Settings reference

All 208 FeatherPanel admin settings in 16 categories, with type, allowed values and validation, generated from the settings controller.

Last synced from FeatherPanel 15b94e9 on 23 Oct 2026.

On this page

How settings work

Panel behaviour lives in the database, not in files. Admins change it under Admin → Settings, which needs the admin.settings.view and admin.settings.edit permissions. Each setting has a key (used by the API and CLI) and a PHP constant in ConfigInterface (used by plugins and core code).

API: GET /api/admin/settings, GET /api/admin/settings/categories, GET /api/admin/settings/category/{category}, GET /api/admin/settings/{setting} and PATCH /api/admin/settings. See the settings endpoints.
CLI: featherpanel settings opens an interactive editor; featherpanel saas listsettings, featherpanel saas getsetting <key> and featherpanel saas setsetting <key> <value> work in scripts. See the panel CLI.

Values marked sensitive (14 keys) are stored encrypted withDATABASE_ENCRYPTION_KEY and are never returned in clear text by the API; the form shows a placeholder and only sends a new value if you type one.

App

Some default settings for the application. Category id app, 32 settings.

Key	Type	Description	Values / validation
`app_name` required	text	The name of the application (shown in the sidebar and browser title)	`required\|string\|max:255`
`app_url` required	text	The URL of the application	`required\|string\|max:255`
`wings_remote_url`	text	Optional URL Wings uses for panel callbacks (SFTP auth, remote APIs). Set to a DNS-only (grey-cloud) hostname when Cloudflare Precursor Maximize Security or Under Attack Mode blocks daemon traffic to App URL. Leave empty to use App URL. Re-fetch each node config after changing.	`nullable\|string\|max:255`
`app_logo_white` required	image	The logo of the application (sidebar & UI, light mode)	`required\|string\|max:2048`
`app_logo_dark` required	image	The logo of the application (sidebar & UI, dark mode)	`required\|string\|max:2048`
`app_timezone` required	select	The timezone of the application	`required\|string\|max:255`
`app_sso_redirect_path` required	text	Path used by generated SSO login links after authentication (must start with /, e.g. /dashboard)	`required\|string\|max:255`
`app_sso_token_lifetime_minutes` required	number	Default lifetime in minutes for admin-generated SSO login tokens (1 to 1440)	`required\|integer\|min:1\|max:1440`
`app_background_image_url`	image	Default background image URL for all users (leave empty to use theme defaults)	`string\|max:2048`
`app_background_lock` required	select	Force the configured background image URL for all users (disables per-user background overrides)	`true`, `false` `required\|string\|max:255`
`app_locale_default` required	select	Default panel language for users who have not chosen one (must match an installed translation code, e.g. en, de, fr)	`required\|string\|max:16`
`app_locale_lock` required	select	Force the configured language for all users (disables per-user language selection)	`true`, `false` `required\|string\|max:255`
`app_server_spell_banner_style` required	select	How spell/egg banners appear on the server console header: off, cover (side art), strip (top bar), or hero (image behind header controls)	`off`, `cover`, `strip`, `hero` `required\|string\|max:32`
`app_server_spell_banner_background` required	select	Use the spell/egg banner as the full panel background on server pages (same layer as the dashboard theme background): off, blend (soft over current theme), or replace (spell image instead of theme background)	`off`, `blend`, `replace` `required\|string\|max:32`
`app_accent_color_default` required	select	Default accent color for the UI (purple, blue, green, red, orange, pink, teal, yellow, white, violet, cyan, lime, amber, rose, slate)	`purple`, `blue`, `green`, `red`, `orange`, `pink`, `teal`, `yellow`, `white`, `violet`, `cyan`, `lime`, `amber`, `rose`, `slate` `required\|string\|max:255`
`app_accent_color_lock` required	select	Force the configured accent color for all users (disables per-user accent selection)	`true`, `false` `required\|string\|max:255`
`app_theme_default` required	select	Default theme (light or dark)	`light`, `dark` `required\|string\|max:255`
`app_theme_lock` required	select	Force the configured theme (light/dark) for all users (disables per-user theme toggle)	`true`, `false` `required\|string\|max:255`
`app_theme_pack_default`	text	Default plugin theme pack id (default or pluginId:themeId)	`nullable\|string\|max:255`
`app_theme_pack_lock` required	select	Force the configured theme pack for all users	`true`, `false` `required\|string\|max:255`
`app_ui_pack_default`	text	Active UI pack id for layout takeovers (empty = none, or pluginId:packId)	`nullable\|string\|max:255`
`app_ui_pack_lock` required	select	Force the configured UI pack for all users	`true`, `false` `required\|string\|max:255`
`app_background_type_default` required	select	Default background type (aurora, gradient, solid, image, pattern) used when no user preference is stored	`aurora`, `gradient`, `solid`, `image`, `pattern` `required\|string\|max:255`
`app_background_type_lock` required	select	Force the configured background type for all users (disables per-user background mode selection)	`true`, `false` `required\|string\|max:255`
`app_backdrop_blur_default` required	number	Default backdrop blur in pixels (0, 4, 8, 12, 16, 24)	`required\|integer\|min:0\|max:24`
`app_backdrop_blur_lock` required	select	Force the configured backdrop blur value for all users	`true`, `false` `required\|string\|max:255`
`app_backdrop_darken_default` required	number	Default backdrop darken overlay in percent (0 to 100)	`required\|integer\|min:0\|max:100`
`app_backdrop_darken_lock` required	select	Force the configured backdrop darken value for all users	`true`, `false` `required\|string\|max:255`
`app_background_image_fit_default` required	select	Default background image fit (cover, contain, fill)	`cover`, `contain`, `fill` `required\|string\|max:255`
`app_background_image_fit_lock` required	select	Force the configured background image fit for all users	`true`, `false` `required\|string\|max:255`
`temp_files_enabled` required	select	Allow users to share server files via temp uploads (uploaded from Wings, not through the panel).	`true`, `false` `required\|string\|max:255`
`temp_files_api_token` sensitive	text	Optional temp uploads API token (tf_…). Empty = anonymous uploads (15 GB max). With token = 30 GB max.	`nullable\|string\|max:255`

