Skip to main content

lumio login

Authenticate with your Lumio account. Credentials are stored in ~/.lumio/credentials and reused automatically for subsequent commands.

Usage​

lumio login [--token <token>] [--api-url <url>] [--id-url <url>] [--port <port>]

Options​

FlagDefaultDescription
--token <token>—Authenticate with a Lumio API key directly (no browser)
--api-url <url>https://api.lumio.visionAPI base URL for the token exchange
--id-url <url>https://id.lumio.visionID (login) app URL the browser is opened against
--port <port>9876Local loopback port that receives the PKCE callback

Browser-based login (default)​

lumio login

This opens your default browser to the Lumio ID app login page (https://id.lumio.vision/login) using the PKCE flow shared by all native apps (see PKCE & Native App Auth). The CLI:

  1. Generates a PKCE code_verifier / code_challenge (S256) and a random state, then starts a loopback HTTP server on http://localhost:9876/callback.
  2. Opens the browser to https://id.lumio.vision/login?client_type=cli&code_challenge=…&code_challenge_method=S256&redirect_uri=http://localhost:9876/callback&state=….
  3. You sign in with a provider (Twitch, Discord, Google). The ID app mints a single-use authorization code (lumio_auth_…) and redirects your browser back to the loopback callback with ?code=…&state=….
  4. The CLI validates state, then exchanges the code and the original code_verifier at POST {api-url}/v1/auth/token/exchange for a Lumio JWT + refresh token, which it stores in ~/.lumio/credentials.

The flow needs no client secret — PKCE (Proof Key for Code Exchange) protects the code in transit, which is safe for CLI tools. The callback binds to loopback only, so no other host on the network can receive the code.

Session lifetime

The browser flow yields a short-lived JWT (~15 min) plus a long-lived refresh token (both stored in ~/.lumio/credentials). For long-running, non-interactive use (CI/CD, scripts), prefer a durable lm_usr_* API key via --token / LUMIO_TOKEN.

Self-hosted / non-production deployments

The ID app only redirects the auth code to a redirect_uri present in its ALLOWED_REDIRECT_ORIGINS allowlist. Production allowlists the CLI loopback origin (http://localhost:9876); a self-hosted ID app must add the origin you pass via --port to ALLOWED_REDIRECT_ORIGINS, or the browser login fails with "redirect_uri missing or not allowed".

Token-based login (pre-provisioned token)​

For non-interactive environments where a browser is not available, pass a pre-provisioned Lumio API token:

lumio login --token lm_usr_xxxxxxxxxxxx

Or set the LUMIO_TOKEN environment variable:

LUMIO_TOKEN=lm_usr_xxxxxxxxxxxx lumio deploy -v 1.0.0

The LUMIO_TOKEN environment variable takes precedence over stored credentials.

Getting a token​

  1. Open lumio.vision in your browser
  2. Navigate to Dashboard → API Keys
  3. Click Create API key
  4. Give it a name (e.g., "CI/CD pipeline")
  5. Copy the generated key — it starts with lm_usr_

Checking your credentials​

lumio whoami
# Logged in as: Your Name (raphael@example.com)
# Account: your-account-slug

Logging out​

lumio logout
# Credentials removed from ~/.lumio/credentials

Credential storage​

Credentials are stored in ~/.lumio/credentials as a JSON file (0600, in a 0700 directory). Browser login writes the JWT token, its refresh_token, and expires_at; token login writes just the token (your lm_usr_* API key). It is not encrypted at rest — keep your home directory secure.