Generated from the settings registry in apps/server/config/settings — the one object the
Studio UI, the settings service and the project-defaults service already share — by
npm run docs:settings in the backend. apps/server/tests/settings-docs.unit.test.ts
fails when the committed table no longer matches the registry, so this page cannot claim
a field the product does not have, or omit one it does.
Each group is one row in the app_settings table, keyed by the group name; when no row
exists the group resolves from its environment fallback. See
settings system for how resolution, encryption and
caching work, and the environment reference
for the variables that seed a group before it has ever been saved.
Secret fields are encrypted with CONFIG_ENCRYPTION_KEY and returned as the sentinel __SECRET_SET__ — never in clear text.
Groups at a glance
| Group key | Label | Fields | Holds a secret |
|---|---|---|---|
server.cors | Security · CORS | 2 | — |
security.rateLimit | Security · Rate limits | 6 | — |
security.rateLimitRules | Security · Rate-limit rules | 1 | — |
auth.tokens | Auth · Token expiry | 2 | — |
auth.methods | Auth · Methods | 4 | — |
auth.signup | Auth · Sign-up & passwords | 5 | — |
auth.sessions | Auth · Sessions | 4 | — |
auth.social | Auth · Social providers | 1 | yes |
auth.oauth.custom | Auth · Custom OIDC | 1 | yes |
auth.twoFactor | Auth · Two-factor | 10 | — |
auth.passkey | Auth · Passkey | 4 | — |
auth.phoneOtp | Auth · Phone (SMS) | 4 | — |
auth.hooks.signUp | Auth · Sign-up gate | 5 | yes |
auth.hooks.accessToken | Auth · Access token claims | 3 | — |
auth.hooks.send | Auth · Delivery override | 5 | yes |
auth.hooks.events | Auth · Event webhook | 4 | yes |
auth.urls | Auth · URL configuration | 2 | — |
auth.rateLimits | Auth · Rate limits | 6 | — |
auth.thirdParty | Auth · Third-party auth | 1 | — |
auth.attackProtection | Auth · Attack protection | 7 | yes |
auth.apiKey | Auth · User API keys | 1 | — |
auth.sso | Auth · SSO (OIDC / SAML) | 1 | — |
auth.organization | Auth · Organizations | 4 | — |
email.smtp | Email · SMTP | 6 | yes |
phone.sms | Phone / SMS | 7 | yes |
email.templates | Email templates | 8 | — |
storage.provider | Storage provider | 9 | yes |
storage.limits | Storage · Limits | 2 | — |
storage.imageTransform | Storage · Image transformations | 2 | — |
storage.s3 | Storage · S3 connection | 1 | — |
storage.policies | Storage · Policies | 1 | — |
push.fcm | Push · Firebase | 4 | yes |
push.apns | Push · APNs | 6 | yes |
backup.schedule | Backups · Schedule | 4 | — |
data.retention | Data · Operational log retention | 8 | — |
logs.retention | Logs · History and retention | 3 | — |
realtime.retention | Realtime · Retention | 3 | — |
realtime.limits | Realtime · Limits | 3 | — |
database.sqlEditor | Database · SQL editor | 1 | — |
api.rest | API · REST | 2 | — |
api.keys | API · Keys | 1 | — |
ai.assistant | AI assistant | 7 | yes |
git.github | Git · GitHub | 3 | yes |
Every group
Security · CORS
Group key: server.cors
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
origins — Allowed origins | text | "" | — | — |
credentials — Allow credentials (cookies / auth headers) | bool | true | — | — |
Security · Rate limits
Group key: security.rateLimit
Max requests per client, per scope, within the rate-limit window. Changes apply live.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
windowMin — Window (minutes) | number | 15 | — | The period every limit below is counted over. Changing it restarts the current window, so in-flight counters reset to zero. |
global — Global (req / window / client) | number | 1000 | — | — |
auth — Auth endpoints | number | 20 | — | Every /api/auth call together. The per-kind limits (emails, SMS, sign-ins…) are auth.rateLimits. |
restRead — REST read (GET) | number | 300 | — | — |
restWrite — REST write (POST/PATCH/DELETE) | number | 120 | — | — |
edge — Edge function invokes | number | 60 | — | — |
All six apply live. The window used to be the exception — express-rate-limit reads
windowMs once at construction — so the limiters are rebuilt when it changes. Saving the
group without changing the window does not rebuild, so a no-op save cannot hand every
throttled caller a fresh allowance.
