These settings live in Settings → System → Access and apply without a restart. Setting a variable locks the value and shows it as read-only in Studio. Durations use Go syntax, such as 30m or 8h.
Passwords
| Variable | Default | What it does |
|---|
PASSWORD_MIN_LENGTH | 12 | Shortest allowed password, 8 to 72 bytes. |
PASSWORD_REQUIRE_CLASSES | false | true requires an upper-case letter, a lower-case letter and a digit. |
Sessions
| Variable | Default | What it does |
|---|
SESSION_LIFETIME | 8h | How long a sign-in lasts, 15m to 720h. Applies to new sessions. |
SESSION_IDLE_TIMEOUT | 0s (off) | Signs out a session after this much inactivity, 5m to 720h, and no longer than SESSION_LIFETIME. |
Login lockout
| Variable | Default | What it does |
|---|
LOGIN_MAX_ATTEMPTS | 5 | Failed logins allowed per account and client in one window, 1 to 100. |
LOGIN_LOCKOUT | 1m | Length of that window, 10s to 24h. The count resets after it. |
Tokens
| Variable | Default | What it does |
|---|
TOKEN_DEFAULT_LIFETIME | 2160h (90 days) | Lifetime when a token request does not set expires_in_days. |
TOKEN_MAX_LIFETIME | 8760h (1 year) | Longest any personal token may live. |
Invites
| Variable | Default | What it does |
|---|
OWNER_INVITES_ENABLED | true | false stops the owner from creating accounts for other people. |
Next steps
