> ## Documentation Index
> Fetch the complete documentation index at: https://gleanfeed.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI profiles and repository config

> Select workspaces deterministically while keeping OAuth tokens and API keys out of repositories and command history.

A profile pairs non-secret workspace metadata with a user-local OAuth grant or
API key. A repository stores only the profile selector and expected workspace
identity.

## Authenticate a profile

Interactive login opens a browser:

```bash theme={null}
gleanfeed auth login --profile personal
gleanfeed auth status --profile personal
gleanfeed profile list
```

Sign in or sign up, choose a workspace, and approve the requested scopes. For a
noninteractive environment, use an API key from an environment variable or
stdin. Never put the key value in an argument:

```bash theme={null}
printf '%s\n' "$GLEAN_FEED_API_KEY" | \
  gleanfeed auth login --profile ci --stdin
```

## Selection order

The CLI selects exactly one profile in this order:

1. The global `--profile <name>` option.
2. The repository's `.gleanfeed.json` profile.
3. The active user profile selected by `gleanfeed profile switch <name>`.

The saved credential still determines the workspace on the server. If the repository's
expected workspace ID differs from the selected profile, the CLI fails instead
of silently switching the binding.

## Initialize a repository

Run from any directory inside the Git repository:

```bash theme={null}
gleanfeed init --profile personal
gleanfeed config validate
```

The CLI finds the Git root and writes schema version 1:

```json .gleanfeed.json theme={null}
{
  "version": 1,
  "profile": "personal",
  "workspaceId": "WORKSPACE_ID",
  "defaultBoard": "product-ideas",
  "portalUrl": "https://feedback.example.com",
  "appUrl": "https://app.gleanfeed.com"
}
```

Only `version`, `profile`, and `workspaceId` are required. `defaultBoard`,
`portalUrl`, and `appUrl` are optional non-secret conveniences. Repository config
cannot set an API endpoint, credential, user data, or absolute machine path.

The CLI does not modify `.gitignore`. Review the file, then deliberately commit
it when collaborators should share the workspace selector.

## Inspect and update supported fields

```bash theme={null}
gleanfeed config get
gleanfeed config get defaultBoard
gleanfeed config set defaultBoard product-ideas
gleanfeed config set profile personal
gleanfeed config validate
```

`version` and `workspaceId` are derived and read-only. Setting `profile` refreshes
the expected workspace ID from that authenticated local profile. Re-running
`init` preserves supported values that were not replaced on the command line.

## Where credentials live

Profile metadata and credentials live in the current user's application config
directory, separate from the repository. On macOS and Linux, the directory is
owner-only (`0700`) and both files are owner-readable/writable (`0600`). Windows
uses the current user's application-data ACLs. Writes use same-directory
temporary files and atomic renames.

Set `GLEAN_FEED_CONFIG_DIR` only for an isolated test or automation root. Do not
commit that directory.

## Remove access

```bash theme={null}
gleanfeed auth logout --profile personal
```

For OAuth profiles, logout attempts remote revocation and always removes the
local profile and tokens. For API-key profiles, revoke the key separately in
**Settings → API Keys** so any other copy stops working. Remove `.gleanfeed.json`
when the repository should no longer select the workspace.

See [CLI security](/api/cli-security) for scope, rotation, and telemetry details.