> ## Documentation Index > Fetch the complete documentation index at: https://mintlify.com/supertokens/supertokens-core/llms.txt > Use this file to discover all available pages before exploring further. # Configuration > Configure SuperTokens Core with config.yaml and environment variables # Configuration SuperTokens Core is configured using a `config.yaml` file and environment variables. This page documents all available configuration options. ## Configuration file location The default configuration file is located at: ```bash Docker theme={null} /usr/lib/supertokens/config.yaml ``` ```bash Binary installation theme={null} /config.yaml ``` You can override the location using the `--with-config` flag: ```bash theme={null} ./supertokens start --with-config=/path/to/config.yaml ``` ## Core configuration ### Service settings The port on which SuperTokens Core runs ```yaml theme={null} port: 3567 ``` The host on which SuperTokens Core runs. Can be `localhost`, a domain name, `0.0.0.0`, or an IP address ```yaml theme={null} host: 0.0.0.0 ``` Base path to prepend to all API endpoints ```yaml theme={null} base_path: /auth ``` With this config, endpoints become `/auth/recipe/signup` instead of `/recipe/signup` Maximum thread pool size for incoming HTTP requests ```yaml theme={null} max_server_pool_size: 20 ``` ### Logging Path for INFO level logs. Set to `"null"` to log to standard output ```yaml theme={null} info_log_path: /var/log/supertokens/info.log ``` Path for ERROR level logs. Set to `"null"` to log to standard error ```yaml theme={null} error_log_path: /var/log/supertokens/error.log ``` Logging level. Options: `DEBUG`, `INFO`, `WARN`, `ERROR`, `NONE` ```yaml theme={null} log_level: DEBUG ``` ## Authentication configuration ### Access tokens **DIFFERENT\_ACROSS\_APPS**: Time in seconds for access token validity ```yaml theme={null} access_token_validity: 7200 # 2 hours ``` **DIFFERENT\_ACROSS\_APPS**: Time in hours for signing key rotation ```yaml theme={null} access_token_dynamic_signing_key_update_interval: 24 # Daily rotation ``` Shorter intervals improve security but increase database queries for key management ### Refresh tokens **DIFFERENT\_ACROSS\_APPS**: Time in minutes for refresh token validity ```yaml theme={null} refresh_token_validity: 43200 # 30 days ``` ### API keys **DIFFERENT\_ACROSS\_APPS**: Comma-separated API keys for authenticating Backend SDK requests ```yaml theme={null} api_keys: key1-min-20-chars-long,key2-min-20-chars-long ``` Keys must be at least 20 characters and contain only alphanumeric characters, `=`, and `-` ## Password authentication ### Password hashing **DIFFERENT\_ACROSS\_APPS**: Password hashing algorithm. Options: `BCRYPT`, `ARGON2` ```yaml theme={null} password_hashing_alg: ARGON2 ``` Argon2 is more secure but uses more CPU. Choose based on your threat model and server capacity ### BCrypt settings Number of rounds for BCrypt hashing. Higher values are more secure but slower ```yaml theme={null} bcrypt_log_rounds: 12 ``` ### Argon2 settings Number of iterations for Argon2 hashing ```yaml theme={null} argon2_iterations: 2 ``` Memory usage in KB for Argon2 (default: 85 MB) ```yaml theme={null} argon2_memory_kb: 131072 # 128 MB ``` Parallelism factor for Argon2 ```yaml theme={null} argon2_parallelism: 4 ``` Number of concurrent Argon2 hash operations allowed ```yaml theme={null} argon2_hashing_pool_size: 2 ``` ### Password reset **DIFFERENT\_ACROSS\_TENANTS**: Password reset token lifetime in milliseconds ```yaml theme={null} password_reset_token_lifetime: 1800000 # 30 minutes ``` ## Passwordless authentication **DIFFERENT\_ACROSS\_TENANTS**: Passwordless code validity in milliseconds ```yaml theme={null} passwordless_code_lifetime: 600000 # 10 minutes ``` **DIFFERENT\_ACROSS\_TENANTS**: Maximum code input attempts before requiring restart ```yaml theme={null} passwordless_max_code_input_attempts: 3 ``` ## TOTP (MFA) **DIFFERENT\_ACROSS\_TENANTS**: Maximum invalid TOTP attempts before rate limiting ```yaml theme={null} totp_max_attempts: 3 ``` **DIFFERENT\_ACROSS\_TENANTS**: Rate limit duration in seconds after max attempts reached ```yaml theme={null} totp_rate_limit_cooldown_sec: 1800 # 30 minutes ``` ## Email verification **DIFFERENT\_ACROSS\_TENANTS**: Email verification token lifetime in milliseconds ```yaml theme={null} email_verification_token_lifetime: 259200000 # 3 days ``` ## IP filtering **DIFFERENT\_ACROSS\_TENANTS**: Regex pattern for allowed IP addresses ```yaml theme={null} # Allow only localhost ip_allow_regex: 127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1 ``` **DIFFERENT\_ACROSS\_TENANTS**: Regex pattern for denied IP addresses ```yaml theme={null} # Deny specific IP range ip_deny_regex: 192\.168\.1\..