Security · Rate-limit rules
Group key: security.rateLimitRules
Custom rules on top of the built-in scopes. Every matching rule applies and the most restrictive wins; rules can only tighten limits. Changes apply live.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
rules — Rules (JSON array) | json | — | — | Match by method / path glob / role; bucket by ip, user, apiKey, role or global. |
Auth · Token expiry
Group key: auth.tokens
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
accessTokenExpMin — Access token lifetime (minutes) | number | 15 | — | — |
refreshTokenExpDays — Session lifetime (days) | number | 30 | — | — |
Auth · Methods
Group key: auth.methods
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
emailPassword — Email + password | bool | true | — | — |
magicLink — Magic link | bool | true | — | — |
emailOTP — Email OTP | bool | true | — | — |
anonymous — Anonymous sign-ins | bool | false | — | signInAnonymously() creates a guest user with is_anonymous = true, upgraded in place when it links an email or a provider. |
Auth · Sign-up & passwords
Group key: auth.signup
Registration and password policy. Applies to new sign-ups and sign-ins after saving.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
allowNewUsers — Allow new sign-ups | bool | true | — | Turn off to close registration. Existing users can still sign in. |
requireEmailVerification — Require email verification | bool | false | — | Block sign-in until the email address is verified. |
autoSignInAfterVerify — Auto sign-in after sign-up | bool | true | — | — |
minPasswordLength — Minimum password length | number | 8 | — | — |
maxPasswordLength — Maximum password length | number | 128 | — | — |
Auth · Sessions
Group key: auth.sessions
Session refresh, freshness, and revocation. Overall session length is set in Token expiry.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
revokeOnPasswordReset — Revoke all sessions on password reset | bool | true | — | Sign every other device out when a user resets their password. |
disableRefresh — Disable sliding refresh | bool | false | — | When on, sessions expire at a fixed time instead of extending on use. |
updateAgeHours — Refresh cadence (hours) | number | 24 | — | How often an active session is extended. Ignored when sliding refresh is disabled. |
freshAgeMinutes — Fresh window (minutes) | number | 0 | — | How long after sign-in a session counts as "fresh" for sensitive actions. 0 disables the freshness requirement. |
Auth · Social providers
Group key: auth.social
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
providers — Providers (JSON) | json | — | yes | — |
Auth · Custom OIDC
Group key: auth.oauth.custom
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
providers — Custom OIDC providers (JSON array) | json | — | yes | — |
Auth · Two-factor
Group key: auth.twoFactor
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | false | — | — |
issuer — Issuer (shown in authenticator apps) | text | — | — | — |
totpDigits — TOTP digits (6 or 8) | number | 6 | — | — |
totpPeriod — TOTP period (seconds) | number | 30 | — | — |
otpChannel — OTP second factor channel | select | off | — | One of off, email, sms. |
otpDigits — OTP digits | number | 6 | — | — |
otpPeriodMinutes — OTP validity (minutes) | number | 3 | — | — |
backupCodeCount — Backup codes count | number | 10 | — | — |
backupCodeLength — Backup code length | number | 10 | — | — |
trustDeviceDays — Trust device for (days) | number | 30 | — | — |
Auth · Passkey
Group key: auth.passkey
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | false | — | — |
rpId — Relying-party ID (domain) | text | — | — | — |
rpName — Relying-party name | text | — | — | — |
origin — Origin | text | — | — | — |
Auth · Phone (SMS)
Group key: auth.phoneOtp
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enable phone sign-in | bool | false | — | — |
otpLength — OTP length | number | 6 | — | — |
expiresIn — OTP expiry (seconds) | number | 300 | — | — |
signUpOnVerification — Create account on first verified number | bool | true | — | — |
Auth · Sign-up gate
Group key: auth.hooks.signUp
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | false | — | — |
emailDomainMode — Email domain rule | select | off | — | One of off, allow, block. |
emailDomains — Email domains (comma separated) | text | — | — | — |
webhookUrl — Verdict webhook URL | text | — | — | — |
