Skip to content
Spinbox
Spinbox is experimental: APIs change and data may be lost. Status lists what is built and what proves it.

spin team

View Markdown
Manage teams and team membership.


Teams provide hierarchical grouping of users and workspaces. Teams can be
nested up to 3 levels deep (e.g., /engineering/backend/api).


Usage:
  spin team [flags]
  spin team [command]


Available Commands:
  create      Create a new team
  delete      Delete a team
  forge       Manage the app a team's workspaces reach its repositories with
  get         Get team details
  list        List teams
  member      Manage team members
  policy      Manage the network policies a team's workspaces may run under
  secret      Manage the secrets the egress proxy adds for a team's workspaces


Flags:
  -h, --help   help for team


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")


Use "spin team [command] --help" for more information about a command.

spin team create

Section titled “spin team create”
Create a new team. Use --parent to nest under an existing team.


Examples:
  spin team create engineering
  spin team create backend --parent engineering
  spin team create api --parent /engineering/backend


Usage:
  spin team create <name> [flags]


Flags:
      --description string   Team description
  -h, --help                 help for create
      --parent string        Parent team ID or path
      --slug string          URL-friendly slug (auto-generated if empty)


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team delete

Section titled “spin team delete”
Delete a team. Only team owners can delete teams.
Teams with children cannot be deleted unless --recursive is used.


Usage:
  spin team delete <team> [flags]


Flags:
  -h, --help        help for delete
      --recursive   Delete children too (dangerous!)
  -y, --yes         Skip confirmation


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team forge

Section titled “spin team forge”
A team's forge is the app it installed on its organization - a GitHub App, today. The control
plane keeps the app's key and mints an installation token with it, an hour's, for the egress
proxy of a host a workspace of the team runs on; a brokered network rule that injects the forge
has the proxy set it on the workspace's requests to the forge. A workspace clones and pushes the
team's private repositories with nothing of either on its disk, so nothing of either is in a
snapshot of it. A workspace of a sub-team uses the nearest of its teams that has one.


Usage:
  spin team forge [flags]
  spin team forge [command]


Available Commands:
  delete      Delete a team's forge app
  list        List a team's forge apps
  set         Set a team's app on a forge: github, its GitHub App


Flags:
  -h, --help   help for forge


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")


Use "spin team forge [command] --help" for more information about a command.

spin team forge delete

Section titled “spin team forge delete”
Delete a team's forge app


Usage:
  spin team forge delete <team> <forge> [flags]


Flags:
  -h, --help   help for delete
  -y, --yes    Skip confirmation


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team forge list

Section titled “spin team forge list”
List a team's forge apps


Usage:
  spin team forge list <team> [flags]


Flags:
  -h, --help   help for list


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team forge set

Section titled “spin team forge set”
Set the team's GitHub App: its id, its installation on the organization the team's
repositories are in, and its private key, read from a file (as GitHub hands it over) or from
standard input with --private-key-file -. Never an argument: an argument is in every process
listing on the machine. The control plane tries the app before keeping it: an id, an
installation or a key GitHub refuses is said here. The token goes to github.com and
api.github.com unless --host names where; a brokered rule that injects the forge and names any
other host is refused it.


Example:
  spin team forge set engineering github --app-id 123456 --installation-id 7890123 \
    --private-key-file ~/Downloads/engineering.2026-10-15.private-key.pem


Usage:
  spin team forge set <team> <forge> [flags]


Flags:
      --api-url string            The forge's API, for GitHub Enterprise Server: https://<host>/api/v3
      --app-id int                The app's id, on its settings page
  -h, --help                      help for set
      --host stringArray          A host the token may be sent to, named exactly (repeatable)
      --installation-id int       The app's installation on the organization, at the end of its URL
      --private-key-file string   The app's private key, PEM; - reads standard input


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team get

Section titled “spin team get”
Get team details


Usage:
  spin team get <team> [flags]


Flags:
  -h, --help   help for get


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team list

Section titled “spin team list”
List teams


Usage:
  spin team list [flags]


Flags:
      --all             Include all descendant teams
  -h, --help            help for list
      --parent string   Filter by parent team


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team member

Section titled “spin team member”
Manage team members


Usage:
  spin team member [flags]
  spin team member [command]


Available Commands:
  add         Add a member to a team
  list        List team members
  remove      Remove a member from a team
  role        Update a member's role


Flags:
  -h, --help   help for member


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")


Use "spin team member [command] --help" for more information about a command.

spin team member add

Section titled “spin team member add”
Add a member to a team


Usage:
  spin team member add <team> <email> [flags]