Modules

Turn whole panel modules on or off. A disabled module disappears from sidebars, dashboard and search, and its API refuses requests.. Category id modules, 4 settings.

Key	Type	Description	Values / validation
`module_game_enabled` required	select	Game servers module (Wings nodes, servers, spells and realms)	`true`, `false` `required\|string\|max:255`
`module_web_enabled` required	select	Web hosting module (WebSpaces, web nodes, mail and DNS hosts)	`true`, `false` `required\|string\|max:255`
`module_vds_enabled` required	select	VDS module (virtual servers on Proxmox)	`true`, `false` `required\|string\|max:255`
`pterodactyl_importer_visibility` required	select	When the Pterodactyl importer shows up in the admin sidebar and search	`auto`, `always`, `hidden` `required\|string\|in:auto,always,hidden`

Links

Public links shown across the panel footer (support, social media, legal). Category id links, 12 settings.

Key	Type	Description	Values / validation
`app_support_url` required	text	The support URL of the application	`required\|string\|max:255`
`website_url`	text	Main website URL	`string\|max:255`
`discord_url`	text	Discord invite or community server URL	`string\|max:255`
`linkedin_url`	text	LinkedIn profile or page URL	`string\|max:255`
`telegram_url`	text	Telegram channel or group URL	`string\|max:255`
`tiktok_url`	text	TikTok profile URL	`string\|max:255`
`twitter_url`	text	Twitter/X profile URL	`string\|max:255`
`whatsapp_url`	text	WhatsApp contact or group URL	`string\|max:255`
`youtube_url`	text	YouTube channel URL	`string\|max:255`
`status_page_url`	text	Status page URL (e.g., status.example.com)	`string\|max:255`
`legal_tos` required	text	The legal TOS of the application	`required\|string\|max:255`
`legal_privacy` required	text	The legal privacy of the application	`required\|string\|max:255`

Auth Page

Customize the login and register experience, marketing panel, QR sign-in, and method layout. Category id auth_page, 20 settings.

Key	Type	Description	Values / validation
`auth_shell_tagline`	textarea	Short marketing line under the brand on the auth left panel. This is auth-only copy; it does NOT use SEO description. Leave empty for the default translated tagline.	`nullable\|string\|max:500`
`auth_aside_title`	text	Optional bold heading under the brand name on the marketing panel (e.g. “Welcome to our panel”). Leave empty to hide.	`nullable\|string\|max:120`
`auth_login_headline`	text	Override the login form title (default: Welcome back). Leave empty for the translated default.	`nullable\|string\|max:120`
`auth_login_subheadline`	text	Override the login form subtitle. Leave empty for the translated default.	`nullable\|string\|max:240`
`auth_register_headline`	text	Override the register page title. Leave empty for the translated default.	`nullable\|string\|max:120`
`auth_register_subheadline`	text	Override the register page subtitle. Leave empty for the translated default.	`nullable\|string\|max:240`
`auth_sso_headline`	text	Headline when Discord/OIDC is the primary login panel (third-party SSO portal). Leave empty for the default “Continue with SSO” style copy.	`nullable\|string\|max:120`
`auth_sso_subheadline`	text	Supporting text under the SSO portal headline. Leave empty for the translated default.	`nullable\|string\|max:240`
`auth_show_marketing_panel` required	select	Show the full-bleed left marketing column on large screens (brand, tagline, QR). When false, auth pages use a centered form column only.	`true`, `false` `required\|string\|max:16`
`auth_aside_image_url`	image	Optional hero image for the auth marketing panel (shown behind brand/QR). Leave empty for gradient atmosphere only.	`nullable\|string\|max:2048`
`auth_template` required	select	Choose the login page template: split (form plus marketing panel), centered (focused form), or spotlight (form with a compact brand panel).	`split`, `centered`, `spotlight` `required\|string\|max:32`
`auth_visual_preset` required	select	Choose the visual treatment for auth backgrounds and surfaces: aurora, glass, minimal, or contrast.	`aurora`, `glass`, `minimal`, `contrast` `required\|string\|max:32`
`auth_show_qr_login` required	select	Enable Discord-style QR code login (phone already signed in approves the desktop session).	`true`, `false` `required\|string\|max:16`
`auth_form_density` required	select	Vertical spacing on auth forms: comfortable (roomy), compact (default), or dense (minimal scroll).	`comfortable`, `compact`, `dense` `required\|string\|max:32`
`auth_secondary_layout` required	select	How alternate login methods appear: chips (compact wrap), stack (full-width rows), or collapsed (hidden behind “More ways to sign in”).	`chips`, `stack`, `collapsed` `required\|string\|max:32`
`auth_show_theme_customizer` required	select	Show the theme/appearance button on auth pages (top-right).	`true`, `false` `required\|string\|max:16`
`auth_footer_style` required	select	Auth footer under the form: full (links + powered-by), minimal (links only), or hidden.	`full`, `minimal`, `hidden` `required\|string\|max:32`
`login_default_method` required	select	Default sign-in panel on the login page (local, ldap, email_code, discord, or oidc). Falls back to the first available method if the choice is hidden or unavailable.	`local`, `ldap`, `email_code`, `discord`, `oidc` `required\|string\|max:64`
`login_methods_order` required	text	Comma-separated order of login methods on the page. Valid ids: local, passkey, ldap, email_code, discord, oidc	`required\|string\|max:255`
`login_hidden_methods`	text	Comma-separated login method ids to hide on the login page (e.g. passkey, local, ldap, email_code, discord, oidc). Leave empty to show all configured methods.	`nullable\|string\|max:255`

