Developer sandboxes and the CLI
Testing auth against a shared staging tenant means flaky tests and leaked settings. The lumo CLI creates a sandbox organization in seconds, opens a tunnel for local webhooks, and cleans up after itself.

One staging tenant for twenty developers
Someone changes the MFA policy and everyone's tests fail. Webhooks cannot reach a laptop. Preview environments share one client ID.
How LumoAuth solves it
lumo dev start
Creates a sandbox organization with a 24-hour lifetime (one week maximum), seeds a client, and prints the environment variables. Docs
Tunnels for webhooks
lumo tunnel exposes your local server so webhook deliveries and redirects work on a laptop. Docs
Scaffolding
lumo init and npx create-lumo-agent set up an app or an agent project with the right configuration. Docs
Diagnostics
lumo doctor checks your configuration, discovery and keys. Docs
Sandboxes from CI
The Admin API spawns and destroys sandboxes from a pipeline; a daily job removes forgotten ones. Docs
Configuration as code
Terraform and the Kubernetes operator keep real environments reproducible. Docs
Setting it up
Install the CLI
See the install guide.
lumo login
Device flow sign-in from the terminal.
lumo dev start
Copy the printed variables into your .env.
Standards involved
Plain names on the left, the specification on the right. The full map is in the standards reference.
- CLI sign-in
- RFC 8628 device authorization
Which plan you need
The CLI, lumo login, lumo tunnel and lumo migrate are free. Ephemeral sandboxes are a $199/month add-on on Business (ten at a time). Every plan can use its own organizations for testing.
Documentation
Questions
Do sandboxes count toward my usage?
Ship passwordless sign-in this week. Put guardrails on your agents today.
The Developer plan is free for 10,000 monthly users and ten agents, with no card. Everything speaks open standards, so moving in or out is a config change.