CLI authentication
Sign the lookio CLI in with a browser, a device code or an API key, choose scopes, use several profiles and know where credentials are stored.
The CLI uses the same two credentials as the API: a personal connection (OAuth) and a workspace API key. See Authentication.
Sign in
lookio auth loginThe CLI opens Lookio, you approve the workspace and the permissions, and the CLI stores the token. This is the right route for a person: the connection carries your identity and can keep conversations.
lookio auth login --deviceUse the device flow over SSH or in a container with no browser. The CLI prints an address and a code. Open the address on any device and enter the code.
LOOKIO_API_KEY="sk_live_..." lookio auth loginUse a workspace key for CI or a server. You can also pass --key, but a key typed on the command line is saved in your shell history, so prefer the environment variable and rotate the key if it leaked.
Before it stores anything, the CLI calls GET /v1/account with the credential. A credential that does not work is never saved.
Which permissions the CLI asks for
A browser or device login asks for the Editor set: account:read, usage:read, resources:read, resources:write, assistants:read, assistants:write and query. It leaves out resources:delete, assistants:delete and admin on purpose: this login deletes nothing.
To ask for more or less, pass --scope:
lookio auth login --scope account:read,resources:read,resources:delete,assistants:delete,adminYou can only get what your role in the workspace allows. An admin is needed for admin, which lookio members and lookio tags rename use.
Check and sign out
lookio auth status # workspace, plan, credential kind, scopes and when the token expires
lookio auth logout # forgets the credential and revokes it server-side when possibleIf LOOKIO_API_KEY is still set in your environment, it keeps authenticating after you sign out. logout warns you.
Credential order
The CLI looks for a credential in this order and uses the first it finds:
- The
LOOKIO_API_KEYenvironment variable. It always wins, so CI can override a stale login. - The OS keychain.
~/.config/lookio/config.json, with mode0600, when there is no keychain (a container, a headless Linux machine). SetLOOKIO_NO_KEYCHAINto skip the keychain on purpose.
XDG_CONFIG_HOME moves the config directory.
An access token is renewed with its refresh token automatically. If the grant was revoked, the CLI forgets it and asks you to sign in again.
Profiles
A profile is a named stored credential, for example one per workspace.
lookio --profile acme auth login
lookio --profile acme account
LOOKIO_PROFILE=acme lookio resources listEnvironment variables
| Variable | Purpose |
|---|---|
LOOKIO_API_KEY | An API key. Overrides any stored credential. |
LOOKIO_PROFILE | The profile to use. Same as --profile. |
LOOKIO_API_URL | The API base URL. Defaults to https://api.lookio.app/v1. |
LOOKIO_MCP_URL | The MCP host, used by lookio mcp. Defaults to https://mcp.lookio.app. |
LOOKIO_AUTH_URL | The authorization server, when it is not the API host. |
LOOKIO_NO_TUI | Any value forces JSON output. |
LOOKIO_NO_KEYCHAIN | Any value skips the OS keychain. |
NO_COLOR | Disables colour only. It does not change the format. |