Telemetry

Enable or disable installation reports, browser analytics, heatmaps, and session recordings to FeatherPanel.. Category id telemetry, 1 settings.

Key	Type	Description	Values / validation
`telemetry` required	select	Send daily aggregate counts to Umami: resource totals, backup outcomes, scheduling, databases, shared access, API keys, SSH keys, mounts, tickets, mailboxes, and feature usage over the last 30 days. No installation identifiers or individual activity records are sent. Browser tracking, recordings, and external error reporting remain disabled. The collector receives the server connection IP. Disable to stop reports.	`true`, `false` `required\|string\|in:true,false`

Security

Security and authentication settings. Category id security, 46 settings.

Key	Type	Description	Values / validation
`email_login_enabled` required	select	Enable passwordless email login with 6-digit OTP codes sent to user email addresses (requires SMTP to be configured)	`true`, `false` `required\|string\|max:255`
`captcha_provider` required	select	Captcha service provider (Turnstile, hCaptcha, Google reCAPTCHA, Friendly Captcha, or reForge Captcha)	`turnstile`, `hcaptcha`, `recaptcha`, `friendlycaptcha`, `reforge` `required\|string\|max:255`
`turnstile_enabled` required	select	The Turnstile enabled of the application	`true`, `false` `required\|string\|max:255`
`turnstile_key_pub`	text	The Turnstile key pub of the application	`string\|max:255`
`turnstile_key_priv` sensitive	password	The Turnstile private key of the application	`string\|max:255`
`hcaptcha_site_key`	text	The hCaptcha site key of the application	`string\|max:255`
`hcaptcha_secret_key` sensitive	password	The hCaptcha secret key of the application	`string\|max:255`
`recaptcha_site_key`	text	The reCAPTCHA site key of the application	`string\|max:255`
`recaptcha_secret_key` sensitive	password	The reCAPTCHA secret key of the application	`string\|max:255`
`recaptcha_version` required	select	Use reCAPTCHA v2 (checkbox) or v3 (invisible score). Keys must match the version in Google Admin.	`v2`, `v3` `required\|string\|max:10`
`recaptcha_v3_min_score` required	text	Minimum v3 score (0.0 to 1.0). Higher is stricter. Ignored when version is v2.	`required\|string\|max:10`
`recaptcha_v3_action` required	text	reCAPTCHA v3 action name (must match what the frontend sends). Use letters, numbers, underscores, and slashes only.	`required\|string\|max:100`
`friendly_captcha_site_key`	text	The Friendly Captcha site key of the application	`string\|max:255`
`friendly_captcha_secret_key` sensitive	password	The Friendly Captcha secret key of the application	`string\|max:255`
`reforge_captcha_site_key`	text	reForge Captcha public site key (from dashboard → Sites)	`string\|max:255`
`reforge_captcha_secret_key` sensitive	password	reForge Captcha secret key (server-side only; never expose to the browser)	`string\|max:255`
`reforge_captcha_widget_type` required	select	reForge Captcha widget challenge type (checkbox or image)	`checkbox`, `image` `required\|string\|max:32`
`reforge_captcha_theme` required	select	reForge Captcha widget colour theme	`auto`, `dark`, `light` `required\|string\|max:16`
`reforge_captcha_size` required	select	reForge Captcha widget size	`normal`, `compact` `required\|string\|max:16`
`reforge_captcha_lang`	text	Optional reForge Captcha widget UI language (e.g. en, nl, de). Leave empty for default.	`string\|max:16`
`reforge_captcha_min_score` required	text	Minimum reForge Captcha verify score (0.0 to 1.0) when the verify API returns a score (stricter = higher)	`required\|string\|max:10`
`registration_enabled` required	select	Can users register themselves?	`true`, `false` `required\|string\|max:255`
`registration_require_email_verification` required	select	Require users to verify their email before they can log in after registration.	`true`, `false` `required\|string\|max:255`
`registration_device_limit_enabled` required	select	Block new registrations when a browser/device already has the maximum number of panel accounts.	`true`, `false` `required\|string\|max:255`
`registration_device_max_accounts` required	number	Maximum number of accounts allowed per browser/device before registration is blocked (main account is the oldest account seen on that device).	`required\|integer\|min:1\|max:10`
