---
id: settings
title: Settings
sidebar_label: Settings
---

One page, three groups: **Access**, **Monitoring** and **Integrations**. Plus
the licence, which has its own page.

Settings require the `owner` or `admin` role.

:::info Where instance settings went
Members and single sign-on used to live at `/settings/instance`. They are now
the Access group at the top of this page splitting "who can sign in" from "how
this instance behaves" produced two half-pages and a nav entry nobody could
distinguish from Settings. The old path still redirects.
:::

## Access

### Members

Add, remove and re-role the people who can sign in.

| Role     | Can                                                  |
| -------- | ---------------------------------------------------- |
| `owner`  | Everything                                           |
| `admin`  | Everything except owner-only settings                |
| `member` | Servers, keys, workflows, monitors, secrets, console |

Local members authenticate with email and a bcrypt-hashed password.

#### Members managed by Vantage HQ

On a cloud instance, people granted access from the HQ portal appear here as
read-only rows with a link to the portal.

:::warning HQ-managed users cannot be edited locally
Changing the role of, or deleting, an `hq`-sourced user is refused with `409`.
HQ owns their role, their password and whether they exist at all a local
change would be overwritten by the next sync and would leave two writers for one
password hash. Manage them from [People and roles](../hq/people-and-roles.md).
:::

### Single sign-on (OIDC)

Configured per organisation:

| Field         |                              |
| ------------- | ---------------------------- |
| Issuer        | Your provider's issuer URL   |
| Client ID     |                              |
| Client secret | Stored AES-256-GCM encrypted |

Sign-in then goes `/auth/oidc/start` → your provider → `/auth/oidc/callback`.

Local and OIDC users coexist. Keep at least one local owner: if the provider is
misconfigured or unreachable, a local account is the way back in.

## Monitoring

- **Alert defaults** for monitors.
- **Notification channels** their own page. See
  [Notification channels](./notification-channels.md).

## Integrations

### Workflow log retention

How long run logs are kept.

| Value    | Meaning        |
| -------- | -------------- |
| unset    | 30 days        |
| a number | that many days |
| `0`      | forever        |

### ESO read token

The bearer token External Secrets Operator uses to read secret groups. Shown
once, stored as a SHA-256 hash, rotatable. See
[Secrets](./secrets.md#kubernetes-external-secrets-operator).

## Licence

`/settings/license` shows the deployment, tier, server allowance, enabled
features and expiry.

On **self-hosted**, paste a licence here. This works even while the current
licence is expired that is the way out of degraded mode.

On **cloud**, there is no paste form. The endpoint answers `409 cloud_managed`,
because a cloud licence is written by HQ directly. The page links to the portal
instead.

See [Licensing and entitlements](../hq/licensing-and-entitlements.md).

## Sessions

Sessions are an opaque token in the `km_session` cookie, held in Redis with a
24-hour TTL. There is no per-session management UI; restarting Redis signs
everyone out and affects nothing else.

## Host and organisation guard

On a multi-tenant deployment, a request to `<slug>.vantage.<tld>` resolves the
organisation from the slug and rejects a session belonging to a different one.
The label it looks for comes from `APP_ROOT_LABEL`.

:::warning A wrong `APP_ROOT_LABEL` disables the guard
It does not fail loudly it simply stops matching, and the host check stops
protecting anything. If you serve the UI on a custom domain, set it to match.
:::