Login & sessions
Browser login
l login --profile production
l whoami --profile production
The CLI opens AWS Sign-In and waits up to five minutes for a callback on 127.0.0.1 at a random port. Use a browser on the computer running the CLI. The terminal reports the final result after STS verifies the credentials and the session is saved successfully.
Without --profile, login uses the profile field from the nearest project config, falling back to default when no profile is configured. To select default explicitly:
l login --profile default
Browser does not open automatically
In v2.0.0, a browser opener failure can still stop login. Do not assume the callback remains active after the command exits. Login over SSH or inside a container requires a loopback callback that your browser can reach; opening the URL on another computer is not sufficient.
Authentication region
Login region priority: --region, then AWS_REGION, then AWS_DEFAULT_REGION, then ap-southeast-1.
l login --profile production --region us-east-1
This region is used for AWS Sign-In login and refresh. The Lambda region comes from the resource command option, then the project region, then the session region. l whoami displays the auth region, which may differ from your Lambda target.
Global storage
| Profile | Session location |
|---|---|
default | ~/.l/session.json |
| Named profile | ~/.l/profiles/<profile>/session.json |
Credentials are not stored in l.config.json. Session files contain temporary credentials, a refresh token, and a private DPoP key. On macOS/Linux, directories use 0700 permissions and files use 0600. Sessions are not encrypted through the operating system keychain.
On Windows, the default location follows your home directory, for example C:\Users\name\.l\session.json. POSIX modes do not replace Windows ACLs; session access follows the permissions on your user folder. The CLI does not configure custom ACLs.
l.config.json only needs the profile name.l profiles are separate from AWS CLI profiles. Neither AWS_PROFILE nor ~/.aws/config selects an l profile. Logout, profile listing, and global profile switching commands are not available yet.
Automatic refresh
Before accessing AWS, the CLI attempts a refresh if credentials expire in less than 60 seconds. Refresh only updates the active profile. Avoid concurrent logins or refreshes for the same profile across multiple processes.
If you see The refresh token has expired, sign in again using the profile name in the error message:
l login --profile production
l whoami --profile production
After success, retry your original command. Check network or AWS permission errors separately using troubleshooting.
Permissions by command
| Operation | Required Lambda permissions |
|---|---|
| List functions or select one from AWS during init | lambda:ListFunctions |
| Inspect or pull one function | lambda:GetFunction |
| Push | lambda:GetFunction, lambda:UpdateFunctionCode |
Pull with --all or --prefix | lambda:ListFunctions, lambda:GetFunction |
Bulk push selects targets from local folders, so listing permission is not required. Selecting one function from a configured prefix without an explicit selector uses AWS listing. --dry-run does not prove that the identity has upload permission.
Read multiple profiles to separate account logins and project configuration to set defaults.