`email_domain_blocking_enabled` required	select	When enabled, registration and email changes are rejected if the address domain matches a row in Admin → Blocked email domains (suffix match). Manage the list on that page.	`true`, `false` `required\|string\|max:255`
`abuseipdb_enabled` required	select	Enable AbuseIPDB integration for registration checks, user IP scanning, and optional reporting when banning users. Get an API key at https://www.abuseipdb.com/.	`true`, `false` `required\|string\|max:255`
`abuseipdb_api_key` sensitive	password	AbuseIPDB API key (stored encrypted). Required when AbuseIPDB is enabled.	`string\|max:255`
`abuseipdb_check_on_register` required	select	Check a registering user\	`true`, `false` `required\|string\|max:255`
`abuseipdb_min_confidence_score` required	number	Minimum AbuseIPDB abuse confidence score (0-100) to treat an IP as reported. AbuseIPDB recommends 75-100 for blocking.	`required\|integer\|min:0\|max:100`
`abuseipdb_max_age_days` required	number	Only consider AbuseIPDB reports from the last N days when checking an IP (1-365).	`required\|integer\|min:1\|max:365`
`abuseipdb_register_action` required	select	What to do when a registering IP meets the confidence score threshold.	`block`, `log`, `auto_ban` `required\|string\|max:32`
`require_two_fa_admins` required	select	Require two-factor authentication for admins	`true`, `false` `required\|string\|max:255`
`avatar_provider` required	select	Default avatar provider for users without a custom profile picture	`gravatar`, `panel_logo`, `ui_avatars`, `robohash`, `dicebear`, `custom` `required\|string\|max:255`
`avatar_custom_url`	text	Custom avatar URL template (only used when avatar provider is custom). Placeholders: {email}, {username}, {name}, {hash}, {app_url}	`nullable\|string\|max:2048`
`user_allow_avatar_change` required	select	Allow users to change their avatar	`true`, `false` `required\|string\|max:255`
`user_allow_username_change` required	select	Allow users to change their username	`true`, `false` `required\|string\|max:255`
`user_allow_email_change` required	select	Allow users to change their email address	`true`, `false` `required\|string\|max:255`
`user_allow_first_name_change` required	select	Allow users to change their first name	`true`, `false` `required\|string\|max:255`
`user_allow_last_name_change` required	select	Allow users to change their last name	`true`, `false` `required\|string\|max:255`
`user_allow_api_keys_create` required	select	Allow users to create API keys	`true`, `false` `required\|string\|max:255`
`user_allow_account_deletion` required	select	Allow users to permanently delete their own account	`true`, `false` `required\|string\|max:255`
`user_account_deletion_mode` required	select	How account deletions are processed: instant, delayed, or after active services expire	`instant`, `delayed`, `after_services` `required\|string\|max:64`
`user_account_deletion_delay_days` required	text	Days to wait before hard-deleting when mode is delayed (1-365)	`required\|string\|max:10`
`user_account_deletion_verify_2fa` required	select	Require two-factor authentication to confirm account deletion	`true`, `false` `required\|string\|max:255`
`user_account_deletion_verify_email_otp` required	select	Require email one-time password to confirm account deletion	`true`, `false` `required\|string\|max:255`

Email

Email configuration settings. Category id email, 7 settings.

Key	Type	Description	Values / validation
`smtp_enabled` required	select	The SMTP enabled of the application	`true`, `false` `required\|string\|max:255`
`smtp_host` required	text	The SMTP host of the application	`required\|string\|max:255`
`smtp_port` required	number	The SMTP port of the application	`required\|integer\|min:1\|max:65535`
`smtp_user` required	text	The SMTP user of the application	`required\|string\|max:255`
`smtp_pass` sensitive required	password	The SMTP password of the application	`string\|max:255`
`smtp_from` required	text	The SMTP from of the application	`required\|string\|max:255`
`smtp_encryption` required	select	SMTP encryption: starttls/tls for port 587 (e.g. Brevo), ssl for port 465 SMTPS, none for plain SMTP	`starttls`, `tls`, `ssl`, `none` `required\|string\|in:starttls,tls,ssl,none`

Status Page

User-facing status page configuration. Category id status_page, 12 settings.

