Configuration Details

Ed-Fi API v8 is configurable through appsettings.json in each service. This page documents the most common settings. Environment variables override appsettings.json values using the double-underscore __ separator for hierarchy — for example, AppSettings__Datastore=mssql. No special prefix is required.

Ed-Fi API Settings

Required Settings

The Ed-Fi API requires a reachable Configuration Service, the shared connection string encryption key, and JWT authentication settings to start. In the Docker Compose setup these are provided via the .env file; in other deployments configure them directly in appsettings.json or via environment variables. The JwtAuthentication section points the Ed-Fi API at the token authority — see also Identity Provider.

• AppSettings:Datastore

  Example	postgresql
  Description	Primary database engine for the Ed-Fi API. Valid values: postgresql, mssql

• ConfigurationServiceSettings:BaseUrl

  Example	http://ed-fi-api-config:8081
  Description	Base URL of the Configuration Service. The Ed-Fi API contacts this URL at runtime to retrieve claim sets, data stores, and application context

• ConfigurationServiceSettings:EncryptionKey

  Example	MySecretKey1234567890123456789012
  Description	Key used to decrypt data store connection strings stored in the Configuration Service. Required: while it is empty, the Ed-Fi API reports a configuration error and answers every request with HTTP 500 until it is corrected. Must match DatabaseSettings:EncryptionKey in the Configuration Service. Docker Compose sets both from CONFIGURATION_SERVICE_DATABASE_ENCRYPTION_KEY

• AppSettings:AuthenticationService

  Example	http://ed-fi-api-config:8081/connect/token
  Description	Token endpoint the Ed-Fi API forwards /oauth/token proxy requests to. Must use the container-network hostname in Docker deployments. Docker Compose env var: OAUTH_TOKEN_ENDPOINT

• ConfigurationServiceSettings:ClientSecret

  Example	(generated secret)
  Description	Client secret the Ed-Fi API uses to authenticate to the Configuration Service as the client named in ClientId. Must match the secret configured in the Configuration Service. Set via DMS_CONFIGURATION_SERVICE_CLIENT_SECRET env var

Optional Settings

• AppSettings:MultiTenancy

  Default	false
  Description	When true, enables multi-tenancy mode. The tenant identifier is extracted from the URL route. See Single and Multi-Tenant Configuration

• AppSettings:RouteQualifierSegments

  Default	(empty)
  Description	Comma-separated list of route qualifier segments extracted from the URL path. Example: districtId,schoolYear. Segments must match dataStoreContexts configured in the Configuration Service. See Context-Based Routing for Year-Specific Data Store

• AppSettings:BypassTypeCoercion

  Default	false
  Description	When true, disables automatic type coercion on POST and PUT request values. Submitted values must already match the JSON Schema type. Improves performance but requires clients to submit correctly typed values

• AppSettings:AllowIdentityUpdateOverrides

  Default	(empty)
  Description	Comma-separated list of resource names that allow natural key (identity) updates. By default all resources reject identity updates with HTTP 400

• AppSettings:MaskRequestBodyInLogs

  Default	true
  Description	When true, masks request body content in DEBUG-level log statements by replacing all scalar values with "*". When false, the full unmasked body is logged. See Logging Configuration

• AppSettings:CorrelationIdHeader

  Default	(empty)
  Description	Name of the request header a client-supplied correlation ID is read from. When empty, no header is read and the request's trace identifier is used. See Correlation IDs

• AppSettings:CorrelationIdMaxLength

  Default	255
  Description	Maximum length of a correlation ID used in logs and error responses; longer values are truncated. Must be between 64 and 1024

• AppSettings:MaximumPageSize

  Default	500
  Description	Upper bound for the limit and pageSize query parameters on GET-many requests, and the page size used when neither is supplied. Must be greater than 0. Docker Compose env var: MAXIMUM_PAGE_SIZE

• AppSettings:DefaultPartitionCount

  Default	10
  Description	Number of partitions a /partitions request returns when it omits the number query parameter. Must be between 1 and 200. See Improve Paging Performance with Cursor Paging. Docker Compose env var: DEFAULT_PARTITION_COUNT