webhookSecret — Webhook signing secret | password | — | yes | — |
Auth · Access token claims
Group key: auth.hooks.accessToken
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | false | — | — |
includeUserFields — User fields to include (comma separated) | text | — | — | — |
staticClaims — Static claims (JSON) | json | — | — | — |
Auth · Delivery override
Group key: auth.hooks.send
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | false | — | — |
email — Override email delivery | bool | false | — | — |
sms — Override SMS delivery | bool | false | — | — |
webhookUrl — Delivery webhook URL | text | — | — | — |
webhookSecret — Webhook signing secret | password | — | yes | — |
Auth · Event webhook
Group key: auth.hooks.events
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | false | — | — |
events — Events (comma separated path fragments) | text | — | — | — |
webhookUrl — Event webhook URL | text | — | — | — |
webhookSecret — Webhook signing secret | password | — | yes | — |
Auth · URL configuration
Group key: auth.urls
The Site URL and the redirect URLs auth flows may send users back to. Wildcards: * (within a segment), ** (anything), ? (one character).
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
siteUrl — Site URL | text | — | — | The default redirect when none is given or the one given is not allowed. |
redirectUrls — Redirect URLs (comma separated) | text | — | — | — |
Auth · Rate limits
Group key: auth.rateLimits
Per-kind auth limits with GoTrue's windows. Counted per IP, except email and SMS, which are per project.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
emailSentPerHour — Emails sent per hour | number | 30 | — | Every auth email (sign-up confirmation, magic link, OTP, recovery), across the whole project. |
smsSentPerHour — SMS sent per hour | number | 30 | — | Every auth text message, across the whole project. |
tokenRefreshPer5Min — Token refreshes per 5 minutes | number | 150 | — | Access tokens minted (/token) per IP. |
verifyPer5Min — Verifications per 5 minutes | number | 30 | — | OTP, magic-link, email, MFA and PKCE verifications per IP. |
signInSignUpPer5Min — Sign-ups and sign-ins per 5 minutes | number | 30 | — | Per IP, all methods together. |
anonymousPerHour — Anonymous sign-ins per hour | number | 30 | — | Per IP. |
Auth · Third-party auth
Group key: auth.thirdParty
JWTs from Clerk, Firebase Auth, Auth0, AWS Cognito or WorkOS, accepted by the data API. The role claim picks the Postgres role (anon, else authenticated; service_role is refused).
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
providers — Providers (JSON array) | json | — | — | — |
Auth · Attack protection
Group key: auth.attackProtection
CAPTCHA on the auth endpoints and on any other route you choose, and a leaked-password check.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
captchaEnabled — Enable CAPTCHA protection | bool | false | — | Clients must then send a token on every guarded call: options.captchaToken on auth calls, the x-captcha-response header elsewhere. |
captchaProvider — CAPTCHA provider | select | hcaptcha | — | One of hcaptcha, turnstile. |
captchaSecret — CAPTCHA secret | password | — | yes | — |
captchaSiteKey — Site key (hCaptcha, optional) | text | — | — | When set, hCaptcha also checks the token was issued for this site key. |
captchaAuthEndpoints — Guarded auth endpoints | json | ["/sign-up/email","/sign-in/email","/sign-in/anonymous","/sign-in/magic-link","/email-otp/send-verification-otp","/email-otp/request-password-reset","/phone-number/send-otp","/request-password-reset"] | — | Which auth calls need a token. Any of /sign-up/email, /sign-in/email, /sign-in/anonymous, /sign-in/magic-link, /email-otp/send-verification-otp, /email-otp/request-password-reset, /phone-number/send-otp, /request-password-reset. All of them by default, as in Supabase. |
captchaRoutes — Other guarded routes | json | [] | — | Any other route: a table's REST API (/rest/v1/<table>), an edge function (/api/edge/<name>), storage. * matches any run of characters. No methods means every method. Server-side callers must send a token too. |
leakedPasswordProtection — Prevent use of leaked passwords | bool | false | — | Rejects passwords found in HaveIBeenPwned. Only the first 5 characters of the SHA-1 hash are sent. |
Auth · User API keys
Group key: auth.apiKey
Personal API keys each user mints through the auth API. Not the project keys (api.keys).