Key	Type	Description	Values / validation
`status_page_enabled` required	select	Enable the user-facing status page	`true`, `false` `required\|string\|max:255`
`maintenance_mode_enabled` required	select	Maintenance mode: only staff with admin dashboard access can use the panel. Everyone else sees the maintenance notice and the status page	`true`, `false` `required\|string\|max:255`
`maintenance_mode_message`	text	Message shown to users during maintenance (optional)	`nullable\|string\|max:1000`
`status_page_public_enabled` required	select	Allow unauthenticated users to access /status and /api/status publicly	`true`, `false` `required\|string\|max:255`
`status_page_show_node_status` required	select	Show node status (healthy/unhealthy counts) on status page	`true`, `false` `required\|string\|max:255`
`status_page_show_load_usage` required	select	Show CPU, memory, and disk usage on status page	`true`, `false` `required\|string\|max:255`
`status_page_show_total_servers` required	select	Show total server count on status page	`true`, `false` `required\|string\|max:255`
`status_page_show_individual_nodes` required	select	Show individual node details on status page	`true`, `false` `required\|string\|max:255`
`status_page_allow_iframe` required	select	Allow the status page to be embedded in an iframe (disables X-Frame-Options: SAMEORIGIN)	`true`, `false` `required\|string\|max:255`
`status_page_show_raw_values` required	select	Show raw resource values (CPU core count, RAM in GB, disk in GB) alongside percentage values on the status page	`true`, `false` `required\|string\|max:255`
`status_page_show_player_count` required	select	Show total online player count per node (sum of all players on all servers of that node)	`true`, `false` `required\|string\|max:255`
`status_page_servers_visible_by_default` required	select	Default "Show on Status Page" value for newly created servers. Existing servers are unchanged; set false to hide new servers from the public status page unless explicitly opted in.	`true`, `false` `required\|string\|max:255`

Knowledgebase

Knowledgebase and documentation settings. Category id knowledgebase, 6 settings.

Key	Type	Description	Values / validation
`knowledgebase_enabled` required	select	Enable the knowledgebase feature for users	`true`, `false` `required\|string\|max:255`
`knowledgebase_public_enabled` required	select	Allow unauthenticated users to access /knowledgebase and /api/knowledgebase/* publicly	`true`, `false` `required\|string\|max:255`
`knowledgebase_show_categories` required	select	Show category listings in knowledgebase	`true`, `false` `required\|string\|max:255`
`knowledgebase_show_articles` required	select	Show article listings in knowledgebase	`true`, `false` `required\|string\|max:255`
`knowledgebase_show_attachments` required	select	Show downloadable attachments in articles	`true`, `false` `required\|string\|max:255`
`knowledgebase_show_tags` required	select	Show article tags in knowledgebase	`true`, `false` `required\|string\|max:255`

OAuth

Discord OAuth configuration. For OIDC/SSO use Admin → OIDC / SSO Providers.. Category id oauth, 3 settings.

Key	Type	Description	Values / validation
`discord_oauth_enabled` required	select	The Discord OAuth enabled of the application Callback URL:	`true`, `false` `required\|string\|max:255`
`discord_oauth_client_id`	text	The Discord OAuth client ID of the application	`required\|string\|max:255`
`discord_oauth_client_secret` sensitive	password	The Discord OAuth client secret of the application

Servers

Servers configuration settings. Category id servers, 28 settings.

