Authentication Commands

Manage your LenserFight session, browser-based device approval, and time-bounded developer tokens.

lf auth <subcommand>

---

auth login

Browser login (recommended)

Run lf auth login with no flags. The CLI opens your browser and waits.

lf auth login

What happens:

1. The CLI creates a short-lived approval request and prints a code + URL.
2. Your browser opens https://auth.lenserfight.com/device-approval?mode=login.
3. Sign in (or you are already signed in) — the code is pre-filled.
4. Click Approve login.
5. The CLI detects approval and saves your session to ~/.lenserfight/lenserfight.json.

If the browser does not open automatically, copy the URL printed in the terminal and open it manually.

Email / password (headless / CI)

Still supported for scripted and headless environments:

lf auth login --email you@example.com --password secret

Flag	Required	Description
--email	No*	Account email address (*required when using email/password path)
--password	No*	Account password (*required when using email/password path)

auth logout

Clear stored session tokens and any saved developer token metadata.

lenserfight auth logout

auth whoami

Show the currently authenticated user.

lenserfight auth whoami

Outputs email, lenser handle, and token expiry.

auth refresh

Force-refresh the stored access token using the saved refresh token.

lenserfight auth refresh

Use this when the session is still valid but the access token expired.

auth token

Print the session access token to stdout.

lenserfight auth token
lenserfight auth token --format bearer
lenserfight auth token | pbcopy   # macOS clipboard

Flag	Required	Default	Description
--format	No	raw	raw prints the token only. bearer prints Bearer <token>.

auth register

Create a new account and lenser profile in one step.

lenserfight auth register \
  --email you@example.com \
  --password secret \
  --display-name "Ada Lovelace"

Flag	Required	Description
--email	Yes	Account email address
--password	Yes	Password (min 8 characters)
--display-name	No	Public display name for your lenser profile

Device approval

auth device request

Start a short-lived device approval request, open the auth app route, and wait for a developer token to be minted.

lenserfight auth device request --label "MacBook Pro"

Flag	Required	Default	Description
--label	No	null	Optional display label for the resulting developer token
--request-ttl-minutes	No	10	How long the approval code stays valid
--token-ttl-hours	No	24	How long the developer token stays valid
--json	No	false	Print the initial request payload as JSON

The command prints the approval code and the auth app URL. Approve it in the browser at /device-approval while you are signed in. The CLI then polls until the token is issued and saves it separately from the session tokens.

Developer tokens

auth developer-token current

Show the locally stored developer token metadata.

lenserfight auth developer-token current

auth developer-token list

List the developer tokens associated with the currently signed-in user.

lenserfight auth developer-token list
lenserfight auth developer-token list --json

Flag	Required	Default	Description
--json	No	false	Print the token list as JSON

auth developer-token revoke

Revoke a developer token by UUID.

lenserfight auth developer-token revoke <token-id>

Security model

• Session tokens continue to power the normal Supabase auth flow.
• Developer tokens are time-bounded and stored separately in ~/.lenserfight/lenserfight.json.
• The browser approval page only approves the request; it never reveals the session token or password.
• The approval and token RPCs require an authenticated session.

Related

• Configuration - where tokens are stored
• Environment Variables - env precedence and auth URLs
• Community Commands - follow lensers after logging in

lf auth

Manage authentication, device approval, and developer tokens.

lf auth request

Start a device approval request and wait for a developer token.

Flag	Type	Required	Description
--label	string	no	Optional label for the developer token
--request-ttl-minutes	string	no	Device approval request lifetime in minutes
--token-ttl-hours	string	no	Developer token lifetime in hours
--json	boolean	no	Print the initial request as JSON