Skip to main content
Configuration is split by purpose. Use this page to find the relevant part of the complete configuration reference.

Hosts, routes, and secrets

Configure API, console, WebSocket, database, Redis, and internal secret values.

Authentication and sessions

Configure OIDC, password authentication, browser sessions, and signup policy.

Models and runtime limits

Configure providers, models, budgets, reasoning summaries, and gateway readiness.

Approvals and retention

Configure write confirmation, Workflow duration, report retention, and auditing.

MCP endpoints and egress

Constrain remote MCP destinations and configure access to approved endpoints.

Webhooks

Configure durable delivery, retry limits, payload bounds, and private destinations.

​
Configuration ownership

Keep these scopes distinct:
  • Deployment configuration sets the maximum available policy and infrastructure behavior.
  • Workspace configuration selects from deployment-supported roles, providers, integrations, and capabilities.
  • Target configuration controls one cluster or VM and its connector policy.
  • Run scope contains the exact resources and tools authorized for one execution.
Settings at a narrower scope cannot exceed a broader policy ceiling.

​
Change discipline

Treat platform configuration as code, but keep secret values in the deployment’s secret mechanism. Render and review Kubernetes changes before applying them. For Compose, review the full environment and image matrix together. Validate auth, target connectivity, model readiness, and a read-only run after changes.