Install

The CLI is a single statically linked Go binary. Every channel installs the same binary, and lumo upgrade later upgrades it through whichever channel you used.

	Recommended	Also works
macOS	Homebrew	install script · release archive · go install
Linux	Homebrew or the install script	release archive · go install
Windows	Scoop or winget	release archive · go install · WSL + install script

Builds ship for macOS (Apple silicon, Intel), Linux (x86_64, arm64, i386) and Windows (x86_64, i386). There is no Windows arm64 build; use go install there.

Homebrew (macOS / Linux)

brew install lumoauth/tap/lumo

The tap is LumoAuth/homebrew-tap and lumo is published as a cask. On macOS the cask clears the Gatekeeper quarantine attribute for you, so the unsigned binary runs without a warning. Shell completions for bash, zsh and fish are installed alongside.

brew upgrade lumoauth/tap/lumo   # or just: lumo upgrade

Scoop (Windows)

scoop bucket add lumoauth https://github.com/lumoauth/scoop-bucket
scoop install lumo

The bucket is LumoAuth/scoop-bucket. Upgrade with scoop update lumo or lumo upgrade.

winget (Windows)

winget install --id LumoAuth.lumo

Each release is submitted to microsoft/winget-pkgs automatically and becomes installable once Microsoft merges it, usually within a few days. If winget cannot find the newest version yet, use Scoop or a release archive in the meantime. Upgrade with winget upgrade --id LumoAuth.lumo or lumo upgrade.

Install script (Linux / macOS / WSL)

No sudo required.

curl -fsSL https://raw.githubusercontent.com/LumoAuth/cli/main/install.sh | sh

What the script does:

1. Detects your OS and architecture.
2. Fetches the latest release from github.com/LumoAuth/cli/releases/latest.
3. Verifies the archive's SHA-256 against the release's checksums.txt and refuses to install on a mismatch (LUMO_SKIP_CHECKSUM=1 bypasses this; don't).
4. Installs the lumo binary to ~/.local/bin.
5. Adds ~/.local/bin to your shell's PATH (bash, zsh, fish or sh) if it isn't already.

Restart your shell (or source your profile) and run:

lumo --version
# → 1.1.0 (commit abc1234, built 2026-10-07, go1.22.2)

On macOS a binary installed this way is quarantined by Gatekeeper because it is not notarized. Clear the attribute once, or prefer Homebrew:

xattr -d com.apple.quarantine ~/.local/bin/lumo

Release archives (direct download)

Every release on the releases page ships one archive per platform plus checksums.txt. Archives are named lumo_<OS>_<Arch> with OS one of Darwin, Linux, Windows and Arch one of x86_64, arm64, i386; Windows archives are .zip, the rest .tar.gz. This is also the way to pin a specific version in CI, since the install script always fetches the latest release.

# Example: Linux x86_64, latest release
VERSION=$(curl -fsSL https://api.github.com/repos/LumoAuth/cli/releases/latest | grep tag_name | cut -d '"' -f4)
curl -fsSLO "https://github.com/LumoAuth/cli/releases/download/${VERSION}/lumo_Linux_x86_64.tar.gz"
curl -fsSLO "https://github.com/LumoAuth/cli/releases/download/${VERSION}/checksums.txt"
sha256sum --check --ignore-missing checksums.txt      # shasum -a 256 on macOS
tar -xzf lumo_Linux_x86_64.tar.gz lumo
install -m 0755 lumo ~/.local/bin/lumo

Set VERSION=v1.1.0 (with the leading v) instead of the curl lookup to pin a release.

# Example: Windows x86_64
Invoke-WebRequest https://github.com/LumoAuth/cli/releases/latest/download/lumo_Windows_x86_64.zip -OutFile lumo.zip
Expand-Archive lumo.zip -DestinationPath "$env:LOCALAPPDATA\Programs\lumo"
# then add that directory to your PATH

A hand-placed binary is still upgradable with lumo upgrade, which downloads and verifies the next release the same way.

go install

Requires Go 1.22+. Builds from source for whatever platform you are on, including ones without a published archive (for example Windows arm64).

go install github.com/lumoauth/cli@latest          # latest release
go install github.com/lumoauth/cli@v1.1.0          # a specific version

The binary lands in $(go env GOPATH)/bin as cli, because the module root is the main package. Rename or alias it:

mv "$(go env GOPATH)/bin/cli" "$(go env GOPATH)/bin/lumo"

lumo --version reports dev for go install builds: the version, commit and date are injected only by the release pipeline.

Build from source

git clone https://github.com/LumoAuth/cli.git && cd cli
go build -o lumo .

# Optional: install into $GOPATH/bin
go install .

Shell completions

Homebrew installs completions automatically. For every other channel, generate them from the binary:

lumo completion bash | sudo tee /etc/bash_completion.d/lumo > /dev/null   # bash
lumo completion zsh > "${fpath[1]}/_lumo"                                 # zsh
lumo completion fish > ~/.config/fish/completions/lumo.fish               # fish
lumo completion powershell | Out-String | Invoke-Expression               # PowerShell

lumo completion --help has the full per-shell instructions.

Upgrading

lumo upgrade            # detect the install channel and upgrade in place
lumo upgrade --check    # only report whether a newer version exists
lumo upgrade --exec     # upgrade without a confirmation prompt

lumo upgrade detects how the binary was installed and uses the matching channel: Homebrew, Scoop and winget installs are upgraded through the package manager (so its state stays consistent), while manual installs (install script or a hand-placed binary) are self-updated: the release archive for your OS and architecture is downloaded, verified against the release's checksums.txt, and swapped in atomically. On Windows, if the running lumo.exe cannot be replaced while in use, the new version is staged as lumo.exe.new with printed instructions to finish the swap.

Checking the version

lumo --version   # one line: version (commit, build date, Go version)
lumo version     # version, commit, build date and platform on separate lines

Uninstall

Remove the binary through the channel you installed with (brew uninstall lumo, scoop uninstall lumo, winget uninstall --id LumoAuth.lumo, or rm ~/.local/bin/lumo for the install script and release archives), then remove the CLI's own files:

rm -rf ~/.lumoauth

~/.lumoauth holds config.yaml (settings) and credentials.yaml (login tokens); that is everything the CLI puts on disk.