Pair with the Console

The Console is loopkeep's web control plane: sign in, see your paired devices, revoke a stolen one, and connect GitHub and Slack so their events can trigger workflows on your machine. Pairing is optional — everything local (cron, file watching, git triggers, the inbox) works without an account, forever.

Pair this device

Open the desktop app and follow the sign-in prompt — it walks you through pairing when you first launch it. Your browser opens an approval screen; approve it and the app finishes the pairing. The device gets its own token and signing key; nothing is shared between devices.

Prefer the terminal? The CLI runs the same flow — like claude or gh:

lk login

Afterwards:

lk account    # show login state and the Console connection
lk logout     # revoke this device and log out

Manage devices

Open the Console and go to Devices. Every paired device is listed, and any of them can be revoked from there. Revoking invalidates the device's token — useful when a laptop is lost or stolen — and deletes that device's uploaded run snapshot, workflow catalog, and trigger-routing declarations. Its local data and workflows remain. Stop automation is a narrow, persisted gate on future automatic firings that can be cleared locally; it is not a process or runtime kill switch. Revoking cuts the Console connection but does not apply that gate. Protecting a lost machine's disk is the job of OS disk encryption.

On a supported device, Stop automation applies the same persisted global trigger gate as lk pause --all: future automatic firings stop, while manual and in-flight runs continue. Resume is deliberately local-only. Stop remains actionable while the device is offline or its presence is unknown, but it is not queued for later. If the request is not delivered, the Console reports that result and local automation keeps running. Stop and Revoke are separate operations. If Stop is rejected, expires, or remains unconfirmed, inspect the device before retrying.

What pairing enables

Remote start requires the account's remote-manual entitlement. Active-run supervision, workflow controls, and Stop use the separate remote-supervision entitlement. Connector triggers and device revocation require neither.

• GitHub, Slack, and webhook triggers — outside events reach your daemon through the Console. See The Console for how this works and what the Console can and cannot see.
• Start a run from the Console — on an entitled plan, on a device that's online.
• Supervise active runs — see the latest active snapshot and Finish an attended run on an online capable device without aborting its process.
• Control workflow triggers — enable or disable future automatic firings per workflow and device; manual and in-flight runs are unaffected.
• Stop automation remotely — set the device's global automatic-trigger gate; resuming still happens locally.
• Remote revoke — unpair a device from the browser.

What stays on your machine

The daemon connects outward to the Console over WebSocket — no inbound ports are opened. What comes down that connection is an event you subscribed to and the text that caused it — delivered, not stored. Your repositories, .env, secrets, policies, workflow bodies, prompts, and run transcripts never leave the machine. Pairing uploads a minimal workflow catalog and, when remote supervision is enabled, the latest active-run state and source locators. It does not upload titles, bodies, authors, sessions, worktrees, or engine settings. Routing declarations used for event matching are uploaded separately from that catalog.