Skip to main content

Setting up sync

Sync copies the personal library through the hosted API. It never writes project dests or home agent dirs. Skip this page if you want to stay local.

Log in​

skl login

The CLI prints a verification URL like https://tryskl.fyi/device?user_code=ABCD-2345 and a user code. Open the URL, approve the device, and wait for the poll to finish.

The device token is stored in ~/.local/share/skl/state.db. Login also writes api_base to ~/.config/skl/config.toml. The OS keyring is not required.

If the code expires, run skl login again. If you deny the request, the CLI exits with "device authorization was denied".

Second machine​

  1. Install skl.
  2. Run skl login and approve the new device.
  3. Run skl sync.

The second machine pulls the personal library. Project dests are still empty until you skl use in each project.

Sync​

skl sync

skl sync hash-syncs ~/.local/share/skl/skills only. .agents/skills in a project does not change. Home copies under ~/.claude/skills or ~/.cursor/skills do not change.

You need a local index first. Run skl init or skl create if state.db does not exist yet.

Conflicts​

A conflict is a tree-hash mismatch. The same skill name has different content locally and on the server. Default on a TTY is a prompt per skill.

skl sync --keep-local
skl sync --keep-remote

--keep-local overwrites the remote tree. --keep-remote overwrites the local library copy. There is no merge.

On a non-TTY, pass one of those flags. Sync refuses to guess.

Secret findings​

Upload is scanned first. Warning-level findings block the upload unless you pass --allow-warnings. Block-level findings always refuse. See Secret scrubbing.

Auto-sync​

When [sync] auto = true (the default), login, init, use, unuse, status, create, capture, and list may run a fail-soft sync in the background. frequency_secs defaults to 900. A failed attempt still counts as the throttle.

Background auto-sync cannot prompt. Tree-hash conflicts there keep the remote copy. Use an explicit skl sync when you want the prompt or --keep-local.

Set auto = false to turn piggyback off. skl sync still works.

Log out​

skl logout

Logout clears the local device token in state.db. It does not revoke the device on the server. Revoke devices on the devices page.

What the server can read​

Sync is not end-to-end encrypted. Traffic uses TLS. Skill blobs are stored at rest on the server, and the server can read them. Treat the personal library as data you are willing to give that host.