Key	Type	Description	Values / validation
`server_allow_egg_change` required	select	Allow users to change the server spells/eggs	`true`, `false` `required\|string\|max:255`
`server_allow_startup_change` required	select	Allow users to change the server startup	`true`, `false` `required\|string\|max:255`
`server_allow_custom_docker_image` required	select	Allow users to enter a custom Docker image on the startup page. When disabled, users may only select images configured on the spell.	`true`, `false` `required\|string\|max:255`
`server_allow_subusers` required	select	Allow users to add subusers to their servers	`true`, `false` `required\|string\|max:255`
`server_allow_schedules` required	select	Allow users to create and manage schedules for their servers	`true`, `false` `required\|string\|max:255`
`server_lifecycle_hooks_enabled` required	select	Show the Lifecycle Hooks page in server navigation and allow configuration. Uses the same schedule permissions as tasks (schedule.read / schedule.update). When disabled, the menu entry is hidden, hooks do not run on power actions or server crashes, and API changes are rejected. Independent of schedules: you can enable hooks without enabling cron schedules.	`true`, `false` `required\|string\|max:255`
`server_lifecycle_hooks_container_shell_enabled` required	select	Allow Container Shell lifecycle hook steps and Container Shell schedule tasks (docker exec /bin/sh -c inside the server container). This is a security-sensitive capability: users with schedule.update (and control.console for schedule tasks) can run arbitrary shell commands in running containers when hooks fire or schedules run. Default off. Lifecycle hook steps additionally require Lifecycle Hooks Enabled; schedule tasks additionally require Schedules to be allowed. Existing Container Shell steps and tasks will not execute while this is disabled.	`true`, `false` `required\|string\|max:255`
`server_run_script_enabled` required	select	Allow the "run a custom container script" endpoint, which runs an arbitrary script inside a spell-allowed Docker image. Separate from the lifecycle Container Shell setting. Security-sensitive capability, default off.	`true`, `false` `required\|string\|max:255`
`server_backup_retention_mode` required	select	Default backup retention when limit is reached (servers/VMs can override per entity). Hard limit blocks new backups. FIFO rolling removes the oldest eligible backup to make room.	`hard_limit`, `fifo_rolling` `required\|string\|max:255`
`server_allow_user_backup_policy_edit` required	select	Allow server owners to change backup retention mode (inherit / hard limit / FIFO) from the panel and user API. Backup slot count (backup limit) is admin-only. Admins can always edit servers and VM instances.	`true`, `false` `required\|string\|max:255`
`server_allow_allocation_select` required	select	Allow users to select which allocation to assign when auto-allocating	`true`, `false` `required\|string\|max:255`
`server_allow_user_made_firewall` required	select	Allow users to create and manage their own server firewall rules	`true`, `false` `required\|string\|max:255`
`server_allow_user_made_proxy` required	select	Allow users to create and manage their own server reverse proxy configurations	`true`, `false` `required\|string\|max:255`
`server_proxy_max_per_server` required	number	Maximum number of reverse proxy configurations per server	`required\|integer\|min:1\|max:10`
`server_allow_cross_realm_spell_change` required	select	Allow users to change server spells/eggs across different realms. When disabled, users can only select spells from the same realm as their server.	`true`, `false` `required\|string\|max:255`
`server_allow_user_server_deletion` required	select	Allow users to delete their servers. When disabled, users can only delete their servers via the admin panel.	`true`, `false` `required\|string\|max:255`
`server_allow_user_made_import` required	select	Allow users to import server files from remote SFTP or FTP servers. The server must be offline for imports to work.	`true`, `false` `required\|string\|max:255`
`server_allow_user_made_fastdl` required	select	Allow users to create and manage their own FastDL configurations	`true`, `false` `required\|string\|max:255`
`server_allow_user_made_subdomains` required	select	Allow users to create and manage server subdomains	`true`, `false` `required\|string\|max:255`
`server_require_subdomain` required	select	Require users to create a panel subdomain before starting a server. Hides allocation IPs until a subdomain exists. Enable "Allow user-made subdomains" first. Roles with user.servers.bypass_subdomain_requirement are exempt.	`true`, `false` `required\|string\|max:255`
`server_auto_start_on_node_reconnect` required	select	When a game node reconnects after reboot or downtime, automatically start servers that have Auto Start enabled (skips manually stopped and suspended servers). Configure stagger delays below instead of Wings YAML.	`true`, `false` `required\|string\|max:255`
`server_auto_start_stagger_seconds` required	number	Seconds between each auto-started server on the same node after reconnect. Prevents starting every server at once.	`required\|integer\|min:0\|max:300`
`server_auto_start_initial_delay_seconds` required	number	Seconds to wait after Wings reconnects before starting the first auto-start server (gives Docker time to settle).	`required\|integer\|min:0\|max:600`
`server_allow_user_auto_start` required	select	Allow server owners to toggle Auto Start after node reboot from the server settings page. Admins can always configure this per server.	`true`, `false` `required\|string\|max:255`
`server_hide_ips` required	select	Default for privacy mode. When true, IP addresses are masked in activity logs, and privacy mode (hides IPs, hosts, emails, keys and credentials in the panel) starts on for users who have not chosen a value. Each user can still switch it from the top bar.	`true`, `false` `required\|string\|max:255`
`file_trash_enabled` required	select	Enable a trash bin for server file deletions. Deleted files are moved to trash instead of being permanently removed, and users can restore or empty trash from the file manager.	`true`, `false` `required\|string\|max:255`
`file_trash_max_size_mb` required	number	Maximum total size of trashed files per server, in megabytes. When exceeded, the oldest trashed items are permanently deleted. Use 0 for no size limit.	`required\|integer\|min:0`
`file_trash_retention_days` required	number	Automatically purge trashed files older than this many days. Use 0 to keep items until manually deleted or the size limit is reached.	`required\|integer\|min:0`

Chatbot

AI chatbot configuration settings. Category id chatbot, 21 settings.