• AppSettings:UseLegacyDocumentIdOrderingForChangeQueries

  Default	false
  Description	When true, pages every request in creation order, including change queries that would otherwise be paged in change-version order. Leave it false. Docker Compose env var: USE_LEGACY_DOCUMENT_ID_ORDERING_FOR_CHANGE_QUERIES

  By default, the Ed-Fi API pages some change queries in change-version order, which is faster on large collections. These are requests that include maxChangeVersion, and change-version-filtered requests served from a snapshot. All other requests, including live requests with only minChangeVersion, are paged in creation order. When this setting is true, every request is paged in the order records were created, as in the ODS/API, and change queries on large collections are slower. Turn it on only if change-version ordering causes a problem, and turn it off again once the problem is fixed.

  Changing this setting, in either direction, invalidates page and partition tokens issued for requests that include maxChangeVersion, and for change-version-filtered requests served from a snapshot. Clients holding those tokens must start over, so make the change when no change queries are running.

• AppSettings:MaxRequestBodySizeMegabytes

  Default	10
  Description	Largest request body, in megabytes, the Ed-Fi API accepts. Larger requests are rejected with HTTP 413

• AppSettings:ApiSchema:UseCustomPath

  Default	false; Docker Compose env var USE_API_SCHEMA_PATH defaults to true in .env.example
  Description	When true, loads the API schema (core and extensions) from the directory specified by ApiSchema:Path. When false, loads the bundled schema from the application output

• AppSettings:ApiSchema:Path

  Default	(empty); Docker Compose env var API_SCHEMA_PATH defaults to /app/ApiSchema in .env.example
  Description	Directory containing bootstrap-api-schema-manifest.json and the declared schema files. Used when ApiSchema:UseCustomPath is true. Only schema files listed in the manifest are loaded. In the Ed-Fi API container, SCHEMA_PACKAGES can download the schema packages into this directory and write the manifest; see Loading Schemas from Packages

• AppSettings:DomainsExcludedFromOpenApi

  Default	(empty)
  Description	Comma-separated list of Ed-Fi domain names to exclude from the generated OpenAPI specification. Case-insensitive. Useful for reducing Swagger UI noise in focused deployments

• AppSettings:ManagementEndpoints:Enabled, AppSettings:ManagementEndpoints:RequiredRole

  Defaults	false, (empty)
  Description	Set Enabled to true and RequiredRole to a role (for example, cms-client) to expose /management/reload-claimsets and /management/view-claimsets. Callers' tokens must carry that role. The endpoints aren't mapped while RequiredRole is empty. Docker Compose env vars: DMS_ENABLE_MANAGEMENT_ENDPOINTS, DMS_MANAGEMENT_REQUIRED_ROLE

• DataManagement:IdentityManagement:Enabled

  Default	false
  Description	When true, maps the /identity/v2/identities routes. The operations themselves are performed by an identity provider plugin; see Plugins. Docker Compose env var: DMS_ENABLE_IDENTITY_MANAGEMENT

• DataManagement:ResourceLinks:Enabled

  Default	true
  Description	When true, each document reference in a response carries a link object. When false, responses carry no link objects

• DataManagement:DocumentCache

  Default	No targets; read acceleration off
  Description	Configures the optional document cache. Nothing is projected while Targets is empty, and cached reads require ReadAcceleration:Enabled to be true. See Document Cache

• AppSettings:ReverseProxy:UseForwardedHeaders, AppSettings:ReverseProxy:KnownProxies, AppSettings:ReverseProxy:KnownNetworks

  Defaults	false, (empty), (empty)
  Description	Same behavior as the Configuration Service settings of the same name, described below. Docker Compose env vars: USE_REVERSE_PROXY_HEADERS, REVERSE_PROXY_KNOWN_PROXIES, REVERSE_PROXY_KNOWN_NETWORKS

• ConfigurationServiceSettings:ClientId

  Default	CMSReadOnlyAccess
  Description	Client ID the Ed-Fi API uses to authenticate to the Configuration Service. Docker Compose env var: DMS_CONFIGURATION_SERVICE_CLIENT_ID