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | false | — | — |
Auth · SSO (OIDC / SAML)
Group key: auth.sso
The single switch for OIDC / SAML SSO, including per-organization SSO. When on, it mounts the SSO plugin and its /api/auth/sso/* endpoints. When off, no provider can be registered or used. The provider a user reaches is tenant data in ssoProvider records, not an organization setting here.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | false | — | Required for all SSO, including per-organization SSO. Auth · Organizations has no SSO switch of its own. |
Auth · Organizations
Group key: auth.organization
End-user organizations (Better Auth organization plugin): creation, teams, and member limits. SSO is not configured here. Enable it in Auth · SSO, the only switch that governs SSO.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | true | — | — |
allowUserToCreateOrganization — Users can create orgs | bool | true | — | — |
teamsEnabled — Teams inside organizations | bool | false | — | Adds Better Auth team sub-groups and their endpoints. This is unrelated to SSO; org admins register identity providers at runtime. |
maxMembers — Maximum members per organization | number | 0 | — | 0 = unlimited. Applies when a member is added directly, when an invitation is accepted, and when SSO auto-provisions a member. |
Email · SMTP
Group key: email.smtp
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
host — SMTP host | text | — | — | Required. |
port — Port | number | 465 | — | Required. |
username — Username | text | — | — | Required. |
password — Password | password | — | yes | — |
from — From address | text | — | — | — |
secure — Secure (TLS) | bool | true | — | — |
Phone / SMS
Group key: phone.sms
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | false | — | — |
provider — Provider | text | — | — | — |
accountSid — Account SID | text | — | — | — |
authToken — Auth token | password | — | yes | — |
from — From number | text | — | — | — |
messagingServiceSid — Messaging Service SID (optional) | text | — | — | — |
testNumbers — Test numbers (bypass real SMS) | text | — | — | Comma-separated phone:code pairs. Matching numbers skip Twilio and accept the fixed code, for app-store review and e2e tests. |
Email templates
Group key: email.templates
Customise transactional auth emails. Code templates use {{code}}; link templates use {{url}} (rendered as a button/link). {{appName}} and {{email}} are always available.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
verificationSubject — Email OTP · verification subject | text | Verify your email | — | — |
verificationBody — Email OTP · verification body | text | — | — | Requires {{code}}. Allowed: {{appName}}, {{code}}, {{email}} |
recoverySubject — Password reset subject | text | Reset your password | — | — |
recoveryBody — Password reset body | text | — | — | Requires {{code}}. Allowed: {{appName}}, {{code}}, {{email}} |
magicLinkSubject — Magic-link subject | text | Your sign-in link | — | — |
magicLinkBody — Magic-link body | text | — | — | Requires {{url}}. Allowed: {{appName}}, {{url}}, {{email}} |
verifyLinkSubject — Verification-link subject | text | Verify your email | — | — |
verifyLinkBody — Verification-link body | text | — | — | Requires {{url}}. Allowed: {{appName}}, {{url}}, {{email}} |
Storage provider
Group key: storage.provider
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
driver — Driver | select | local | — | One of local, s3. |
staticPath — Local static path | text | uploads | — | — |
userPath — Local user path | text | users | — | — |
s3Endpoint — S3 endpoint | text | — | — | — |
s3Region — S3 region | text | us-east-1 | — | — |
s3AccessKeyId — S3 access key ID | text | — | — | — |
s3SecretAccessKey — S3 secret access key | password | — | yes | — |
s3Bucket — S3 bucket | text | uploads | — | — |
s3PublicUrl — S3 public URL | text | — | — | — |
Storage · Limits
Group key: storage.limits
Upload size and type constraints. Max size is also capped by the server MAX_UPLOAD_MB.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
maxUploadBytes — Max upload size (bytes) | number | 0 | — | 0 uses the server default (MAX_UPLOAD_MB). A positive value is additionally capped to it. |
allowedMimeTypes — Allowed MIME types | text | — | — | Comma-separated. Blank allows all. Wildcards like image/* are supported. |
Storage · Image transformations
Group key: storage.imageTransform
