Dashboard Pairing

Pair your browser from a personal or organization project in the secrets dashboard. Each scope uses a separate pairing. Values decrypt in your browser.

Organization pairing uses the sharing key registered to your account. You still need current membership and a shared key for each organization project.

Pair a Browser

Start from the secrets dashboard. Sign in and complete the requested recent-authentication check. The browser then creates a temporary P-256 keypair and displays:

  • A six-character pairing code.
  • A eight-digit verification number.
  • A five-minute expiration time.

Run the displayed command from the LPM CLI installation that can already open the environment:

lpm login
lpm env pair ABC123

Pairing requires the session-backed login created by lpm login; a standalone Registry token is not accepted. LPM CLI shows the pairing code, browser-key fingerprint, device information, and eight-digit verification number. Confirm that the number matches the dashboard before approving the request.

After approval:

  1. LPM CLI encrypts the selected access key for the browser's temporary public key.
  2. The browser consumes that encrypted result once and decrypts it locally.
  3. The browser stores the access key in IndexedDB for later dashboard sessions.
  4. The dashboard can open environments shared with that account and key.

The pairing code cannot be reused after it is consumed or expires.

For command options, see the LPM CLI environment reference. For the cryptographic flow, see the LPM CLI vault architecture.

What Pairing Unlocks

The transferred key lets an authorized browser:

  • Decrypt and display personal and organization environments.
  • Edit values and encrypt the updated vault in the browser before upload.

Organization pairing stores your X25519 sharing key as a non-extractable browser key, bound to your account. It does not replace your personal pairing.

Owners, admins, and maintainers can save organization changes. Other members can view values. Saves check current membership, subscription access, and key versions.

If key rotation is required, an owner or admin must run lpm env rotate --org <slug> before browser saves can resume. After a sharing-key change, pair again and ask an owner or admin to refresh your environment access.

What LPM.dev Registry Sees

During pairing, LPM.dev Registry handles:

  • The browser's temporary public key.
  • The LPM CLI installation's temporary public key.
  • The encrypted wrapping-key payload.
  • Pairing status, device information, and expiration metadata.

The transferred key is encrypted before the Registry receives it. Personal and organization values remain inside encrypted payloads during normal browser access.

Unpairing and Browser Data

lpm env unpair

This command revokes all personal and organization browser pairings for the signed-in account. The server then denies further browser retrievals and saves.

Pairing-session deletion does not clear an access key that a browser has already stored. To remove that local copy from a browser you control, clear the site data for lpm.dev in that browser.

Current limitation: LPM.dev Registry cannot invalidate wrapping-key material already retained by an unavailable browser. lpm env unpair and dashboard-side pairing deletion must not be treated as cryptographic revocation of a previously paired browser.

Plan Requirements

Pairing itself has no separate plan gate. The personal cloud vault it opens requires the personal cloud-sync capability, which is available with Pro.

Organization access requires an active organization subscription, current membership, and a shared environment key.

See Also