• ConfigurationServiceSettings:Scope

  Default	edfi_admin_api/readonly_access
  Description	Scope requested for the Configuration Service token. The ClientId client must hold it, or the Ed-Fi API can't read its configuration. Keep the default when multi-tenancy is on. Docker Compose env var: DMS_CONFIGURATION_SERVICE_CLIENT_SCOPE

• ConfigurationServiceSettings:AllowLegacyConnectionStrings

  Default	true
  Description	Whether connection strings stored in the legacy (unauthenticated) encryption format can still be read. Set it to the same value as DatabaseSettings:AllowLegacyConnectionStrings in the Configuration Service. Docker Compose env var: CONFIGURATION_SERVICE_ALLOW_LEGACY_CONNECTION_STRINGS (sets both)

• CacheSettings:ClaimSetsCacheExpirationSeconds

  Default	600
  Description	Seconds before cached claim sets (the claims taxonomy) expire and are re-fetched from the Configuration Service

• CacheSettings:ApplicationContextCacheExpirationSeconds

  Default	600
  Description	Seconds before cached application context expires and is re-fetched from the Configuration Service

• CacheSettings:TokenCacheExpirationSeconds

  Default	1500
  Description	Seconds before the cached Configuration Service access token expires and is renewed. The Ed-Fi API does not read the token's expires_in, so keep this no longer than the Configuration Service token lifetime: IdentitySettings:TokenExpirationMinutes in self-contained mode, or the access token lifespan in Keycloak mode

• CacheSettings:ProfileCacheExpirationSeconds

  Default	1800
  Description	Seconds before cached profile definitions expire and are re-fetched from the Configuration Service

• CacheSettings:DataStoreCacheExpirationSeconds

  Default	600
  Description	Seconds before cached data store configuration expires and is re-fetched from the Configuration Service. Set to 0 or a negative value to keep the cache until the next explicit reload

• CacheSettings:DataStoreCacheRefreshEnabled

  Default	true
  Description	When true, data store settings are re-fetched every DataStoreCacheExpirationSeconds, so Configuration Service changes take effect without a restart. When false, they're kept until the next explicit reload

• CacheSettings:DerivativeValidationCacheExpirationSeconds

  Default	600
  Description	Seconds the Ed-Fi API caches the result of checking that a read replica or snapshot database matches the expected schema. Unlike DataStoreCacheExpirationSeconds, 0 doesn't turn off expiry: values below 1 fall back to 600, and values above 3600 are capped at 3600. When the data store cache expires (DataStoreCacheRefreshEnabled is true and DataStoreCacheExpirationSeconds is above 0), the value is also capped at DataStoreCacheExpirationSeconds. See Read Replicas

• AppSettings:PathBase

  Default	(empty); Docker Compose env var PATH_BASE defaults to api in .env.example
  Description	URL path prefix for all Ed-Fi API endpoints. With PATH_BASE=api, resource endpoints are at /api/data/ed-fi/.... Leave empty to serve from the root path with no prefix

• Cors:SwaggerUIOrigin

  Default	http://localhost:8082
  Description	The single origin allowed to call the Ed-Fi API from a browser, normally where Swagger UI is served. Docker Compose env var: DMS_SWAGGER_UI_URL

• DatabaseOptions:IsolationLevel

  Default	ReadCommitted
  Description	Transaction isolation level. Valid values from System.Data.IsolationLevel. Docker Compose env var: DATABASE_ISOLATION_LEVEL; the Compose files use RepeatableRead when it isn't set

• RateLimit:PermitLimit, RateLimit:Window, RateLimit:QueueLimit

  Defaults	20000, 10, 0
  Description	Fixed-window limit of PermitLimit requests per Window seconds, shared by all clients that use the same Host header. Up to QueueLimit excess requests wait (0 = no queuing); the rest get HTTP 429. To disable, remove the RateLimit section; this isn't possible with the provided Docker Compose files, which always set it. Docker Compose env vars: DMS_RATE_LIMIT_PERMIT_LIMIT, DMS_RATE_LIMIT_WINDOW, DMS_RATE_LIMIT_QUEUE_LIMIT