* ``` ## OAuth configuration Encryption key for OAuth client secrets stored in database ```yaml theme={null} oauth_client_secret_encryption_key: your-32-char-encryption-key-here ``` Required if you're using OAuth provider features. Must be exactly 32 characters URL for OAuth provider public service ```yaml theme={null} oauth_provider_public_service_url: https://oauth.example.com ``` URL for OAuth provider admin service ```yaml theme={null} oauth_provider_admin_service_url: https://oauth-admin.example.com ``` ## SAML configuration Service provider entity ID for SAML ```yaml theme={null} saml_sp_entity_id: https://saml.myapp.com ``` Duration in milliseconds for SAML claims validity ```yaml theme={null} saml_claims_validity: 600000 # 10 minutes ``` ## Bulk import **DIFFERENT\_ACROSS\_APPS**: Number of parallel threads for bulk user migration ```yaml theme={null} bulk_migration_parallelism: 4 ``` **DIFFERENT\_ACROSS\_APPS**: Number of users to load per batch during migration ```yaml theme={null} bulk_migration_batch_size: 5000 ``` ## Monitoring **DIFFERENT\_ACROSS\_APPS**: Disable anonymous telemetry ```yaml theme={null} disable_telemetry: true ``` Learn more about telemetry: [SuperTokens Wiki](https://github.com/supertokens/supertokens-core/wiki/Telemetry) OpenTelemetry collector URL for distributed tracing ```yaml theme={null} otel_collector_connection_uri: http://localhost:4318 ``` Enable deadlock detection logging ```yaml theme={null} deadlock_logger_enable: true ``` ## Environment variables Most configuration options can be set via environment variables using uppercase with underscores: ```bash theme={null} # Set port via environment variable PORT=8080 # Set API keys API_KEYS=key1-min-20-chars-long,key2-min-20-chars-long # Set password hashing algorithm PASSWORD_HASHING_ALG=ARGON2 ``` Environment variables take precedence over config.yaml settings ## Configuration scopes Configuration parameters are marked with scope annotations: * **DIFFERENT\_ACROSS\_APPS**: Can be different for each app in multi-tenancy setup * **DIFFERENT\_ACROSS\_TENANTS**: Can be different for each tenant within an app * **(No annotation)**: Global configuration, same across all apps and tenants ## Example configurations ### Development ```yaml config.yaml theme={null} core_config_version: 0 port: 3567 host: localhost log_level: DEBUG disable_telemetry: true ``` ### Production ```yaml config.yaml theme={null} core_config_version: 0 # Service port: 3567 host: 0.0.0.0 max_server_pool_size: 20 # Security api_keys: your-production-key-min-20-chars,your-backup-key-min-20-chars # Tokens access_token_validity: 3600 # 1 hour refresh_token_validity: 43200 # 30 days access_token_dynamic_signing_key_update_interval: 168 # 7 days # Password hashing password_hashing_alg: ARGON2 argon2_iterations: 2 argon2_memory_kb: 131072 # 128 MB argon2_parallelism: 4 argon2_hashing_pool_size: 2 # Logging log_level: INFO info_log_path: /var/log/supertokens/info.log error_log_path: /var/log/supertokens/error.log # Monitoring otel_collector_connection_uri: http://localhost:4318 ``` ### High security ```yaml config.yaml theme={null} core_config_version: 0 # Strict token lifetimes access_token_validity: 900 # 15 minutes refresh_token_validity: 10080 # 7 days password_reset_token_lifetime: 900000 # 15 minutes # Strong password hashing password_hashing_alg: ARGON2 argon2_iterations: 3 argon2_memory_kb: 262144 # 256 MB argon2_parallelism: 4 bcrypt_log_rounds: 13 # MFA settings totp_max_attempts: 3 totp_rate_limit_cooldown_sec: 1800 # 30 minutes # Passwordless security passwordless_max_code_input_attempts: 3 passwordless_code_lifetime: 300000 # 5 minutes # IP filtering (adjust regex for your needs) ip_allow_regex: 10\.0\.\d+\.\d+ ``` ## Validation Validate your configuration by starting SuperTokens Core: ```bash theme={null} ./supertokens start --with-config=/path/to/config.yaml ``` Check the logs for any configuration errors or warnings. ## Related documentation Configure your database connection Use environment variables with Docker Deploy SuperTokens Core to production Learn about security best practices