Connecting accounts and devices

There is a single Local Keep AI account. The CLI, the web app, the iOS and Android apps and the desktop app all sign in to it, and all see the same conversations, the same plan and the same limits. There is nothing to pair and no per-device licence.

lk login opens your browser. You approve there, and the browser posts the token back to a callback the CLI is listening on locally. No key is copied by hand, and the token is stored in your user config rather than in the project you happen to be in.

lk logout is local. It does not sign you out of the web app, your phone, or your other machines — each client holds its own session.

Sign in with the same account and your history appears. On desktop and on the web, sign out lives at the bottom of the left-hand rail, under the theme and settings controls. On phones it is at the bottom of the drawer behind the menu button.

This is separate from signing in, and it is the part people miss. A device has to REGISTER before you can text it, because the bridge routes by device name — @macbook: run the tests has to resolve to something.

A machine keeps the same identity across restarts. Earlier builds minted a new device id every time the bridge started, so a laptop that had been restarted a few times appeared as a list of near-identical entries on the devices page. The id is now derived from the computer's own name, so restarting re-registers the same device instead of adding another.

The bridge only accepts commands from contacts you have explicitly added. An unknown number is ignored, not queued — this is the security boundary for a feature whose whole purpose is executing commands on your computer.

Integrations are OAuth connections to other services, kept per account. Connecting one starts a normal browser OAuth flow.

lk integrate revoke drops the token stored locally. It does NOT invalidate it at the provider. If you are revoking because a token may have leaked, also revoke it in that provider's own security settings — this command alone is not enough.

lk secrets gitignore ensures your .gitignore excludes .env files, applying the same rules lk run applies at startup. It is worth running once in any repository you are about to point the agent at.