Project authorization

Connect a repository to a Web project with loom web setup project, then approve a narrow ingestion credential from an interactive terminal:

loom auth project --flow browser
# For an interactive remote shell:
loom auth project --flow device

The command reads the repository's strict .loom/config.yml Web destination and shows its HTTPS origin and project UUID before approval. Browser flow uses an OS-assigned loopback callback on the CLI machine and PKCE S256. Web requires a fresh consent decision for each authorization, even with an existing approval. Device flow shows a verification URL and user code, so approval may happen in a browser on another machine. Choose the flow explicitly; a denial never starts another flow. A script without an interactive terminal cannot start approval. Complete it in an interactive session first.

Both flows request only ingest:write for the configured project. The server's one-time response binds the owner, project, operation and 30-day credential expiry. The CLI writes the resulting project credential and local repository enrollment in the private ~/.config/loom/auth.json store; it never saves a browser session, OAuth bootstrap proof or account grant for this project-only path. A copied repository or changed destination needs explicit enrollment again. The project credential does not permit account management or listing or creating projects. Authorization alone does not enable uploads; loom web setup project controls upload consent.

loom auth project status
loom auth project logout

Status shows only the selected origin, project, owner, credential identity, expiry and recovery state. It identifies any pending operation and reports pending operation blocks upload separately from the selected credential's status. A false value for that field only means pending history does not block this selection; a revoked or locally removed selection cannot upload. An interrupted automatic issue or renewal remains visible after a later explicit approval, while a separately selected active project-only credential may upload. Review the project's Credentials page in Web for any unresolved remote credential, and revoke an orphan there if present. An uncertain renewal of the named selected predecessor remains blocked.

Logout removes this repository's selected project authorization locally. It does not prove the server credential was revoked. To revoke it remotely, open the named project at the displayed Web origin and use its Credentials page. Other devices and independent CI credentials are not remotely changed by local logout. If a one-time exchange reply or local save is lost, the server may hold an orphaned credential: review that project's Credentials page, revoke it if present, then make a fresh explicit approval. A rejected, revoked or locally removed credential does not authorize automatic fresh issuance.

The file store is unencrypted private JSON, protected by current-user file ownership and permissions on Linux and macOS. A host job running as the same OS user can read that user's home, so use trusted host workflows while credentials are stored. Project tokens never enter portable repository config, workflow options, job environments, ordinary command output or receipts.