Resize and convert images on the fly through /storage/v1/render/image.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enable image transformations | bool | true | — | When off, every render URL answers 403 and the original object is still downloadable as usual. |
maxSourceBytes — Largest source image (bytes) | number | 26214400 | — | Images above this size are refused rather than decoded. 25 MB, like Supabase, by default. |
Storage · S3 connection
Group key: storage.s3
An S3-compatible endpoint at /storage/v1/s3, authenticated with S3 access keys.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enable the S3 protocol | bool | true | — | When off, every S3 request is refused. Access keys are kept and work again once it is back on. |
Storage · Policies
Group key: storage.policies
Authorize storage with PostgreSQL row level security instead of the built-in owner rule.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Use RLS policies for storage | bool | false | — | When on, every read and write is decided by the policies on storage.files, the same way table access is. The migration installs policies reproducing the built-in behaviour, so turning this on changes nothing until you write your own. When off, the built-in rule applies: an object is readable if it is public or if you own it. |
Off by default because turning it on changes who can read every object in the project, and an upgrade does not get to do that silently. The migration installs policies reproducing the built-in behaviour, so switching over changes nothing until you write your own.
Push · Firebase
Group key: push.fcm
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | false | — | — |
projectId — Project ID | text | — | — | — |
clientEmail — Client email | text | — | — | — |
privateKey — Private key | password | — | yes | — |
Push · APNs
Group key: push.apns
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | false | — | — |
key — APNs key | password | — | yes | — |
keyId — Key ID | text | — | — | — |
teamId — Team ID | text | — | — | — |
bundleId — Bundle ID | text | — | — | — |
production — Production | bool | false | — | — |
Backups · Schedule
Group key: backup.schedule
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | false | — | — |
cron — Cron expression | text | 0 3 * * * | — | — |
retention — Retention (keep newest N) | number | 7 | — | — |
offsite — Offsite upload to S3 | bool | false | — | — |
Data · Operational log retention
Group key: data.retention
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | true | — | — |
cron — Cron expression | text | 15 4 * * * | — | — |
webhookDeliveryDays — Webhook delivery retention (days) | number | 30 | — | — |
edgeFunctionLogDays — Edge function log retention (days) | number | 30 | — | — |
jobRunDays — Scheduler run history (days) | number | 30 | — | Rows in platform.job_runs older than this are deleted. Every scheduled job writes one per run, so this is the fastest-growing operational table. |
authAuditLogDays — Auth audit log retention (days) | number | 90 | — | Rows in auth.audit_log_entries (Authentication → Audit Logs) older than this are deleted. |
batchSize — Rows per batch | number | 500 | — | — |
maxBatchesPerRun — Maximum batches per run | number | 20 | — | — |
Logs · History and retention
Group key: logs.retention
Keep log lines in the database so the Logs screen can look further back than the in-memory buffer and survive a restart. Retention is applied by the data-retention job.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Store logs in the database | bool | true | — | Off keeps the in-memory buffer only: history is capped by CONSOLE_LOG_BUFFER_SIZE and lost on restart. |
retentionDays — Keep logs for (days) | number | 7 | — | Lines older than this are deleted on the next data-retention run. |
maxRows — Maximum stored lines | number | 2000000 | — | Hard ceiling regardless of age; the oldest lines above it are deleted. 0 disables the cap. |
Realtime · Retention
Group key: realtime.retention
Prune processed realtime outbox rows. Only completed/failed (terminal) rows are removed; pending and processing rows are never touched.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | true | — | — |
completedDays — Keep delivered events (days) | number | 7 | — | Completed realtime events, and messages sent with realtime.send, older than this are purged. |
failedDays — Keep failed events (days) | number | 30 | — | Failed realtime events are kept longer for debugging. |
Realtime · Limits
Group key: realtime.limits
