Settings are edited in the console under Settings or onApplicationConfig, and apply at the next restart. A flag that is off means the capability's endpoint is not served at all.
Which OAuth and OpenID flows this server issues tokens through.
Allow omitting a single registered redirect_uri
Let a client with one registered redirect_uri omit it from requests
falseWhen a client has exactly one registered redirect_uri, allow authorization and token requests to omit redirect_uri and resolve it to that single value. Off by default (secure).
Enable client_credentials grant
Accept grant_type=client_credentials at the token endpoint
falseEnables grant_type=client_credentials on the token endpoint.
Enable Device Authorization Grant (RFC 8628)
Serve the device authorization grant for input-constrained devices
falseEnables the Device Authorization Grant.
User-code charset
Which characters generated user codes are drawn from
"base-20"deviceFlow.enabledCharacter set for generated user codes. "digits" suits a device paired from a numeric keypad or a TV remote; "base-20" packs more entropy into the same number of characters.
User-code mask
The shape of a generated user code
"****-****"deviceFlow.enabledTemplate for user codes; * is replaced by a random charset char. Every * is one character of entropy, so shortening the template to spare the person typing it also shortens what an attacker has to guess.
Enable CIBA flow
Serve the client-initiated backchannel authentication flow
falseEnables Core CIBA flow.
Token delivery modes
How a client collects a CIBA token once the user approves
["poll"]ciba.enabledSupported CIBA token delivery modes.
Conform ID Token claims
Carry end-user claims in an ID Token only where the spec requires
trueWhen on, an ID Token carries End-User claims only where the requested response_type is id_token. Turning it off includes scope-derived claims in ID Tokens issued from other response types. On by default (spec-conformant).
How an authorization request is proven, bound and protected.
Enable PAR (RFC 9126)
Serve the pushed_authorization_request endpoint
falseEnables the pushed_authorization_request endpoint.
Allow unregistered redirect_uris via PAR
Let authenticated PAR clients use redirect_uris they never registered
falsepar.enabledLets authenticated PAR clients use unregistered redirect_uri values (no sector_identifier_uri).
Enable DPoP (RFC 9449)
Sender-constrain tokens with application-layer proof-of-possession
falseSender-constrains tokens via application-layer proof-of-possession.
Require DPoP nonce
Require a server-issued nonce in every DPoP proof
falsedpop.enabledRequires a server-provided DPoP nonce. The secret the nonces are derived from is managed by the server; there is nothing to supply.
Enable JARM
Return authorization responses as a signed JWT (JARM)
falseEnables JWT Secured Authorization Responses.
Enable FAPI behaviours
Apply the extra Authorization Server behaviours of the FAPI profile
falseExtra Authorization Server behaviours defined in the FAPI profile.
Enable encryption features
Allow encrypted UserInfo, ID Tokens and Request Objects
falseEncrypted UserInfo/ID Tokens and signed/encrypted Request Objects.
Enable the claims parameter
Accept and validate the claims request parameter
falseEnables use and validation of the claims parameter.
Enable mTLS features (RFC 8705)
Authenticate clients by TLS certificate
falseEnables Mutual TLS client authentication / certificate-bound tokens.
Certificate-bound access tokens
Bind issued access tokens to the client certificate
falsemTLS.enabledRequires mTLS enabled.
self_signed_tls_client_auth method
Accept the self_signed_tls_client_auth method
falsemTLS.enabledRequires mTLS enabled.
tls_client_auth method
Accept the tls_client_auth method
falsemTLS.enabledRequires mTLS enabled.
Enable Request Objects (JAR)
Accept authorization parameters inside a signed request object
falseEnables the request (Request Object) parameter.
Require signed request objects
Refuse authorization requests that are not signed request objects
falserequestObjects.enabledRequires signed request objects for all authorization requests.
Enable Resource Indicators (RFC 8707)
Let a client name the resource server a token is meant for
trueEnables Resource Indicators features.
Enable RAR (RFC 9396)
Accept fine-grained authorization_details on a request
falseEnables the authorization_details parameter, per RFC 9396 (published May 2023). Requires at least one authorization details type below, and requires Resource Indicators — details are only assigned to an access token bound to a resource server.
Authorization details types
The authorization details types this server accepts
{}richAuthorizationRequests.enabledThe authorization details types this server accepts, as a map of type identifier to a descriptor: {"https://scheme.example/payment":{"label":"Initiate a payment","fields":{"actions":{"required":true,"allowed":["initiate"]}},"allowUnknownFields":false}}. `label` is what the consent screen shows. Constraints may only name the RFC 9396 §2 common fields (actions, locations, datatypes, privileges, identifier); `identifier` is single-valued so it takes `required` only. Unknown fields are refused unless a type opts in.
Which protocol endpoints are served, and what discovery advertises.