• CircuitBreaker:FailureRatio, CircuitBreaker:SamplingDurationSeconds, CircuitBreaker:MinimumThroughput, CircuitBreaker:BreakDurationSeconds

  Defaults	0.1, 120, 20, 30
  Description	Circuit breaker for document reads and writes. When the share of unexpected database failures within SamplingDurationSeconds reaches FailureRatio (after at least MinimumThroughput calls), document requests receive HTTP 503 for BreakDurationSeconds. Docker Compose env vars: FAILURE_RATIO, SAMPLING_DURATION_SECONDS, MINIMUM_THROUGHPUT, BREAK_DURATION_SECONDS

• DeadlockRetry:MaxRetryAttempts, DeadlockRetry:BaseDelayMilliseconds, DeadlockRetry:UseJitter

  Defaults	3, 150, true
  Description	Retries a document request that failed with a retryable database error, such as a deadlock, using exponential backoff from BaseDelayMilliseconds. Set MaxRetryAttempts to 0 to disable retries

• Plugins:Directory, Plugins:Allowed

  Defaults	/app/plugins, (empty)
  Description	Plugin root directory and the comma-separated, ordered list of plugin directory names to load. Nothing loads while Allowed is empty. See Plugins

• OtlpLogging

  Default	Disabled
  Description	Exports logs over OpenTelemetry (OTLP). See OpenTelemetry (OTLP) Log Export

JwtAuthentication

These settings tell the Ed-Fi API how to validate the bearer tokens issued by the identity provider. See Identity Provider for values for each provider.

• JwtAuthentication:Authority

  Example	http://ed-fi-api-config:8081
  Description	Token issuer. Must exactly match the issuer in the identity provider's metadata document, or the Ed-Fi API does not start. Docker Compose env var: DMS_JWT_AUTHORITY

• JwtAuthentication:MetadataAddress

  Example	http://ed-fi-api-config:8081/.well-known/openid-configuration
  Description	OpenID Connect metadata endpoint. Signing keys are fetched only from this address's origin (scheme, host and port). Docker Compose env var: DMS_JWT_METADATA_ADDRESS

• JwtAuthentication:Audience

  Default	account
  Description	Expected audience of incoming tokens. Docker Compose env var: DMS_JWT_AUDIENCE

• JwtAuthentication:RequireHttpsMetadata

  Default	true
  Description	Requires the metadata and signing-key documents to be fetched over HTTPS. Set to false only when the identity provider is reached over a private network; the Docker Compose files set it to false through DMS_JWT_REQUIRE_HTTPS_METADATA

• JwtAuthentication:RoleClaimType

  Default	http://schemas.microsoft.com/ws/2008/06/identity/claims/role
  Description	Claim type that carries role values in tokens. Used by endpoints that require a configured role, such as the management endpoints. Docker Compose env var: DMS_JWT_ROLE_CLAIM_TYPE

• JwtAuthentication:ClientRole

  Default	service
  Description	Role that every access token must carry. A token without it gets 403 Forbidden. Set it to the role your identity provider gives API clients, such as dms-client, the self-contained default (IdentitySettings:ClientRole). Empty turns the check off. The local Docker Compose files use dms-client when the env var isn't set, and the published ones leave it empty. Docker Compose env var: DMS_JWT_CLIENT_ROLE

• JwtAuthentication:AutomaticRefreshIntervalHours

  Default	24
  Description	How often, in hours, the Ed-Fi API re-fetches the identity provider's metadata and signing keys. A new signing key isn't used until this refresh or a restart. Docker Compose env var: DMS_JWT_AUTOMATIC_REFRESH_INTERVAL_HOURS

• JwtAuthentication:ClockSkewSeconds

  Default	30
  Description	Clock skew tolerance, in seconds, applied when checking a token's validity period. Docker Compose env var: DMS_JWT_CLOCK_SKEW_SECONDS