Constraints applied when a client subscribes to a realtime topic.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enablePostgresChanges — Enable postgres_changes | bool | true | — | When off, database-change subscriptions are ignored. Broadcast and presence still work. |
maxChannelsPerClient — Max channels per client | number | 100 | — | Reject further channel subscriptions from a single connection past this count. |
privateOnly — Private channels only | bool | false | — | Refuse public channels. Every channel must be joined with private: true and is authorized by the policies on realtime.messages. |
Database · SQL editor
Group key: database.sqlEditor
What the Studio SQL editor may run. Changes apply to the next query.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
allowWrites — Allow writes from the SQL editor | bool | true | — | On, the editor runs anything, as the database owner. Off, every statement runs in a Postgres READ ONLY transaction and INSERT, UPDATE, DELETE and DDL are refused. |
API · REST
Group key: api.rest
Limits for the auto-generated REST API. Changes apply on the next request.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
maxRows — Max rows per request | number | 1000 | — | Upper bound on rows a single GET returns. The parser also enforces a hard ceiling of 1000. |
rpcSecurityDefiner — Exposed SECURITY DEFINER functions | text | "" | — | Comma-separated function names reachable over /rest/v1/rpc/. A SECURITY DEFINER function runs as its owner and bypasses the caller's row-level security, so each one must be listed here explicitly. Empty means none are exposed. |
Function names are stored verbatim: they are matched against pg_proc.proname, and a quoted
CREATE FUNCTION "MyFn" really is stored as MyFn, so case is not folded. Entries longer
than Postgres' 63-byte identifier limit, or carrying control characters, are rejected on save.
API · Keys
Group key: api.keys
Whether a project API key is required to reach the REST API.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
requireApiKey — Require a project API key | bool | false | — | When on, every REST request must carry a valid publishable or secret key in the apikey header. Off by default so an app running against an older version keeps working across an upgrade. Turn it on once your clients send the key: revoking a key then cuts that caller off without touching a single policy. |
Off by default so an app running against an older version keeps working across an upgrade.
Turn it on once your clients send the key: revoking a key then cuts that caller off without
touching a single policy. The keys themselves are not settings — they live in their own table
and are managed from Project Settings → API keys or motherbase keys.
AI assistant
Group key: ai.assistant
Bring your own model key. The assistant runs server side and can only do what your account can do.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
enabled — Enabled | bool | false | — | — |
provider — Provider | select | anthropic | — | One of anthropic, openai, gemini, deepseek, qwen, glm, moonshot, mistral, xai, groq, openrouter, compatible. |
model — Model | text | — | — | Any model id the provider accepts. Leave blank to use the provider default. |
apiKey — API key | password | — | yes | — |
baseUrl — Base URL | text | — | — | Leave blank to use the provider's own endpoint. Required for a custom OpenAI-compatible server (Ollama, vLLM, LiteLLM). |
maxSteps — Maximum tool steps per message | number | 12 | — | — |
autoApproveWrites — Run write actions without confirmation | bool | false | — | Off by default. When off, the assistant proposes changes and you press Run. |
Git · GitHub
Group key: git.github
A GitHub OAuth App (Settings → Developer settings → OAuth Apps). Its Authorization callback URL must be exactly the callback URL below.
| Field | Type | Default | Secret | Notes |
|---|---|---|---|---|
clientId — Client ID | text | — | — | — |
clientSecret — Client secret | password | — | yes | — |
callbackUrl — Authorization callback URL | text | — | — | The Studio page GitHub returns the browser to. Its origin is also where the push webhook is delivered. |
Where to read more
- Storage policies: Storage
- API keys, and the table they live in rather than these settings: API Keys
- The GitHub OAuth App behind
git.github: Git migrations - Rate limits, including the custom-rule engine: Security model
- The assistant's own model key: AI assistant