Configuration

Token System

LazyTeams requires 7 tokens to function. The helper lazyteams-auth captures them automatically via Playwright (Firefox).

Token Descriptions

Token	Expiration	Usage	API
MS_GRAPH_TOKEN	~1h	Chats, teams, channels, presence, files	Microsoft Graph v1.0
TEAMS_WEB_TOKEN	~24h	Read/write messages	Teams internal API (ChatSvc)
TEAMS_NOTIF_TOKEN	~24h	Push notifications	Teams internal API
EDU_TOKEN	~1h	Educational tasks/Assignments	Microsoft Education API
TEAMS_SPACES_TOKEN	~24h	Team and channel creation/deletion	Teams beta API
TEAMS_FABRIC_TOKEN	~24h	Private channel member management	Fabric API
TEAMS_COOKIE	~24h	Session authentication	HTTP Headers

Token Renewal

• Automatic Per-Token Renewal: When a token expires (401 or 403), the TUI dispatches lazyteams-auth --renew <token_type> in the background with the correct capture mode. The top bar shows ⟳ Renewing TEAMS_WEB_TOKEN... with the specific token name.
• TEAMS_WEB_TOKEN / TEAMS_NOTIF_TOKEN: ~24h. Fully automatic renewal via background Playwright session.
• MS_GRAPH_TOKEN: ~1h. Renewed via Graph Explorer browser flow.
• TEAMS_FABRIC_TOKEN: ~24h. Renewed via browser flow with role-change instruction (see below).

Fabric Token Capture

TEAMS_FABRIC_TOKEN is captured by changing your own role in any Private or Shared Channel:

1. Go to any Private or Shared Channel.
2. Go to the Members tab.
3. Try to change your own role (e.g., Owner → Member).

⚠️ If you are the only owner of the team, the operation will fail (Teams prevents removing the last owner), but the token is captured instantly on the role-change request — the error is expected and harmless.

The Fabric API returns 403 Forbidden (not 401) when the token is expired — the TUI treats this as expired accordingly.

Persistence

All runtime files live in ~/.config/lazyteams/ (%APPDATA%\lazyteams on Windows):

File	Purpose	Permissions
tokens.env	Authentication tokens	0600
prefs.json	Preferences (self-chat cache, download directory, hidden teams/channels, collapsible sections state, file info toggle showFileInfo). Created when preferences are saved for the first time.	0600
browser-session/	Persistent Playwright/Firefox session (keeps you logged in across runs)	0700
browser-state.json	Internal Firefox state file — ignorable	-
mso_cookies.json	Captured Microsoft cookies used by the auth helper — ignorable	0600

The browser-session/ directory contains a full Firefox profile (SQLite databases, caches, etc.). These are internal Playwright/Firefox files; you can safely ignore them.

Manual Token Export

If you prefer to set tokens manually:

export MS_GRAPH_TOKEN="eyJ..."
export TEAMS_WEB_TOKEN="eyJ..."
export TEAMS_NOTIF_TOKEN="eyJ..."
export EDU_TOKEN="eyJ..."
export TEAMS_SPACES_TOKEN="eyJ..."
export TEAMS_FABRIC_TOKEN="eyJ..."
export TEAMS_COOKIE="skype..."

Environment Variables

The tokens are stored in ~/.config/lazyteams/tokens.env and loaded automatically on startup. The auth helper writes this file with restricted permissions (0600) to protect sensitive data.

Debug Tools

Built-in Debug Mode

Both the TUI and the auth helper support a --debug flag for detailed diagnostics:

• ./lazyteams --debug: Activates diagnostic mode. The TUI propagates the --debug flag to the background auth helper.
• Auth Helper Logging:
  • In normal mode, the auth helper runs with discarded output to prevent polluting the terminal, and no logs are generated.
  • In debug mode, the auth helper writes detailed logs (URLs, pages, ARIA snapshots, EDU requests, and detailed errors) to ~/.config/lazyteams/auth-helper.log.
• Manual Debugging: You can run ./lazyteams-auth --renew <token_type> --show --debug to see the diagnostic logs directly in the terminal while forcing the browser to be visible.
• Both binaries provide updated --help menus with information on these flags.