB_TOKEN=<TOKEN> lpm login --gitlab

These commands use the environment token for the current process. They do not save it.

Pass a token to save it as a fallback credential:

lpm login --github --token <TOKEN>
lpm login --gitlab --token <TOKEN>

You can also import a long-lived environment token into secure storage:

GITHUB_TOKEN=<TOKEN> lpm login --github --save-env-token
GITLAB_TOKEN=<TOKEN> lpm login --gitlab --save-env-token

Use --save-env-token with one GitHub or GitLab target. Do not combine it with --token.

LPM CLI does not save CI_JOB_TOKEN. This token is short-lived and limited to one GitLab CI job.

Package commands can use the same environment tokens directly:

GITHUB_TOKEN=<TOKEN> lpm install
GITLAB_TOKEN=<TOKEN> lpm install
CI_JOB_TOKEN=<TOKEN> lpm install

In JSON mode, source identifies the selected credential source. Values include explicit-token, env:GITHUB_TOKEN, env:GITLAB_TOKEN, env:CI_JOB_TOKEN, gh, glab, and stored.

The stored field reports whether LPM owns the credential. Stored credentials also include storage_backend and storage_degraded values.

A missing import variable returns credential_import_unavailable. An attempt to save CI_JOB_TOKEN returns credential_import_rejected.

Sign in to a custom registry

Use --login-registry for a custom npm-compatible registry:

lpm login --login-registry https://npm.example.com --token <TOKEN>

LPM CLI scopes the saved token to the registry URL. Use the same URL that appears in your .npmrc file. Custom publishing accepts equivalent spellings with or without a trailing slash, such as /team and /team/. A token for /team/ does not authenticate /other/.

Keep usernames and passwords outside the URL. For install authentication, use registry-scoped .npmrc fields.

In an interactive terminal, you can omit --token. LPM CLI asks for the token with masked input and can save an expiry reminder.

lpm login --login-registry https://npm.example.com

In JSON mode or a non-interactive shell, you must pass --token.

Check the active account

Use lpm whoami to check the selected LPM-compatible registry account:

lpm whoami
lpm whoami --json

The command shows:

• The username and a masked email address
• The plan, MFA status, and Pool access
• Storage and private-package usage
• Personal and organization scopes
• Available npm, GitHub, GitLab, and custom-registry credentials
• Credential expiry warnings and storage health

Human output masks the email address. JSON output includes the full email address and structured account data.

The registry list reports available credential sources. lpm whoami does not test each third-party credential with its registry.

Without local LPM.dev Registry authentication, human output shows login help and exits successfully. JSON mode returns an authentication error instead.

Log out

Without flags, lpm logout clears only the saved LPM.dev Registry session:

lpm logout

Clear one third-party credential or all saved credentials:

lpm logout --npm
lpm logout --github
lpm logout --gitlab
lpm logout --logout-registry https://npm.example.com
lpm logout --all

GitHub and GitLab logout clears only fallback tokens saved by LPM CLI. It does not sign out of gh or glab.

Revoke the LPM.dev Registry session

Normal logout removes local credentials only. Add --revoke to also revoke the LPM.dev Registry session and browser pairings:

lpm logout --revoke

Revoke the LPM.dev Registry session and clear every saved registry credential:

lpm logout --all --revoke

Use --revoke with no target or with --all. Do not combine it with --npm, --github, --gitlab, or --logout-registry.

LPM CLI still tries to clear local credentials if remote revocation fails. The command exits with an error if it cannot complete a selected action.

If the registry rejects LPM_TOKEN

LPM_TOKEN overrides your saved login. If the registry rejects it, LPM CLI reports LPM_TOKEN was rejected and exits with an error. JSON output uses the error code env_token_rejected and includes recovery guidance in next_steps.

lpm doctor --all reports this rejection as an auth_invalid check and shows the same recovery steps.

Replace the token, or remove the override to use your saved login:

unset LPM_TOKEN
lpm whoami

The rejected token does not change your saved credentials. If no valid saved session remains, run lpm login.

For CI, update LPM_TOKEN in the job or secret configuration. A new browser login does not replace the environment token.

If LPM_TOKEN keeps you signed in

lpm logout cannot remove an environment variable from its parent shell. Unset the variable, then run logout again:

unset LPM_TOKEN
lpm logout

For CI, remove LPM_TOKEN from the job or secret configuration.

Login flags

Logout flags

The global --registry and --json flags also apply. See global flags for details.

See also

• Authentication - learn how LPM CLI selects and stores credentials
• lpm setup - configure project .npmrc authentication
• lpm token-rotate - rotate an LPM.dev Registry token
• lpm publish - publish to a selected registry
• Environment variables - use registry credentials in CI