Skip to main content

lumio login

Authenticate with your Lumio account. Credentials are stored in ~/.lumio/credentials and reused automatically for subsequent commands.

Usage​

lumio login [--token <token>] [--api-url <url>] [--id-url <url>] [--port <port>]

Options​

FlagDefaultDescription
--token <token>-Authenticate with a Lumio API key directly (no browser)
--api-url <url>https://api.lumio.visionAPI base URL for the token exchange
--id-url <url>https://id.lumio.visionID (login) app URL the browser is opened against
--port <port>9876Local loopback port that receives the PKCE callback

Browser-based login (default)​

lumio login

This opens your default browser to the Lumio ID app login page (https://id.lumio.vision/login) using the PKCE flow shared by all native apps (see PKCE & Native App Auth). The CLI:

  1. Generates a PKCE code_verifier / code_challenge (S256) and a random state, then starts a loopback HTTP server on http://localhost:9876/callback.
  2. Opens the browser to https://id.lumio.vision/login?client_type=cli&code_challenge=…&code_challenge_method=S256&redirect_uri=http://localhost:9876/callback&state=….
  3. You sign in with a provider (Twitch, Discord, Google). The ID app mints a single-use authorization code (lumio_auth_…) and redirects your browser back to the loopback callback with ?code=…&state=….
  4. The CLI validates state, then exchanges the code and the original code_verifier at POST {api-url}/v1/auth/token/exchange for a Lumio JWT + refresh token, which it stores in ~/.lumio/credentials.

The flow needs no client secret - PKCE (Proof Key for Code Exchange) protects the code in transit, which is safe for CLI tools. The callback binds to loopback only, so no other host on the network can receive the code.

Session lifetime

The browser flow yields a short-lived JWT (~15 min) plus a long-lived refresh token (both stored in ~/.lumio/credentials). For long-running, non-interactive use (CI/CD, scripts), prefer a durable developer key (lm_dev_*) via --token / LUMIO_TOKEN - see Getting a token.

Self-hosted / non-production deployments

The ID app only redirects the auth code to a redirect_uri present in its ALLOWED_REDIRECT_ORIGINS allowlist. Production allowlists the CLI loopback origin (http://localhost:9876); a self-hosted ID app must add the origin you pass via --port to ALLOWED_REDIRECT_ORIGINS, or the browser login fails with "redirect_uri missing or not allowed".

Token-based login (pre-provisioned token)​

For non-interactive environments where a browser is not available, pass a pre-provisioned Lumio API token. For extension publishing this is a developer key (lm_dev_*):

lumio login --token lm_dev_xxxxxxxxxxxx

Or set the LUMIO_TOKEN environment variable:

LUMIO_TOKEN=lm_dev_xxxxxxxxxxxx lumio deploy -v 1.0.0

The LUMIO_TOKEN environment variable takes precedence over stored credentials. The CLI sends whatever token you give it verbatim as a Bearer credential, so any Lumio key kind is accepted - but a developer key is the credential scoped for lumio deploy and the other developer commands.

Getting a token​

Extension publishing uses a developer key (lm_dev_*) - a credential bound to your developer profile (or team), scoped to the extension-dev:* permissions and not gated on the Pro plan, so free-tier developers keep publishing. You need an approved developer profile to mint one.

  1. Open lumio.vision in your browser
  2. Navigate to Settings → You → Developer → Developer keys (/dashboard/settings/developer/keys)
  3. Click Create developer key
  4. Give it a name (e.g., "CI/CD pipeline") and pick its extension-dev:* scopes (e.g. extension-dev:publish)
  5. Copy the generated key - it starts with lm_dev_ and is shown only once

A developer key reaches the extension-developer publishing routes only. It cannot mint or revoke other keys, cannot touch account-scoped resources, and - because it carries no user identity - cannot be used with lumio whoami (that command needs a browser login or a personal lm_usr_* key).

Checking your credentials​

lumio whoami
# Logged in as: Your Name (raphael@example.com)
# Account: your-account-slug

Logging out​

lumio logout
# Credentials removed from ~/.lumio/credentials

Credential storage​

Credentials are stored in ~/.lumio/credentials as a JSON file (0600, in a 0700 directory). Browser login writes the JWT token, its refresh_token, and expires_at; token login writes just the token (your lm_dev_* developer key, or an lm_usr_* / lm_svc_* key). It is not encrypted at rest - keep your home directory secure.