Authentication

Sign in to Lobby automation without copying browser cookies or agent capabilities.

Local CLI and MCP

Run an interactive email-code login once for each Lobby origin:

lobby login --email you@company.com

The CLI verifies the identity with Lobby and saves an owner-readable session in the local user’s configuration directory. Browser sign-in is separate. Never copy the saved session into a repository, command argument, MCP configuration, prompt, or another user’s account.

Run lobby logout to remove the local session. Sign in again after the session expires. For a non-production deployment, pass the same --site HTTPS_ORIGIN to login and later commands; login also accepts --auth-url HTTPS_ORIGIN when that deployment uses another Auth origin.

Account membership and each person’s GitHub repository permission are checked by the server. A conversation ID selects scope; it does not grant access. Discover authorized IDs with:

lobby conversations list

Inside a Lobby agent

Lobby supplies short-lived, conversation-scoped authority to eligible agents. Commands inherit the account, repository, conversation, run, and actor; omit --site, --conversation, and --repository when the command says scope is inherited. The agent cannot turn that capability into broader or durable access.

API keys

Lobby does not currently issue customer API keys or service-account credentials. The product’s browser cookies and internal bearer capabilities are not substitutes for an API key and are not a stable public integration contract.