Choose an interface
Choose by who is calling and how they will authenticate.
Use the web app for work by hand, MCP for your AI agent, the CLI for shell scripts, and REST for application code. You can combine them in the same workflow.
Match the interface to the task
Caller | Use | Authentication |
|---|---|---|
A person in a browser | Sign in to establish a browser session. | |
An AI agent | OAuth for interactive clients; a bearer API key for headless clients. | |
A person at a terminal | lepsto auth login, then approve the device request in a browser. | |
A CI job or shell script | lepsto auth login --token "$LESSLY_TOKEN" with a product-scoped token. | |
Your application code | A bearer session token or API key. |
Decide how to use the response
MCP gives the agent tool descriptions and input schemas. The CLI returns tables by default, with JSON or YAML available for scripts. REST gives your code direct control over headers and HTTP responses, including X-Product-Id for product selection within the credential’s boundary.
CLI operations that change something require confirmation. An unattended script must supply --yes; without it, the command fails rather than waiting for input. See CLI conventions and exit codes.
Choose credentials for the caller
Use the browser authorization flow for interactive MCP clients. Headless clients can use a supported API key. See MCP credentials and API-key management.
Static API keys are restricted to their associated product on both REST and MCP. Signed-in user credentials use the product as a default and can select another product within the caller’s membership. See product context by credential.
Exchanging an API key returns a one-hour session token that can select products within the owner’s membership. It does not preserve the raw key’s same-product restriction. See key exchange.