lumo doctor
Runs the checks a new user otherwise discovers by trial and error, and prints the command that fixes each failing one.
lumo doctor
✓ profile default (/Users/jane/.lumoauth/credentials.yaml)
✓ organization acme-corp
✓ server https://app.lumoauth.dev
✓ credential jane@acme.com, login token, expires 2026-09-16T17:00:00Z
✓ scopes openid profile email admin
✓ discovery issuer https://app.lumoauth.dev/orgs/acme-corp/api/v1
✓ admin api GET /admin/organization succeeded
lumo 1.1.0
| Check | What it verifies | Typical fix |
|---|---|---|
| profile | Which profile is active and where it is stored | lumo profile use <name> |
| organization | An organization slug is selected | lumo login --org <slug> or --org / LUMO_ORG |
| server | Which base URL the CLI will call (and whether TLS verification is off for it) | --base-url / LUMO_BASE_URL |
| credential | Which credential will be sent; expired tokens are refreshed on the spot | lumo login or LUMO_API_KEY |
| scopes | A login token carries an admin scope | lumo login again (requests admin by default) |
| discovery | The server is reachable and the organization exists | Check --base-url; for a local dev certificate run lumo login --insecure once (remembered for that server) |
| admin api | The credential can read the organization (GET /admin/organization) | Follow the printed scope hint |
A broken ~/.lumoauth/config.yaml shows up as a failing config check first. With an API key the report ends with a note line reminding you that keys are checked per resource: a 403 on another command names the missing scope.
Exit code is 1 when any check fails, so it can gate a CI job. Use -o json for a machine-readable report ({"ok": bool, "checks": [...], "version": "…"}; each check has name, status of ok, warn, fail or skip, detail and an optional hint):
lumo doctor -o json | jq '.checks[] | select(.status != "ok")'