Workspace

A General Input account can belong to many workspaces, your personal projects, your employer's org, a client's org you've been invited into. Each workspace has its own credentials, integrations, and audit log; they're fully isolated from each other.

The CLI authenticates you once (geni login against your account), then remembers which workspace is currently active. Every subsequent command operates in that workspace's context. When you need to do something in a different workspace, switch.

• geni workspace list, every workspace your account belongs to.
• geni workspace switch, change the active workspace.
• geni workspace current, print the active workspace (handy in scripts).

Per-call override

Every command accepts a global --workspace <slug> flag that overrides the active workspace just for that invocation:

geni workspace switch acme                            # default for the rest of this shell session
geni --workspace personal credential list              # one-off, doesn't change the default

Use this when you want to fan out across workspaces without flipping the default back and forth.

How the auth model works

• One auth session, many workspaces. geni login authenticates your General Input account. The same runner-session token works across every workspace your account belongs to.
• Active workspace is local state. It lives in ~/.config/geni/runner-session.json next to the session token. Switching is a local file edit, not a server call.
• Server enforces per-request. Every request includes the active workspace id; the server checks your account has access to that workspace before resolving credentials or returning data.
• No cross-workspace leakage. A geni credential list only returns credentials in the active workspace; credentials connected in one workspace are not visible from another.