Dashboard Pairing

Pairing gives a browser the personal wrapping key held by an LPM CLI installation. The browser can then decrypt personal cloud vaults protected by that same key and display them in the LPM.dev Registry secrets dashboard.

Pairing does not copy the key to another LPM CLI installation, grant organization-vault access, or change account permissions.

Pair a Browser

Start from the secrets dashboard. Sign in and complete the requested recent-authentication check. The browser then creates a temporary P-256 keypair and displays:

  • A six-character pairing code.
  • A two-digit verification number.
  • A five-minute expiration time.

Run the displayed command from the LPM CLI installation that can already open the personal vault:

lpm login
lpm env pair ABC123

Pairing requires the session-backed login created by lpm login; a standalone Registry token is not accepted. LPM CLI shows the pairing code, browser-key fingerprint, device information, and two-digit verification number. Confirm that the number matches the dashboard before approving the request.

After approval:

  1. LPM CLI encrypts its personal wrapping key for the browser's temporary public key.
  2. The browser consumes that encrypted result once and decrypts it locally.
  3. The browser stores the wrapping key in IndexedDB for later dashboard sessions.
  4. The dashboard can open personal cloud vaults encrypted with that wrapping key.

The pairing code cannot be reused after it is consumed or expires.

For command options, see the LPM CLI environment reference. For the cryptographic flow, see the LPM CLI vault architecture.

What Pairing Unlocks

The transferred key lets an authorized browser:

  • Decrypt and display compatible personal cloud vaults.
  • Edit values and encrypt the updated vault in the browser before upload.

Organization vaults use X25519 member keys instead of the personal wrapping key. Browser-side organization-vault decryption is not currently available.

What LPM.dev Registry Sees

During pairing, LPM.dev Registry handles:

  • The browser's temporary public key.
  • The LPM CLI installation's temporary public key.
  • The encrypted wrapping-key payload.
  • Pairing status, device information, and expiration metadata.

The personal wrapping key is encrypted before LPM.dev Registry receives it. Ordinary personal vault values remain inside the encrypted vault payload.

Unpairing and Browser Data

lpm env unpair

This command deletes all pairing-session records for the signed-in account. It does not select or revoke one browser.

Pairing-session deletion does not clear a wrapping key that a browser has already stored. To remove that local copy from a browser you control, clear the site data for lpm.dev in that browser.

Current limitation: LPM.dev Registry cannot invalidate wrapping-key material already retained by an unavailable browser. lpm env unpair and dashboard-side pairing deletion must not be treated as cryptographic revocation of a previously paired browser.

Plan Requirements

Pairing itself has no separate plan gate. The personal cloud vault it opens requires the personal cloud-sync capability, which is available with Pro.

Organization vault access follows the organization sharing model and is not unlocked by dashboard pairing.

See Also