Enable Token Introspection (RFC 7662)
Serve token introspection for opaque access and refresh tokens
falseEnables introspection for opaque access tokens and refresh tokens.
JWT introspection responses (RFC 9701)
Return introspection results as a signed JWT
falseintrospection.enabledJWT responses for introspection. Requires Introspection enabled.
Enable Back-Channel Logout
Notify clients of sign-out over a back channel
falseEnables OIDC Back-Channel Logout features.
Enable the UserInfo endpoint
Serve the UserInfo endpoint
trueEnables the UserInfo endpoint.
JWT UserInfo responses
Return UserInfo as a signed JWT
falseuserinfo.enabledJWT responses for UserInfo. Requires UserInfo enabled.
Enable Token Revocation (RFC 7009)
Serve the token revocation endpoint
falseEnables Token Revocation.
Enable RP-Initiated Logout
Let a client start sign-out and return the user to itself
trueEnables OIDC RP-Initiated Logout.
Enable Dynamic Client Registration
Let a client register itself at runtime
falseEnables Dynamic Client Registration.
Issue registration access token
Issue a registration access token to a new client
trueregistration.enabledWhether a registration access token is issued.
Enable registration management (RFC 7592)
Let a registered client update or delete itself
falseEnables update/delete for dynamically registered clients.
Rotate registration access token
Issue a fresh registration access token on each update
trueregistrationManagement.enabledEnables registration access token rotation.
Supported scopes
Scopes advertised in discovery
["openid","offline_access"]Scopes advertised in discovery. Must include openid.
Supported acr values
ACR values this server claims to support
[]ACR values the server supports (acr_values_supported).
Client authentication methods
Client authentication methods advertised in discovery
["client_secret_basic","client_secret_jwt","client_secret_post","private_key_jwt","none"]token_endpoint_auth_methods_supported (mTLS methods added when enabled).
End-user sign-in, and the limits that keep it from being abused.
Enable cross-origin access for browser clients
Let browser apps read responses from this server
trueLets browser-based apps read responses from the metadata and key endpoints, and from the endpoints listed on a project’s browser origins. Closure normally comes from data — a project with no origins grants nothing — so this is an incident kill switch rather than the usual control.
Refuse a calling origin that exceeds its request allowance
Refuse a caller that exceeds its request allowance
trueRefuses requests from one origin past its allowance inside a window, before the endpoint does any work. Allowances are tiered by route class, so the token endpoint and a static asset are not held to the same number. On by default; turn it off as an incident kill switch if it starts refusing traffic it should not. Applied at startup.
Take the caller’s address from the proxy headers
Read the caller address from proxy headers
truerateLimit.enabledWhether Fly-Client-IP, the first hop of X-Forwarded-For, or X-Real-IP names the caller. This one has a wrong answer in each direction. Leave it ON when a proxy or load balancer sits in front of this server: with it off, every caller arrives as the proxy’s address, so the whole internet shares one allowance and all traffic is refused within seconds. Turn it OFF only when the server is directly exposed: with it on, any caller can set the header to a fresh value per request and is never limited. Defaults to on, matching the shipped deployment.
Origins remembered per route class
How many callers each route class tracks at once
10000rateLimit.enabledHow many distinct origins each class tracks at once, capping the limiter’s own memory. Bounded on purpose: the key comes from the caller, so an unbounded tally would itself become the memory-exhaustion vector this feature exists to prevent. Past the bound the least recently seen origin is forgotten and gets a fresh allowance. Lower it on a small machine.
Strict allowance — requests per window
Allowance for token, authorization and other costly routes
60rateLimit.enabledApplies to the unauthenticated and expensive surface: token issuance, authorization, dynamic registration, device and CIBA, and every end-user door that checks a secret or sends mail. Raise it if a legitimate server-to-server integration behind a single address, or many users behind one corporate NAT, start seeing refusals.
Strict allowance — window length in seconds
Window the strict allowance is measured over
60rateLimit.enabledThe period the strict allowance is measured over. A caller timing requests around the boundary can send close to twice the allowance across two adjacent windows; that is normal for this kind of limit and not a defect.
Ordinary allowance — requests per window
Allowance for userinfo, admin and other ordinary routes
300rateLimit.enabledApplies to everything not classified strict or public: userinfo, introspection, revocation, the administration API, the MCP surface, and the rest of the end-user screens. Any endpoint added without an explicit classification lands here, so it is sized for a mixed session rather than for one endpoint.
Ordinary allowance — window length in seconds
Window the ordinary allowance is measured over
60rateLimit.enabledThe period the ordinary allowance is measured over.
Public allowance — requests per window
Allowance for assets, discovery and the key set
1200rateLimit.enabledApplies to the cheap public surface — static assets, the discovery document, the key set — and to every cross-origin preflight. Sized to clear the administration console’s full page-and-asset load from one address. Raise it if the console stutters while loading.
