Lark CLI Skill: Shared — Auth, Config & Security

What it is

The Lark CLI Shared Skill is the foundation layer for Lark/Feishu command-line automation. It provides app configuration, authentication login flows, identity switching between multiple Lark apps, scope management for API permissions, and security rules for safe CLI operations.

This skill is for developers and DevOps engineers who automate Lark/Feishu workflows via CLI. If you manage multiple Lark apps, need to switch between identities, or want to script Lark API interactions, this skill provides the authentication plumbing.

How it saves time or tokens

Instead of manually handling OAuth tokens, refresh cycles, and multi-app credential management, this skill provides a single lark-cli auth login command that handles the entire flow. Identity switching lets you move between apps without re-authenticating. Scope management ensures your CLI sessions have the right permissions before making API calls, preventing failed requests and wasted debugging time.

How to use

1. Install the Lark CLI and skill: npm install -g @larksuite/cli then npx skills add larksuite/cli -y -g.
2. Initialize configuration: lark-cli config init to set up your app credentials.
3. Authenticate: lark-cli auth login --recommend to start the auth flow with recommended scopes.

Example

# Install and configure
npm install -g @larksuite/cli
npx skills add larksuite/cli -y -g
lark-cli config init

# Authenticate with recommended scopes
lark-cli auth login --recommend

# Switch between app identities
lark-cli auth switch --app my-production-app

# Check current auth status
lark-cli auth status

# List available scopes
lark-cli auth scopes list

Related on TokRepo

• AI tools for automation -- CLI automation tools and workflows
• AI tools for API -- API integration and management tools

Common pitfalls

• Not running config init before attempting to authenticate. The CLI needs app credentials (App ID and App Secret) configured before the auth flow can start.
• Forgetting to request necessary scopes during login. If your script needs specific API permissions, pass them during auth rather than discovering missing scopes at runtime.
• Storing credentials in version control. The CLI config file contains sensitive tokens. Add the config directory to .gitignore and use environment variables for CI/CD pipelines.