Settings

How instance configuration works — the settings registry, environment overrides, and what each settings category controls.

#Settings

The Settings area (sidebar, bottom) is your instance's configuration surface. Every setting lives in one central registry, so the UI, the API, and validation all agree on what exists and what values are legal.

#How a setting resolves

A setting's effective value comes from the first match in this order:

  1. Environment / secret override — set with wrangler secret put or in wrangler.toml vars. Wins over everything and shows as read-only in the UI
  2. Database value — what you saved through the Settings UI
  3. Built-in default

This split matters operationally: put secrets and per-deployment identity (OAuth client secrets, tokens, URLs) in the environment, and keep product behaviour (branding, cache TTLs, signup mode) in the UI where admins can change it without a deploy.

Values are cached at the edge and invalidated when you save, so changes apply within moments — no redeploy needed for UI-managed settings.

#What's configurable

Category Controls
General / Branding Instance name, logo, brand icon, palette — Outback (the default), Edge, or seed colours to derive one from
Email From-address and delivery for invites and password resets
Authentication / Sign-in Signup mode, username login, two-factor, session behaviour
Security & Access CORS, trusted origins, cookie policy, rate limits
OAuth Providers Google, GitHub, and other social sign-in credentials
Collections Defaults that apply across your data APIs
Map Basemaps and geo display defaults
Analytics Usage reporting configuration
AI Guide Models used by the in-app assistant and debug tools
Edge Cache Public read caching at Cloudflare's edge — toggles and TTLs
System Page cache, dashboard mode, and the update channel
Tip

If a field is greyed out, an environment variable is overriding it. The UI tells you which one — remove or change the variable and redeploy to hand control back to the UI.

#Sensitive values

Secrets (tokens, client secrets, SMTP passwords) are write-only: the UI shows whether one is set, never the value. Rotate them by writing a new value.

#What you learned

  • One registry defines every setting; env overrides beat DB values, which beat defaults
  • Secrets belong in the environment; product behaviour belongs in the UI
  • UI changes apply without a redeploy; greyed-out fields are env-controlled