Public allowance — window length in seconds
Window the public allowance is measured over
60rateLimit.enabledThe period the public allowance is measured over.
Failed password attempts allowed per window
Wrong passwords one address may try before sign-in shuts
5How many wrong passwords one address may submit before the sign-in door shuts for that address. Once shut it refuses every attempt, including one with the correct password, until the window ends — and the refusal looks exactly like an ordinary wrong password, so it tells an attacker nothing. Raising this hands a guessing attack proportionally more tries; lowering it locks out people who mistype. Matches the verification code’s attempt cap by default. Applied at startup.
First lockout length in seconds
How long sign-in shuts the first time an address runs out
900How long the door stays shut the first time an address runs out of attempts, and the length each further lockout doubles from. This is also the shortest wait an honest user who trips the throttle will face, so it is the number to lower if legitimate lockouts are the complaint. A bucket that requires a one-time code stays at this length however often it is tripped, because a guessed password there does not sign anyone in. Applied at startup.
Longest lockout length in seconds
The longest sign-in will ever shut for one address
3600The longest the door will ever shut, however many times one address has run out of attempts. With the defaults the lockouts run 15 → 30 → 60 minutes, which holds a sustained attack to roughly 120 guesses a day. Cannot be shorter than the first lockout, and cannot exceed 24 hours — beyond that the counter would be forgotten before its own lockout ended, which would reopen the door. Someone locked out this long can still get straight back in by completing a password reset. Applied at startup.
Enable sign-in through an upstream identity provider
Let a bucket offer sign-in through an upstream provider
falseLets a user bucket offer sign-in through external OpenID Providers configured on that bucket, alongside or instead of its password form. Off by default: this is the only capability that lets an outside party’s assertion produce a session here, and with it off no federation route is served and no provider button renders, whatever a bucket holds. Configuring providers stays available either way, so a provider can be prepared before switching this on and removed after switching it off. Applied at startup.
What this server records when something fails, and where it goes.
Record internal server faults
Keep a durable record of unexpected internal faults
falseKeeps a durable record of unexpected internal faults so a failure can be diagnosed after it happened rather than only while it is happening. Routine client rejections — a bad grant, a wrong password, an expired code — are correct behaviour and are never recorded, so every entry is a defect. Off by default; with it off nothing is written and the /admin/api/errors paths are not served at all.
Retention window (days)
How long a recorded fault is kept
30errorStore.enabledHow long a recorded fault is kept. The window runs from when the fault was last seen, not when it was first seen, so a fault that is still happening does not age out mid-life.
Maximum distinct faults retained
How many distinct faults are kept at once
10000errorStore.enabledHow many distinct faults are kept. At the limit the least recently seen fault is evicted — never the oldest by creation, which would discard a long-running problem in favour of one that happened once this morning.
Occurrences kept per fault
Full occurrences retained per distinct fault
10errorStore.enabledHow many full occurrences are retained for each distinct fault: the earliest, plus the most recent ones. The occurrence count stays exact however many are discarded — this bounds the detail kept, never the tally.
Pending write queue depth
How many records may await writing
500errorStore.enabledHow many records may await writing. Recording never delays a response, so faults are queued rather than written inline — which makes this also the loss bound: an abruptly killed process can lose at most this many records, and a full queue counts what it could not accept so an operator can see that recording fell behind.
Caller address detail
How much of the caller address a record keeps
"anonymized"errorStore.enabledHow much of the caller’s network address a record keeps, because an address is personal data. "omitted" stores none and says so; "anonymized" stores a value that cannot be reversed to the address but is still the same for two requests from one origin, so a single misbehaving deployment is still identifiable; "full" stores the address. Defaults to anonymized.
Report recorded faults to Sentry
Also send every recorded fault to a Sentry project
falseerrorStore.enabledSends every fault the error store records to an external Sentry project, so a failure raises an alert instead of waiting to be found here. This is an additional destination, never an alternative: the fault is recorded locally first and the outbound event is built from that record, which is why this cannot be switched on unless the error store is. Only the endpoint, the kind of failure and the reference are sent — never a request URL, header, cookie, body, or any end-user identity. Off by default; requires the ingestion credential below. Applied at startup.
Outbound services, and machine access to this console.
Enable the administrative MCP control plane
Let an AI agent administer this server over MCP
falseServes this control plane to an AI agent over MCP at /mcp, as an OAuth 2.1 protected resource of this server. An agent acts as the administrator who authorized it and gets exactly that account’s permissions: every operation runs through the same routes, the same checks and the same audit trail as the console, and each entry records both the operator and the agent. Deleting a project or a user bucket is withheld from agents entirely and stays console-only. Off by default — with it off, neither /mcp nor its metadata document is served. Applied at startup.