Configuration
Set Authentication defaults in .env. Project settings in the dashboard can override email copy and the verification policy.
Env keys still use the PROJECT_AUTH_* prefix in the application config.
Token and session defaults
| Variable | Default | Description |
|---|---|---|
PROJECT_AUTH_ISSUER | APP_URL | JWT issuer |
PROJECT_AUTH_ACCESS_TOKEN_TTL_MINUTES | 15 | Access token lifetime |
PROJECT_AUTH_REFRESH_TOKEN_TTL_DAYS | 30 | Refresh token lifetime |
PROJECT_AUTH_JWT_KEY_TTL_DAYS | 180 | Signing key lifetime |
PROJECT_AUTH_MAX_SESSIONS_PER_USER | 25 | Session cap per user |
PROJECT_AUTH_AUDIT_RETENTION_DAYS | 90 | Audit log retention |
Email verification defaults
| Variable | Default | Description |
|---|---|---|
PROJECT_AUTH_VERIFICATION_TOKEN_TTL_MINUTES | 60 | Verification token lifetime |
PROJECT_AUTH_VERIFICATION_RESEND_COOLDOWN_SECONDS | 60 | Resend cooldown |
PROJECT_AUTH_VERIFICATION_URL_BASE | APP_URL | Base URL for verification links |
PROJECT_AUTH_VERIFICATION_EMAIL_SUBJECT | Verify your email address | Email subject |
PROJECT_AUTH_VERIFICATION_EMAIL_HEADING | Verify your email address | Email heading |
PROJECT_AUTH_VERIFICATION_EMAIL_INTRO | Please verify your email address to continue. | Email intro |
PROJECT_AUTH_VERIFICATION_EMAIL_BUTTON_TEXT | Verify Email | Button label |
PROJECT_AUTH_VERIFICATION_EMAIL_OUTRO | If you did not create this account, you can safely ignore this email. | Email outro |
PROJECT_AUTH_VERIFICATION_EMAIL_FROM_NAME | MAIL_FROM_NAME | From name |
PROJECT_AUTH_VERIFICATION_EMAIL_FROM_EMAIL | MAIL_FROM_ADDRESS | From address |
Rate limits and lockout
| Variable | Default |
|---|---|
PROJECT_AUTH_SIGNUP_PER_MINUTE | 10 |
PROJECT_AUTH_SIGNIN_PER_MINUTE | 20 |
PROJECT_AUTH_REFRESH_PER_MINUTE | 120 |
PROJECT_AUTH_API_KEYS_PER_MINUTE | 30 |
PROJECT_AUTH_API_KEY_INTROSPECT_PER_MINUTE | 240 |
PROJECT_AUTH_VERIFICATION_RESEND_PER_MINUTE | 20 |
PROJECT_AUTH_VERIFICATION_CONFIRM_PER_MINUTE | 60 |
PROJECT_AUTH_MAX_FAILED_SIGNINS_BEFORE_LOCKOUT | 5 |
PROJECT_AUTH_SIGNIN_LOCKOUT_SECONDS | 300 |
Related docs
- Full env page: Environment Variables
- Dashboard controls: Dashboard settings
- Product overview: Authentication