Multiple profiles
Store AWS logins for several accounts or identities and select one per project. Each profile has its own credentials, refresh token, and DPoP key.
Set up profiles
l login --profile production
l login --profile staging
l whoami --profile production
l whoami --profile staging
Complete browser login with the appropriate identity for each profile. production and staging are local labels; the CLI does not infer an AWS account from them. Check Profile, Account, and Identity in the whoami output.
Profile names contain 1–64 lowercase letters, digits, underscores, or hyphens, starting with a letter or digit. Examples: production, team-a, dev_01. Uppercase letters, spaces, dots, and path separators are rejected.
con, prn, aux, nul, com1–com9, and lpt1–lpt9 are rejected on every OS to keep profiles portable. See the release notes.Bind a profile to a project
From your project folder, run:
l init --profile production
The wizard saves the profile field without asking for its name again. Without this option, l init asks for a profile, defaulting to the existing config or default. You can also edit the config directly:
{
"version": 1,
"name": "billing",
"region": "ap-southeast-1",
"profile": "production",
"lambda": {
"prefix": "billing-"
}
}
These commands then automatically use production:
l whoami
l lambda list
l pull --prefix billing-
l push --all --dry-run
See project configuration for the full schema and multiple functions at once for target selection. Manual init is available before login.
Selection priority
| Source | Priority | Scope |
|---|---|---|
--profile <name> | First | The current command |
profile in the nearest project config | Second | Project default, including commands run from subfolders |
default | Last | When neither an option nor a project profile is set |
This applies to login, whoami, Lambda list/info, and pull/push. Init uses the config in the current folder, not a parent config, because it creates or updates the project in that folder.
l lambda list --profile staging
l --profile staging lambda list
l whoami --profile default
An override does not change the project config. Use l init --profile staging to save a different profile through the wizard. -p still means Lambda prefix; use the full --profile option for authentication.
default session is not silently substituted.Storage and compatibility
~/.l/
├── session.json # default profile, including older CLI sessions
└── profiles/
├── production/session.json
└── staging/session.json
Older configs without profile continue to use default; you do not need to move the session. Signing in again only replaces the selected profile's session. Automatic refresh only updates that profile as well. Secrets stay in your home directory, not in l.config.json or this documentation site.
l profiles are separate from AWS CLI profiles in ~/.aws/config; AWS_PROFILE does not select an l profile. There is no l profile list, global switching, logout, or profile deletion command yet. Select a profile through the config or available option.
Regions, accounts, and sync history
The login region follows l login --region, AWS_REGION, AWS_DEFAULT_REGION, then ap-southeast-1. It is stored for auth/refresh. The resource region follows --region on Lambda/pull/push commands, then the project region, then the session region if the command supports running without a project. Pull/push always require a project config.
lambda/ or .l/state.json. The baseline still binds code to its original ARN/account/region. Use separate project folders for different accounts or regions. Profiles with the same account and region must still pass identity and revision checks.Signing in to another account under the same profile name affects every project that uses it. Verify whoami before syncing.
Expired refresh token
Use the profile name from the error message:
l login --profile production
l whoami --profile production
After success, retry your original command. See troubleshooting for recovery and login and sessions for PKCE, DPoP, and storage details.