• JwtAuthentication:RefreshIntervalMinutes

  Default	60
  Description	Minimum time, in minutes, between on-demand re-fetches of the identity provider's metadata and signing keys, such as after an issuer mismatch. Docker Compose env var: DMS_JWT_REFRESH_INTERVAL_MINUTES

• JwtAuthentication:ValidatedTokenCacheEntryMaxLifetimeSeconds

  Default	300
  Description	How long, in seconds, a validated token is reused before it is validated again. 0 turns reuse off. Not mapped in Docker Compose

---

Configuration Service Settings

Required Settings

• AppSettings:Datastore

  Example	postgresql
  Description	Primary database engine. Valid values: postgresql, mssql

• AppSettings:IdentityProvider

  Default	self-contained
  Description	Authentication provider. Valid values: self-contained (OpenIddict), keycloak. See Identity Provider

• DatabaseSettings:DatabaseConnection

  Example	host=localhost;port=5432;username=postgres;database=edfi_configurationservice;
  Description	Connection string for the Configuration Service's own database. The service does not start when it is blank. Docker Compose env var: CONFIGURATION_SERVICE_DATABASE_CONNECTION_STRING

• DatabaseSettings:EncryptionKey

  Example	MySecretKey1234567890123456789012
  Description	AES key used to encrypt data store connection strings at rest. The service does not start when it is blank, shorter than 32 characters, has a non-ASCII character in its first 32 characters, or is the sample key that earlier appsettings.json files shipped with. Must match ConfigurationServiceSettings:EncryptionKey in the Ed-Fi API. Set via CONFIGURATION_SERVICE_DATABASE_ENCRYPTION_KEY environment variable

Optional Settings

• AppSettings:DeployDatabaseOnStartup

  Default	true
  Description	When true, creates and initializes the Configuration Service database on startup

• AppSettings:MultiTenancy

  Default	false
  Description	When true, enables multi-tenancy. The tenant identifier is extracted from the Tenant request header

• AppSettings:PathBase

  Default	(empty); Docker Compose env var CONFIGURATION_SERVICE_PATH_BASE defaults to config in .env.example
  Description	URL base segment for all Configuration Service endpoints. Example: with PathBase=config, the management API is at /config/v3/vendors

• AppSettings:TokenRequestTimeoutSeconds

  Default	30
  Description	Timeout in seconds for calls to Keycloak when IdentityProvider is keycloak

• AppSettings:ReverseProxy:UseForwardedHeaders

  Default	false
  Description	When true, respects X-Forwarded-* headers for URL generation. Enable when deploying behind a reverse proxy or load balancer

• AppSettings:ReverseProxy:KnownProxies

  Default	(empty)
  Description	Comma-separated list of trusted proxy IP addresses (e.g. 10.0.0.1,10.0.0.2). Restricts which proxies may supply forwarded-header values

• AppSettings:ReverseProxy:KnownNetworks

  Default	(empty)
  Description	Comma-separated list of trusted proxy CIDR networks (e.g. 192.168.1.0/24,10.0.0.0/8). Extends KnownProxies to cover a range of addresses

• DatabaseSettings:AllowLegacyConnectionStrings

  Default	true
  Description	Whether stored connection strings in the legacy (unauthenticated) encryption format can still be read. Set to false once every stored value has been re-encrypted, and set the Ed-Fi API's ConfigurationServiceSettings:AllowLegacyConnectionStrings to match

• ClaimsOptions:ClaimsSource

  Default	Embedded
  Description	Where claims are loaded from. Valid values: Embedded (built-in claims only), Hybrid (built-in base claims plus fragments from ClaimsDirectory), Filesystem (all claims from ClaimsDirectory). Docker Compose env var: CONFIGURATION_SERVICE_CLAIMS_SOURCE

• ClaimsOptions:ClaimsDirectory

  Default	(empty)
  Description	Directory that holds claims files. Required when ClaimsSource is Hybrid or Filesystem. Docker Compose env var: CONFIGURATION_SERVICE_CLAIMS_DIRECTORY

• ClaimsOptions:DataStandardVersion

  Default	5.2
  Description	Ed-Fi Data Standard version whose built-in base claims are loaded, for example 5.2 or 6.1. Docker Compose env var: CONFIGURATION_SERVICE_DATA_STANDARD_VERSION

