Authentication

Secure access for people and automations.

Use browser login for local CLI sessions and separate, minimally privileged tokens for CI, servers, and AI agents.

Recommended for local devices

Browser-based device login

lxi auth login
# Browser prüfen und freigeben
lxi account

The CLI receives a short-lived device code. The password is never passed to the CLI. After your approval, a token is issued exactly once and stored locally with user permissions.

CI and AI agents

Create a token in the customer center

Create a separate token for each environment at Customer Center → API & CLI. Pass it as a secret and never as part of a URL.

export LXI_API_TOKEN='lxi_live_…'
curl https://lxi.be/api/v1/account \
  -H "Authorization: Bearer $LXI_API_TOKEN"

Least Privilege

Assign permissions specifically

readAccountRead usage, domains, and services

domainsDomainsCheck and manage DNS

hostingHostingManage sites and mailboxes

billingPurchasesOrders and checkout

aiKIChat and translations

makerMakerManage projects

maker_gitGitIn addition to maker: explicitly allow branches and pull requests

supportSupportCreate error reports; read allows reading your own tickets

webhooksEventsManage webhook targets

Secrets

Do not store tokens in source code

Use your CI platform's secret stores or LXI_API_TOKEN. The CLI configuration is located at ~/.config/lxi/config.json respectively XDG_CONFIG_HOME and is only readable by the current user.

Lifecycle

Revoke access immediately

In the customer center you can see prefix, scopes, and last use. Revoked tokens lose access immediately. With lxi auth logout you also remove the local copy.