Skip to main content
loomloom uses a verified Server profile and a credential issued for that environment. Both preset platforms are operational in v0.2.1: Run loomloom doctor --output json first. If the current profile is already healthy, continue using it.

​
Browser login for preset platforms

Run only the command for the platform you selected. The CLI opens its authorization page and saves the returned credential locally after validating it against the selected Server. Use --no-browser to print the URL instead of opening it automatically, or --login-timeout 10m when more than the default five minutes is needed. Browser login is supported for the ShengSuanYun and CogFoundry presets. Custom Servers use an API Token.

​
API Token authentication

Create a Token from the selected platform: Verify the exact Server and Token pair before persisting it:
If verification succeeds, persist the Token under the exact variable returned in token_env, then verify the active profile:

​
Credential rules

  • Use a token only with the environment and platform that issued it.
  • Send a token only over HTTPS and only to the host you explicitly configured.
  • Never send a ShengSuanYun token to a CogFoundry host, or a CogFoundry token to a ShengSuanYun host.
  • Do not follow a cross-domain redirect while retaining a token.
  • Never place a real token in source code, committed .env files, documentation, screenshots, logs, or support tickets.
  • Prefer the profile-specific token_env returned by doctor over a command-line --token; command-line arguments may be retained in shell history or visible to local process inspection.
An environment Token has higher priority than a browser credential for the same profile. If they differ, remove or update the environment variable intentionally; do not describe this as a browser-login failure.

​
Logout

Logout removes only the browser credential saved for the active profile. It reports environment_token_set separately and does not edit shell configuration. Remove an environment Token only after identifying the exact token_env and intentionally updating your local configuration.

​
Explicit verification

Use explicit flags when registering or checking a new Server:
Use this only in a protected terminal session. See Server profiles and Environment variables for profile behavior and precedence.