Flags:
  -h, --help          help for add
      --role string   Role: owner, admin, member (default "member")


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team member list

Section titled “spin team member list”
List team members


Usage:
  spin team member list <team> [flags]


Flags:
  -h, --help   help for list


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team member remove

Section titled “spin team member remove”
Remove a member from a team


Usage:
  spin team member remove <team> <user-id> [flags]


Flags:
  -h, --help   help for remove


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team member role

Section titled “spin team member role”
Update a member's role


Usage:
  spin team member role <team> <user-id> <role> [flags]


Flags:
  -h, --help   help for role


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team policy

Section titled “spin team policy”
A team's network policies are named allowlists, declared by its admins where the
installation lets teams declare them, for the workspaces of the team and of the teams below it.
A workspace runs under one by naming it (spin workspace create --network-tag, spin workspace
retag). They only allow: a brokered rule is the installation's to declare.


Usage:
  spin team policy [flags]
  spin team policy [command]


Available Commands:
  delete      Delete a team's network policy no workspace runs under
  list        List a team's network policies and what each allows
  set         Make a team's policy, or replace what it allows


Flags:
  -h, --help   help for policy


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")


Use "spin team policy [command] --help" for more information about a command.

spin team policy delete

Section titled “spin team policy delete”
Delete a team's network policy no workspace runs under


Usage:
  spin team policy delete <team> <name> [flags]


Flags:
  -h, --help   help for delete
  -y, --yes    Skip confirmation


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team policy list

Section titled “spin team policy list”
List a team's network policies and what each allows


Usage:
  spin team policy list <team> [flags]


Flags:
  -h, --help   help for list


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team policy set

Section titled “spin team policy set”
Make a team's policy, or replace what it allows, whole. Each --rule is destinations, then
the ports they are reached on after a colon: CIDRs or addresses, and names - exact or with one
leading "*." - separated by commas. No ports is every port; no destinations is any destination
on those ports. No --rule at all allows nothing.


Example:
  spin team policy set <team> builds --rule github.com,*.githubusercontent.com:443 --rule 10.20.0.0/16:5432


Usage:
  spin team policy set <team> <name> [flags]


Flags:
  -h, --help               help for set
      --rule stringArray   Destinations and ports, as dest,dest:port,port (repeatable)


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team secret

Section titled “spin team secret”
A team's secrets are what a brokered network rule has the host's egress proxy add to a
request a workspace of the team makes - an API key the workspace uses without ever holding it.
A value is set and replaced, and not shown again; it is sent only to the hosts set with it. A
workspace of a sub-team uses the nearest of its teams that has the name. The installation's
admins, who write the policies, are trusted with it.


Usage:
  spin team secret [flags]
  spin team secret [command]


Available Commands:
  delete      Delete a team's secret
  list        List a team's secrets, by name
  set         Set a team's secret, read from standard input or kept in Secrets Manager or Parameter Store


Flags:
  -h, --help   help for secret


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")


Use "spin team secret [command] --help" for more information about a command.

spin team secret delete

Section titled “spin team secret delete”
Delete a team's secret


Usage:
  spin team secret delete <team> <name> [flags]


Flags:
  -h, --help   help for delete
  -y, --yes    Skip confirmation


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team secret list

Section titled “spin team secret list”
List a team's secrets, by name


Usage:
  spin team secret list <team> [flags]


Flags:
  -h, --help   help for list


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

spin team secret set

Section titled “spin team secret set”
Set a team's secret to what standard input holds, and the hosts it may be sent to, replacing
what the name held. Read from standard input and never an argument: an argument is in every
process listing on the machine. A brokered rule that injects the secret and names any host not
given here is refused it.


With --ref the team keeps the value in Secrets Manager or Parameter Store instead, and the control
plane reads it as the team whenever a host asks: the secret or the parameter must carry the tag
spin-team-id with the team's id. A parameter costs nothing; a SecureString is opened on the read.


Example:
  printf %s "$GITHUB_TOKEN" | spin team secret set engineering github --host api.github.com
  spin team secret set engineering github --host api.github.com \
    --ref arn:aws:secretsmanager:us-east-2:123456789012:secret:github-AbCdEf


Usage:
  spin team secret set <team> <name> [flags]


Flags:
  -h, --help               help for set
      --host stringArray   A host the secret may be sent to, named exactly (repeatable)
      --ref string         The ARN of the Secrets Manager secret or the Parameter Store parameter the team keeps the value in


Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

Generated by task reference from spin/cmd/cli at 8eee32b9d.

Documents Spinbox v20261019.02. This page as Markdown, for a model or a terminal.