• JobSettings:WorkerEnabled, JobSettings:SchedulerEnabled, JobSettings:RetentionEnabled

  Defaults	true, true, true
  Description	Turn off the job worker, the recurring-job scheduler, or the cleanup of old finished jobs on this instance, for example on extra replicas. Docker Compose env vars: CONFIGURATION_SERVICE_JOBS_WORKER_ENABLED, CONFIGURATION_SERVICE_JOBS_SCHEDULER_ENABLED, CONFIGURATION_SERVICE_JOBS_RETENTION_ENABLED

• JobSettings:MaxConcurrentJobs, JobSettings:FinishedJobRetention

  Defaults	2, 7.00:00:00
  Description	Number of jobs one instance runs at the same time (1 to 32), and how long a completed or failed job is kept (1 hour to 365 days). The service does not start when a JobSettings value is out of range

• SecretsSettings:CacheExpirationSeconds, SecretsSettings:ResolveTimeoutSeconds

  Defaults	300, 10
  Description	How long a resolved ${secret:<name>} value in a connection string is reused (0 disables caching), and how long a read waits for the secret resolver plugin. See Secrets in Connection Strings

• ConnectRateLimit:Enabled, ConnectRateLimit:SourcePermitLimit, ConnectRateLimit:ClientPermitLimit, ConnectRateLimit:WindowSeconds, ConnectRateLimit:RequiredProxyAddress

  Defaults	true, 120, 30, 60, (empty)
  Description	Rate limits on the /connect OAuth endpoints. See Rate Limits on /connect Endpoints

• Plugins:Directory, Plugins:Allowed

  Defaults	/app/plugins, (empty)
  Description	Configuration Service plugins, such as a secret resolver, configured separately from the Ed-Fi API's. Nothing loads while Allowed is empty. See Plugins

• OtlpLogging

  Default	Disabled
  Description	Exports logs over OpenTelemetry (OTLP). See OpenTelemetry (OTLP) Log Export

IdentitySettings

These settings configure how the Configuration Service issues and validates tokens. See Identity Provider for values for each provider.

• IdentitySettings:Authority

  Example	http://ed-fi-api-config:8081
  Description	Token issuer. In self-contained mode, the base URL advertised for discovery endpoints; don't include AppSettings:PathBase in it. Docker Compose env var: CONFIGURATION_SERVICE_IDENTITY_AUTHORITY

• IdentitySettings:Audience

  Default	account
  Description	Audience of issued and accepted tokens. Docker Compose env var: CONFIGURATION_SERVICE_IDENTITY_AUDIENCE

• IdentitySettings:ClientId, IdentitySettings:ClientSecret

  Defaults	DmsConfigurationService, (none)
  Description	The Configuration Service's own client credentials. The secret is required and must meet the client secret length and complexity rules below. Docker Compose env vars: CONFIGURATION_SERVICE_IDENTITY_CLIENT_ID, CONFIGURATION_SERVICE_IDENTITY_CLIENT_SECRET

• IdentitySettings:RequireHttpsMetadata

  Default	true
  Description	Requires identity provider metadata to be fetched over HTTPS (Keycloak mode). Set to false only on a private network; the Docker Compose files set it to false through CONFIGURATION_SERVICE_IDENTITY_REQUIRE_HTTPS

• IdentitySettings:RoleClaimType

  Default	http://schemas.microsoft.com/ws/2008/06/identity/claims/role
  Description	Claim type that carries role values in tokens. Docker Compose env var: CONFIGURATION_SERVICE_IDENTITY_ROLE_CLAIM_TYPE

• IdentitySettings:ConfigServiceRole

  Default	cms-client
  Description	Role a token must carry to call the Configuration Service management API. Docker Compose env var: CONFIGURATION_SERVICE_IDENTITY_SERVICE_ROLE

• IdentitySettings:ClientRole

  Default	dms-client
  Description	Role assigned to API clients created for the Ed-Fi API. Docker Compose env var: CONFIGURATION_SERVICE_IDENTITY_CLIENT_ROLE

