Workspace workflow

Repo config stays commit-safe. Secrets live in the vault; each developer picks one local environment.

Workspace Setup and Update list env files beside a table with one row per detected secret, followed by each selected file's existing authsia:// references as read-only rows; a reference whose item is not in the vault is Not found and counts as Needs attention. Unchecking an env file stops managing it, so workspace run and workspace health ignore it; its references stay in the file. Filter the table by status (All, Needs attention, New, In vault, Skipped), by env file, or by key; Include All and Skip All act on the shown rows. Set a file environment in the file list, then select one or more rows to override their environment with Default, All, or named environments. Use File Environment removes an override; filename suggestions, including dev, prod, and stage, apply only when chosen. Before apply, setup lists variables that env files in the same folder would define with equal priority in an environment they share, and blocks rows that would store the same vault item. Apply saves each file's environment, and Update starts from it: a file with an environment applies only while that environment is selected, so .env.dev and .env.prod do not compete with .env when no environment is selected. Environment choices are included in the storage approval and saved with the secrets. The Bridge refreshes vault metadata after approval so deleted items can be imported again.

Applying selected workspace secrets asks for one Workspace Secret Migration approval covering the selected items, destination folder, environment tags, and rollback backups. It grants no reusable CLI session. If approval is denied or storage fails, env files remain unchanged. The app's local preview and rules-only updates need no vault approval.

authsia workspace init and update review only values detected as secrets; add --all-values to review every literal env-file assignment.

authsia workspace reset restores managed env files when backups exist and removes local workspace metadata. The preview checks which files have a backup without asking for approval or reading backup values. Reset then restores every file under one Workspace Env Restore approval and grants no reusable CLI session. A file without a backup stays unchanged with a warning. Denying the approval stops reset; config-only env bindings need no backup access.

Select one environment

List Default, workspace tags and saved file environments, and env bindings, then select one. Named envs use exact-tagged and All items, and an env file with a file environment applies only in that environment; Default stays inactive until you use Default or clear.

Remove a stale binding with authsia workspace env remove NAME authsia://.... Removal works even when unrelated MCP configuration is invalid; it preserves vault items, other bindings, and MCP settings. Normal workspace operations still require valid configuration.

Override one run

Does not change the saved workspace environment.

Resolution order

Searches upward for the nearest .authsia/workspace.json. Conflicts fail closed. A reference in an env file set to the selected environment that only matches items for other environments also fails, as environmentMismatch, unless a one-run --env-file supplies the variable. authsia workspace status shows each file's environment.