Key	Type	Description	Values / validation
`chatbot_enabled` required	select	Enable the AI chatbot	`true`, `false` `required\|string\|max:255`
`chatbot_ai_provider` required	select	AI provider for the chatbot	`basic`, `google_gemini`, `openrouter`, `openai`, `ollama`, `grok`, `perplexity` `required\|string\|max:255`
`chatbot_temperature`	number	Temperature for AI responses (0.0-1.0). Lower = more focused, Higher = more creative	`numeric\|min:0\|max:1`
`chatbot_max_tokens`	number	Maximum number of tokens in AI responses	`integer\|min:1\|max:8192`
`chatbot_max_history`	number	Maximum number of previous messages to include in context	`integer\|min:1\|max:50`
`chatbot_system_prompt`	textarea	System prompt to prepend to all messages (optional)	`string\|max:1000`
`chatbot_user_prompt`	textarea	User context prompt to append to all messages (optional)	`string\|max:1000`
`chatbot_google_ai_api_key` sensitive	password	Google AI Studio API key for Gemini
`chatbot_google_ai_model`	text	Google Gemini model to use (e.g., gemini-2.5-flash, gemini-2.5-pro)	`string\|max:255`
`chatbot_openrouter_api_key` sensitive	password	OpenRouter API key
`chatbot_openrouter_model`	text	OpenRouter model to use (e.g., openai/gpt-4o-mini, anthropic/claude-3-haiku)	`string\|max:255`
`chatbot_openai_api_key` sensitive	password	OpenAI API key
`chatbot_openai_model`	text	OpenAI model to use (e.g., gpt-4o-mini, gpt-4o, gpt-3.5-turbo)	`string\|max:255`
`chatbot_openai_base_url`	text	OpenAI base URL (e.g., https://api.openai.com)	`string\|max:255`
`chatbot_ollama_base_url`	text	Ollama server base URL (e.g., http://localhost:11434)	`string\|max:255`
`chatbot_ollama_model`	text	Ollama model to use (e.g., llama3.2, mistral, codellama)	`string\|max:255`
`chatbot_grok_api_key` sensitive	password	xAI (Grok) API key	`string\|max:255`
`chatbot_grok_model`	text	xAI (Grok) model to use (e.g., grok-2-1212, grok-beta, grok-vision-beta)	`string\|max:255`
`chatbot_perplexity_api_key` sensitive	password	Perplexity API key	`string\|max:255`
`chatbot_perplexity_model`	text	Perplexity model to use (e.g., sonar-pro, sonar-small-chat)	`string\|max:255`
`chatbot_perplexity_base_url`	text	Perplexity base URL (e.g., https://api.perplexity.ai)	`string\|max:255`

Ticket System

Ticket system configuration settings. Category id ticket_system, 3 settings.

Key	Type	Description	Values / validation
`ticket_system_enabled` required	select	Enable or disable the ticket system feature	`true`, `false` `required\|string\|max:255`
`ticket_system_allow_attachments` required	select	Allow users to attach files to tickets	`true`, `false` `required\|string\|max:255`
`ticket_system_max_open_tickets` required	number	Maximum number of open tickets a user can have at once (0 = unlimited)	`required\|integer\|min:0\|max:1000`

SEO

Search Engine Optimization settings. Category id seo, 4 settings.

Key	Type	Description	Values / validation
`app_seo_title` required	text	The default title for the application pages	`required\|string\|max:255`
`app_seo_description` required	textarea	The default description for the application pages	`required\|string\|max:500`
`app_seo_keywords` required	textarea	Comma-separated keywords for SEO	`required\|string\|max:500`
`app_seo_indexing` required	select	Allow search engines to index this panel (when disabled, we send noindex,nofollow).	`true`, `false` `required\|string\|max:255`

PWA

Progressive Web App settings. Category id pwa, 5 settings.

Key	Type	Description	Values / validation
`app_pwa_enabled` required	select	Allow users to install the panel as an app on desktop, Android, and iOS	`true`, `false` `required\|string\|max:255`
`app_pwa_short_name`	text	Short name under the home-screen icon (falls back to app name)	`nullable\|string\|max:12`
`app_pwa_description`	textarea	PWA description (falls back to SEO description, then app name)	`nullable\|string\|max:500`
`app_pwa_theme_color` required	text	Theme color for the PWA browser bar	`required\|string\|max:7`
`app_pwa_bg_color` required	text	Background color for the PWA splash screen	`required\|string\|max:7`

Other

Other configuration settings. Category id other, 4 settings.

Key	Type	Description	Values / validation
`app_developer_mode` required	select	Is the application in developer mode?	`true`, `false` `required\|string\|max:255`
`custom_js`	textarea	Custom JavaScript to inject into the page	`string`
`custom_css`	textarea	Custom CSS to inject into the page	`string`
`cache_driver` required	select	Cache driver to use (file, redis) (redis is recommended for production) but redis can be unstable in some cases	`file`, `redis` `required\|string\|max:255`

Keys without a settings field

These 61 keys exist in ConfigInterface but have no field on the settings page. They are written by other screens (setup wizard state, Mythic Cloud link, feature pages with their own forms) or by code. Change them only through the screen that owns them, or with featherpanel saas setsetting if you know what the key does.

