Authenticate with LPM.dev Registry

LPM CLI sessions, local .npmrc tokens, and CI credentials solve different problems. Start with lpm login, then add another credential only when a different package client or automation environment needs one.

Command	Use it for
`lpm login`	Sign LPM CLI in to LPM.dev Registry on this machine.
`lpm setup local`	Give npm, pnpm, or yarn read-only access to `@lpm.dev/*` in a local project.
`lpm setup ci npmrc`	Generate `.npmrc` for a CI job that supplies `LPM_TOKEN`.
`lpm logout`	Remove the stored LPM.dev Registry session from this machine.
`lpm logout --revoke`	Invalidate the active CLI session on LPM.dev Registry, then clear it locally.

lpm login
lpm whoami

lpm login opens the browser for authentication. LPM CLI stores the session in the operating-system keychain. When a keychain is unavailable, it uses an encrypted local fallback.

A signed-in LPM CLI uses this session directly for commands such as:

lpm install @lpm.dev/acme.design-system
lpm publish

You do not need .npmrc for these LPM CLI commands.

Use npm, pnpm, or yarn locally

Other JavaScript package clients cannot read the LPM CLI keychain session. In a project that must install @lpm.dev/* packages with npm, pnpm, or yarn, run:

lpm setup local

This requests a read-only token and writes scoped configuration to the project .npmrc:

@lpm.dev:registry=https://lpm.dev/api/registry
//lpm.dev/api/registry/:_authToken=lpm_...

Only the @lpm.dev scope routes through LPM.dev Registry. The command sets .npmrc to owner-only permissions on Unix and adds it to .gitignore.

The default lifetime is 30 days. Choose a shorter lifetime when appropriate:

lpm setup local --days 7

Run the command again to replace an expired token. Account policy limits local token lifetimes to 90 days.

Do not commit the generated .npmrc. If a token is exposed, revoke it from Security settings and generate a replacement.

Authenticate CI

Use a read-scoped LPM_TOKEN for package installation:

lpm setup ci npmrc

When no credential is already available, the generated file uses an environment placeholder:

//lpm.dev/:_authToken=${LPM_TOKEN}
@lpm.dev:registry=https://lpm.dev/api/registry/

Store LPM_TOKEN in the CI provider's encrypted secret settings. Keep the generated .npmrc inside the temporary job workspace and do not upload it as an artifact.

LPM CLI can also read LPM_TOKEN directly without an .npmrc. See CI/CD integration for LPM CLI and npm-compatible workflow examples.

Sign out

Clear only the credentials stored on the current machine:

lpm logout

Use server-side revocation when leaving a shared machine or responding to possible credential exposure:

lpm logout --revoke

Server-side revocation invalidates the active CLI session, including its refresh ability, and then clears local credentials. It does not revoke unrelated API tokens or sessions on your other devices.

You can review and revoke other sessions and tokens from Security settings.

Session recovery

The CLI renews saved sessions automatically. If a session was revoked, run lpm login again.

LPM_TOKEN overrides your saved login. If the registry rejects this token, replace it or unset LPM_TOKEN. The CLI preserves your saved credentials. JSON output reports env_token_rejected with the same recovery guidance.

Security settings show the current active sessions each time the page loads. Sign out from all devices revokes browser and CLI sessions. Revoke standalone API tokens separately.

Open tabs reload after a browser sign-out or account change. If a browser session expires, sign in again to return to the requested page.

Dashboard access to encrypted environments

Environment dashboard pairing is separate from package-registry authentication:

lpm env pair <CODE>

See Dashboard Pairing for the end-to-end encrypted pairing flow.

Verify sensitive dashboard actions

Sensitive dashboard actions use the same identity verification dialog. These actions include account deletion, token creation, security changes, and environment browser pairing.

The dialog selects a method from your enrolled credentials:

Account credentials	Default method	Alternative
Passkey and authenticator	Passkey	Authenticator code
Passkey only	Passkey	None
Authenticator only	Authenticator code	None
Password only	Account password	None
Connected provider only	Sign in again with the provider	None

If you have both a passkey and an authenticator, the dialog offers Use authenticator code instead. Passkey cancellation keeps the current method selected. A password cannot replace an enrolled passkey or authenticator.

Verification lasts five minutes for the current browser session and action scope. An organization token scope also identifies the organization. Verification for one scope does not authorize another scope.

Some destructive actions also require the account, organization, package, or repository name. This text records your intent and does not replace identity verification.

Login MFA, account recovery, and authenticator enrollment keep their own verification steps. Password changes also require the current password. For a password-only account, this current-password check provides identity verification without a second password prompt.

Organization rules still apply. An organization that requires MFA can require authenticator enrollment, even if your account has a passkey.