• IdentitySettings:AllowRegistration

  Default	false
  Description	When true, allows new clients to register themselves through /connect/register. Keep false in production. Docker Compose env var: CONFIGURATION_SERVICE_IDENTITY_ALLOW_REGISTRATION

• IdentitySettings:EncryptionKey

  Default	(empty)
  Description	Key that protects the token signing keys stored in the Configuration Service database. Must be set in self-contained mode; while it is empty the service starts but can't issue tokens. Docker Compose env var: CONFIGURATION_SERVICE_IDENTITY_ENCRYPTION_KEY

• IdentitySettings:TokenExpirationMinutes

  Default	30
  Description	Lifetime, in minutes, of access tokens issued in self-contained mode. Must be between 1 and 35791394; the Configuration Service does not start otherwise. Keep it at or above the Ed-Fi API's CacheSettings:TokenCacheExpirationSeconds (25 minutes by default), because the Ed-Fi API keeps using its cached token for that long whatever the token's lifetime

• IdentitySettings:BearerTokenPerClientLimit

  Default	15
  Description	Maximum number of active access tokens one API client may hold in self-contained mode. A value below 1 turns the limit off. See Token limits. Docker Compose env var: CONFIGURATION_SERVICE_IDENTITY_BEARER_TOKEN_PER_CLIENT_LIMIT

• IdentitySettings:TokenCleanup:Enabled

  Default	true
  Description	Runs the background job that deletes expired access tokens in self-contained mode. See Expired-token cleanup. Docker Compose env var: CONFIGURATION_SERVICE_IDENTITY_TOKEN_CLEANUP_ENABLED

• IdentitySettings:TokenCleanup:IntervalMinutes

  Default	30
  Description	Minutes between runs of the expired-token cleanup job. Docker Compose env var: CONFIGURATION_SERVICE_IDENTITY_TOKEN_CLEANUP_INTERVAL_MINUTES

• IdentitySettings:ClientSecretHashingIterations

  Default	210000
  Description	Number of hashing iterations (PBKDF2-SHA256) for client secrets in self-contained mode. Don't change it after clients exist: every existing client secret stops working and must be re-issued. Docker Compose env var: CONFIGURATION_SERVICE_IDENTITY_HASHING_ITERATIONS

• IdentitySettings:ClientSecretValidation:MinimumLength

  Default	32
  Description	Minimum length for client secrets registered with the Configuration Service. Secrets must also contain at least one uppercase letter, one lowercase letter, one number, and one special character from !@#$%^&*()-_=+[]{}:;,.?

• IdentitySettings:ClientSecretValidation:MaximumLength

  Default	128
  Description	Maximum length for client secrets

The following settings control how the Configuration Service keeps its token signing keys in memory. They apply only in self-contained mode, aren't mapped in the Docker Compose files, and are checked at startup: the Configuration Service doesn't start when a value is out of range. See Configuration Service Signing Keys.

• IdentitySettings:SigningKeyRefreshIntervalSeconds

  Default	300
  Description	Seconds between scheduled reloads of the signing keys. Each wait varies by up to 10 percent. Must be from 30 to 43200

• IdentitySettings:SigningKeyMaxStalenessSeconds

  Default	3600
  Description	Age, in seconds, at which the loaded signing keys are no longer trusted. Until a reload succeeds, requests that need a bearer token and the JWKS endpoint get 503, and introspection reports every token as inactive. Issuing and revoking tokens aren't affected. Must be at least twice SigningKeyRefreshIntervalSeconds and no more than 86400

• IdentitySettings:SigningKeyUnknownKeyRefreshCooldownSeconds

  Default	30
  Description	Minimum seconds between the end of a load and a reload caused by a token signed with an unknown key. Must be from 1 to 3600

• IdentitySettings:SigningKeyLoadTimeoutSeconds

  Default	10
  Description	Seconds after which a signing key load is cancelled and counted as failed. Must be from 1 to 60, and less than SigningKeyRefreshIntervalSeconds

IdentitySettings:KeyFormatCacheSize is no longer read. Remove it from your configuration; it has no effect.