lpm login / logout / whoami

Manage registry identity for the LPM.dev Registry, npm, GitHub Packages, GitLab Packages, and custom npm-compatible registries.

lpm login
lpm whoami
lpm logout
lpm logout --revoke

Examples

lpm login                                      # alias: lpm l
lpm login --npm
lpm login --github
lpm login --gitlab
lpm login --login-registry https://npm.my-co.com --token <T>

lpm whoami
lpm whoami --json

lpm logout                                     # alias: lpm lo
lpm logout --npm
lpm logout --logout-registry https://npm.my-co.com
lpm logout --all

lpm login

With no registry flags, lpm login starts the browser-based OAuth flow for the LPM.dev Registry. LPM CLI starts a local HTTP server on a random port, opens the registry login page, captures the redirect token, verifies it with whoami, and stores it in local secure storage. The flow validates CSRF state end-to-end and times out after 2 minutes waiting for the browser callback.

On success, human output stays on stderr and ends with a compact summary: browser authentication complete, the user, the registry host, and the active secure-storage backend. --json keeps the machine envelope on stdout and includes storage_backend plus storage_degraded.

For npm, lpm login --npm uses npm web login by default: LPM CLI asks registry.npmjs.org for a web-login URL, opens it, polls the registry for completion, then stores the returned npm token. This requires an interactive terminal. In --json mode or non-TTY shells, pass --token <T> or set NPM_TOKEN.

lpm login --npm and NPM_TOKEN are for https://registry.npmjs.org. They are not sent to repo-configured custom npm registries.

For CI publishes to npm, you can skip long-lived npm publish tokens with npm Trusted Publishing. lpm publish --npm and lpm stage publish first look for npm OIDC auth: GitHub Actions runtime tokens with permissions: id-token: write, or NPM_ID_TOKEN from GitLab CI / CircleCI minted with audience npm:registry.npmjs.org. LPM CLI exchanges that ID token for npm's short-lived registry token and falls back to NPM_TOKEN or stored npm auth only when OIDC is unavailable or rejected.

For GitHub and GitLab, lpm login --github / --gitlab validates your existing host CLI session instead of asking you to paste a token. GitHub uses gh auth token --hostname github.com; GitLab.com uses glab auth token. When that succeeds, LPM CLI stores nothing. Passing --token <T> stores an explicit fallback token in LPM CLI secure storage.

Custom registries stay token-based and exact-URL scoped. Use lpm login --login-registry <URL> --token <T> in scripts. In an interactive TTY without --token, LPM CLI prompts with masked input. Explicit token fallbacks can also record a token-expiry reminder and 2FA/OTP preference for publishing.

For the LPM.dev Registry, if you are already logged in, lpm login reports the existing identity and exits without re-authenticating. Third-party login commands refresh or re-check the selected auth source.

lpm logout

With no flags, lpm logout clears only the LPM.dev Registry session.

lpm logout
lpm logout --npm
lpm logout --github
lpm logout --gitlab
lpm logout --logout-registry https://npm.my-co.com
lpm logout --all
lpm logout --all --revoke

Passing one of --npm, --github, --gitlab, or --logout-registry <URL> clears only that target. Your LPM.dev Registry session stays signed in. Use --all to clear every stored registry token.

For GitHub and GitLab, logout clears only LPM CLI-stored fallback tokens. gh and glab sessions remain managed by those tools.

Plain lpm logout is local-only and makes no network requests. Use lpm logout --revoke to revoke browser pairings first, then revoke the authenticated CLI session, its refresh capability, and linked access tokens. The server derives the session from the bearer; the caller cannot name another session.

--revoke applies to the LPM.dev Registry session, so targeted combinations such as --revoke --npm are rejected before any credentials are changed. Use --all --revoke to attempt LPM.dev remote revocation and clear every local registry credential. All local targets are still cleared if that remote attempt fails.

Every selected local credential store is attempted even if a remote request or another local deletion fails. The command exits non-zero whenever any selected credential could not be removed; human output reports whether local cleanup completed, and JSON reports success: false with separate pairings_revoked, server_revoked, and local_cleared fields plus bounded errors. A legacy token cannot revoke a CLI session but is still cleared locally. Repeating logout with neither stored state nor LPM_TOKEN succeeds without network access.

LPM CLI cannot unset environment variables in its parent shell. If a non-empty LPM_TOKEN remains active alongside a stored refresh-backed session, lpm logout --revoke uses the stored session—not the environment token—to revoke browser pairings and the server-side session before clearing it locally. The command still exits non-zero, reports success: false and local_cleared: false, and tells you to unset LPM_TOKEN in that shell or CI environment.

lpm whoami

lpm whoami
lpm whoami --json

Prints the currently logged-in LPM.dev Registry identity, plus:

• Username and a masked email address in human output (t...n@gmail.com); --json returns the full email.
• Plan tier, MFA status, and pool access flag
• Storage and private-package usage against your plan limits
• Available personal and organization scopes
• External registry auth sources for npm, GitHub, GitLab, and custom registries
• Token expiry warnings for registry tokens that are approaching their reminder window
• Secure-storage backend health for the active stored LPM.dev Registry session

--json returns the same data structurally: {username, email, plan, mfa_enabled, has_pool_access, usage, limits, orgs, registries, storage_backend, storage_degraded}. storage_backend is "keychain", "encrypted_file_fallback", or null when the active auth source is not stored by LPM CLI.

See also

• Authentication - registry auth model and secure-storage backend details
• lpm setup - write .npmrc auth for CI or local development
• lpm token-rotate - rotate the LPM.dev Registry token
• lpm publish - publish to the LPM.dev Registry or another registry
• Environment variables - LPM_TOKEN, NPM_TOKEN, GITHUB_TOKEN, GITLAB_TOKEN