Configuration Schema · Issuary

The current config model is organized by top-level groups:

server
tokens
i18n
branding
registration
account_deletion
logging
security
database
auth
email
identity_providers
clients
users
terms
scheduler
cleanup
openapi

`branding`

Field	Type	Default	Description
`icon_url`	`string` (URL)	Official Issuary icon	App icon URL.
`logo_url`	`string` (URL)	-	Logo that replaces the icon and title.
`title`	`Record<string, string>`	Default localized title	Localized title keyed by language code.
`subtitle`	`Record<string, string>`	Default localized greeting	Login subtitle. An empty localized value hides it.
`login_method_description`	`Record<string, string>`	Default localized guidance	Login method guidance. An empty localized value hides it.

`registration`

Field	Type	Default	Description
`enabled`	`boolean`	`false`	Canonical self-registration switch. It gates password signup and first-time OAuth signup.
`allowed_email_patterns`	`string[]`	`[]`	Optional email filters checked only when `enabled` is `true`. If omitted or empty, signup is unrestricted.
`email_verification_required`	`boolean`	`true`	Requires email verification for password signups.
`signup_notice`	`Record<string, string>`	`{}`	Localized HTML-capable notice text for implicit consent terms.

`identity_providers`

Use an array to configure external OAuth providers. Omit the field or use [] when none are configured.

Field	Type	Description
`id`	`string`	Unique provider identifier.
`type`	`'github' \| 'google' \| 'apple' \| 'generic_oauth'`	Provider type.
`enabled`	`boolean`	Enables the provider.
`display_name`	`string`	Display label for the login button. Required for `generic_oauth`.
`icon_url`	`string`	Optional icon URL.
`client_id`	`string`	OAuth client ID.
`client_secret`	`string`	OAuth client secret.
`authorization_url`	`string`	Authorization endpoint for `generic_oauth`.
`token_url`	`string`	Token endpoint for `generic_oauth`.
`userinfo_url`	`string \| null`	Userinfo endpoint for `generic_oauth`.
`email_url`	`string`	Email endpoint when required by the provider.
`scopes`	`string[]`	Requested OAuth scopes.
`email_conflict_strategy`	`'auto_link' \| 'require_link'`	Handling for email collisions with existing accounts.

`terms`

Field	Type	Description
`id`	`string`	Unique identifier for the term.
`required`	`boolean`	Whether accepting the term is mandatory.
`consent_mode`	`'explicit' \| 'implicit'`	Consent collection mode.
`version`	`string`	Version string used for re-consent tracking.
`content`	`Record<string, { title, type, content }>`	Localized term content.

Within each localized content item, type must be link or text.

`openapi`

Field	Type	Default	Description
`enabled`	`boolean`	`true`	Enables the live OpenAPI routes `GET /api/docs` and `GET /api/docs/json`.
`title`	`string`	`'Issuary API'`	OpenAPI document title.
`description`	`string`	`'OpenID Connect Provider API'`	OpenAPI document description.
`ui_title`	`string`	`'Issuary API Reference'`	Browser page title for the live Scalar API reference UI.

`scheduler`

Field	Type	Default	Description
`enabled`	`boolean`	`true`	Enables the internal scheduler.
`mode`	`'croner' \| 'database'`	`'croner'`	Scheduler backend. Use `database` for multi-instance lease-based execution.
`cleanup_cron`	`string`	`'0 2 * * *'`	Cron expression for built-in cleanup jobs.
`poll_interval_ms`	`number`	`5000`	Database scheduler polling interval in milliseconds.
`lock_ttl_ms`	`number`	`60000`	Database scheduler lease TTL in milliseconds.
`background_retry_delay_ms`	`number`	`1000`	Database scheduler retry delay for failed background jobs in milliseconds.
`background_max_attempts`	`integer`	`3`	Database scheduler maximum attempts before a background job is marked failed.
`background_retention_ms`	`number`	`604800000`	Retention for terminal background jobs (`succeeded`/`failed`) in milliseconds. Pending/running jobs are not deleted by this cleanup.
`instance_id`	`string`	generated	Database scheduler lease owner id. Leave empty to generate a unique per-process id.

Field	Type	Behavior
`skip_consent`	`boolean`	Default `false`. Administratively preapprove registered scopes, including allowed offline access. `prompt=consent` still requests consent.