Authenticate with LPM.dev Registry

LPM CLI sessions, local .npmrc tokens, and CI credentials solve different problems. Start with lpm login, then add another credential only when a different package client or automation environment needs one.

CommandUse it for
lpm loginSign LPM CLI in to LPM.dev Registry on this machine.
lpm setup localGive npm, pnpm, or yarn read-only access to @lpm.dev/* in a local project.
lpm setup ci npmrcGenerate .npmrc for a CI job that supplies LPM_TOKEN.
lpm logoutRemove the stored LPM.dev Registry session from this machine.
lpm logout --revokeInvalidate the active CLI session on LPM.dev Registry, then clear it locally.

Sign in LPM CLI

lpm login
lpm whoami

lpm login opens the browser for authentication. LPM CLI stores the session in the operating-system keychain. When a keychain is unavailable, it uses an encrypted local fallback.

A signed-in LPM CLI uses this session directly for commands such as:

lpm install @lpm.dev/acme.design-system
lpm publish

You do not need .npmrc for these LPM CLI commands.

Use npm, pnpm, or yarn locally

Other JavaScript package clients cannot read the LPM CLI keychain session. In a project that must install @lpm.dev/* packages with npm, pnpm, or yarn, run:

lpm setup local

This requests a read-only token and writes scoped configuration to the project .npmrc:

@lpm.dev:registry=https://lpm.dev/api/registry
//lpm.dev/api/registry/:_authToken=lpm_...

Only the @lpm.dev scope routes through LPM.dev Registry. The command sets .npmrc to owner-only permissions on Unix and adds it to .gitignore.

The default lifetime is 30 days. Choose a shorter lifetime when appropriate:

lpm setup local --days 7

Run the command again to replace an expired token. Account policy limits local token lifetimes to 90 days.

Do not commit the generated .npmrc. If a token is exposed, revoke it from Security settings and generate a replacement.

Authenticate CI

Use a read-scoped LPM_TOKEN for package installation:

lpm setup ci npmrc

When no credential is already available, the generated file uses an environment placeholder:

//lpm.dev/:_authToken=${LPM_TOKEN}
@lpm.dev:registry=https://lpm.dev/api/registry/

Store LPM_TOKEN in the CI provider's encrypted secret settings. Keep the generated .npmrc inside the temporary job workspace and do not upload it as an artifact.

LPM CLI can also read LPM_TOKEN directly without an .npmrc. See CI/CD integration for LPM CLI and npm-compatible workflow examples.

Sign out

Clear only the credentials stored on the current machine:

lpm logout

Use server-side revocation when leaving a shared machine or responding to possible credential exposure:

lpm logout --revoke

Server-side revocation invalidates the active CLI session, including its refresh ability, and then clears local credentials. It does not revoke unrelated API tokens or sessions on your other devices.

You can review and revoke other sessions and tokens from Security settings.

Dashboard access to encrypted environments

Environment dashboard pairing is separate from package-registry authentication:

lpm env pair <CODE>

See Dashboard Pairing for the end-to-end encrypted pairing flow.

See also