Key	Constant
`api_clients_allow_public_key_auth`	`API_CLIENTS_ALLOW_PUBLIC_KEY_AUTH`
`app_demo_yes`	`APP_DEMO_YES`
`app_server_spell_banner_enabled`	`APP_SERVER_SPELL_BANNER_ENABLED`
`branding_show_powered_by`	`BRANDING_SHOW_POWERED_BY`
`branding_show_version`	`BRANDING_SHOW_VERSION`
`chatbot_avatar_url`	`CHATBOT_AVATAR_URL`
`chatbot_display_name`	`CHATBOT_DISPLAY_NAME`
`feathercloud_access_last_rotated`	`FEATHERCLOUD_ACCESS_LAST_ROTATED`
`feathercloud_access_private_key`	`FEATHERCLOUD_ACCESS_PRIVATE_KEY`
`feathercloud_access_public_key`	`FEATHERCLOUD_ACCESS_PUBLIC_KEY`
`feathercloud_api_base_url`	`FEATHERCLOUD_API_BASE_URL`
`feathercloud_authorizer_email`	`FEATHERCLOUD_AUTHORIZER_EMAIL`
`feathercloud_authorizer_feather_uuid`	`FEATHERCLOUD_AUTHORIZER_FEATHER_UUID`
`feathercloud_authorizer_mythic_user_id`	`FEATHERCLOUD_AUTHORIZER_MYTHIC_USER_ID`
`feathercloud_authorizer_name`	`FEATHERCLOUD_AUTHORIZER_NAME`
`feathercloud_cloud_id`	`FEATHERCLOUD_CLOUD_ID`
`feathercloud_cloud_last_rotated`	`FEATHERCLOUD_CLOUD_LAST_ROTATED`
`feathercloud_cloud_name`	`FEATHERCLOUD_CLOUD_NAME`
`feathercloud_cloud_private_key`	`FEATHERCLOUD_CLOUD_PRIVATE_KEY`
`feathercloud_cloud_public_key`	`FEATHERCLOUD_CLOUD_PUBLIC_KEY`
`feathercloud_eggs_base_url`	`FEATHERCLOUD_EGGS_BASE_URL`
`feathercloud_eggs_enabled`	`FEATHERCLOUD_EGGS_ENABLED`
`feathercloud_issues_enabled`	`FEATHERCLOUD_ISSUES_ENABLED`
`feathercloud_last_synced_at`	`FEATHERCLOUD_LAST_SYNCED_AT`
`feathercloud_linked_at`	`FEATHERCLOUD_LINKED_AT`
`feathercloud_marketplace_enabled`	`FEATHERCLOUD_MARKETPLACE_ENABLED`
`feathercloud_member_map`	`FEATHERCLOUD_MEMBER_MAP`
`feathercloud_member_user_uuid`	`FEATHERCLOUD_MEMBER_USER_UUID`
`feathercloud_oauth_url`	`FEATHERCLOUD_OAUTH_URL`
`feathercloud_pastes_enabled`	`FEATHERCLOUD_PASTES_ENABLED`
`feathercloud_relink_pending_at`	`FEATHERCLOUD_RELINK_PENDING_AT`
`feathercloud_team_name`	`FEATHERCLOUD_TEAM_NAME`
`feathercloud_team_slug`	`FEATHERCLOUD_TEAM_SLUG`
`feathercloud_team_uuid`	`FEATHERCLOUD_TEAM_UUID`
`feathercloud_translate_base_url`	`FEATHERCLOUD_TRANSLATE_BASE_URL`
`feathercloud_translate_project`	`FEATHERCLOUD_TRANSLATE_PROJECT`
`featherpanel_premium_active`	`FEATHERPANEL_PREMIUM_ACTIVE`
`featherpanel_premium_checked_at`	`FEATHERPANEL_PREMIUM_CHECKED_AT`
`featherpanel_premium_expires_at`	`FEATHERPANEL_PREMIUM_EXPIRES_AT`
`featherpanel_premium_features`	`FEATHERPANEL_PREMIUM_FEATURES`
`featherpanel_premium_last_failure_at`	`FEATHERPANEL_PREMIUM_LAST_FAILURE_AT`
`oidc_allowed_group_claim`	`OIDC_ALLOWED_GROUP_CLAIM`
`oidc_allowed_group_value`	`OIDC_ALLOWED_GROUP_VALUE`
`oidc_auto_provision`	`OIDC_AUTO_PROVISION`
`oidc_client_id`	`OIDC_CLIENT_ID`
`oidc_client_secret`	`OIDC_CLIENT_SECRET`
`oidc_disable_local_login`	`OIDC_DISABLE_LOCAL_LOGIN`
`oidc_email_claim`	`OIDC_EMAIL_CLAIM`
`oidc_enabled`	`OIDC_ENABLED`
`oidc_issuer_url`	`OIDC_ISSUER_URL`
`oidc_provider_name`	`OIDC_PROVIDER_NAME`
`oidc_require_email_verified`	`OIDC_REQUIRE_EMAIL_VERIFIED`
`oidc_scopes`	`OIDC_SCOPES`
`oidc_subject_claim`	`OIDC_SUBJECT_CLAIM`
`setup_completed`	`SETUP_COMPLETED`
`sidebar_navigation_config`	`SIDEBAR_NAVIGATION_CONFIG`
`subdomain_cf_api_key`	`SUBDOMAIN_CF_API_KEY`
`subdomain_cf_email`	`SUBDOMAIN_CF_EMAIL`
`subdomain_max_per_server`	`SUBDOMAIN_MAX_PER_SERVER`
`vnc_proxy_via_panel`	`VNC_PROXY_VIA_PANEL`
`vnc_use_pve_redirect`	`VNC_USE_PVE_REDIRECT`