# API Maker Configuration > Every setting of an API Maker server - logs, databases, Redis, security, sandboxes, limits and uploads - set from the Deployment Settings page of the root user, a settings file, the .env file of each server, the environment or the command line. Export and import with sealed secrets. Source: https://docs.apimaker.dev/v4/docs/am-resources/api-maker-configurations.html A server of API Maker is one process. It reads its settings, the `am` block, from six layers when it starts : each one wins over the ones above it. 1. The defaults built into API Maker. 2. The `am` object of a settings file : `--settingsPath=`, else the `package.json` of the folder API Maker runs in. 3. The settings of the servers kept by the root user : the page **Settings → Deployment Settings** of the admin panel, kept in the main database. Every server of the installation reads the same values. 4. The `.env` file : `--envPath=`, else the `.env` of that folder. `--envPath` is an argument of the command line only : a `.env` file or the environment can not name another file. 5. The environment of the process. 6. The command line. | | | |---|---| | The page | **Settings → Deployment Settings**, for the root user alone : Logging, Databases, Redis, Security, API Access, Sandboxes, SSR websites, Requests and limits, and Uploads, then the servers, their environment and the history of the changes. | | When it applies | A setting of the servers (a setting with a path below, such as `sandbox.sandboxReqTimeout`) applies when each server starts again : the page says which values wait for a restart, and restarts the servers. The other settings of the page (the database of the logs, the Redis of the cache, the tokens of your APIs...) apply at once. | | What wins | A value of a server's `.env` file, environment or command line wins over the page : the installer writes the address, ports, database and secrets of each server in its `.env`. The page shows on which servers its value is not taken. | | Each server | The settings of [each server](https://docs.apimaker.dev/v4/docs/am-resources/api-maker-configurations.html#server) (its port, its address, its main database, the secret of the encrypted values...) are only read from its `.env` file, its environment or its command line : a server needs them before it reads its database. | | Override by name | A setting is named by its path : `am__port=48246` in `.env` or the environment, `--am.port=48246` on the command line. Levels join with `__` or `.` : `am__jwtOptions__issuer=AM_JWT`. `BE_HOST_PORT` and `logFilePath` are read without the prefix too. | | Values | Text which starts with `{` or `[` is read as JSON5, a number as a number, everything else as text : `am__redisInternal__nodes=[{"host":"127.0.0.1","port":6379}]`. An empty value overrides nothing. | | Required | `mongo_db_connection`, `passCommunication`, `passJWT`, `passDBEncryptDecrypt`, `redisInternal.nodes`. A missing or wrong value stops the start with one line per problem. | | Encrypted values | A connection string of MongoDB or of Redis, or a password of Redis, may stand encrypted in the `.env` file : the page **Security → Encrypt Strings** of the admin panel writes such a value. This hides the value (in the file, in a terminal, on a shared screen), it does not protect it : every copy of API Maker holds the key which reads it, so whoever has the program and the file reads the value. Protect the file itself (`chmod 600`, owned by the user of the service), or give the values as environment variables from the secret store of your platform. | | Log | `AM_LOG` sets what the process writes to its log : `info` by default, `debug`, or a filter per part of API Maker (`info,am_sandbox=debug`). It is read from the environment of the process only, before anything else. | ## The Deployment Settings page 1. **Find a setting** The links at the top of the page go to each card. The help of a setting shows when the pointer is on its name : what it does, its default, its limits, its unit and its variable of the `.env` file. 2. **Change it** A change which is not saved is marked on its row and in the bar at the top, with what was saved and **undo**. **default** leaves a setting of the servers to the layers of each server again. 3. **Save** **Save** (or Ctrl+S) lists every change of the settings of the servers, and asks every server what it would do with it : applied after a restart, or not taken because the server's own `.env`, environment or command line names it. A change a server could not start with is not saved. 4. **Restart** Saved values of the servers apply when a server starts. The page counts the values which wait for a restart, and restarts one server or all of them. Under each setting of the servers, the page shows what each server runs with, and where that value comes from : the default, the settings file, the page, the `.env` file, the environment or the command line. The **Servers** card shows each server, its folder, its `.env` file and its settings file; **Server environment** shows the [variables](https://docs.apimaker.dev/v4/docs/am-resources/api-maker-configurations.html#process-environment) each server has, without changing them. A value of the page which a server can not start with never keeps it down : such a server starts with its files and its environment only, says why in its log, and the page shows it in red until the values are set right and saved. The page keeps the last 50 changes of the settings of the servers : who saved them, when, and each value before and after. A secret is written `••••••` there, never its value. ## Export and import **Export** writes the saved values of the settings of the servers into a JSON file, to keep them or to set up another installation. **Import** reads such a file back into the page. - A value which is no secret is written as it is. The secrets are sealed with a password asked when the file is made : PBKDF2-HMAC-SHA256 with 600,000 rounds and a random salt makes the key, AES-256-GCM seals the secrets. Without that password nobody reads them, API Maker neither. - Import asks for the same password when the file has secrets. A wrong password is refused; a setting this version of API Maker does not know is left out and named. - Nothing is saved by an import : its values come into the page as changes to review. **Keep their values** changes only the settings of the file; **Go back to their defaults** also clears the settings the file does not have. **api-maker-server-configuration-2026-10-12.json** ```json { "format": "api-maker-server-configuration", "version": 1, "exportedAt": "2026-10-12T09:35:50.309Z", "apiMakerVersion": "4.0.0", "settings": { "sandbox.sandboxReqTimeout": 20000, "bodyLimit": 1048576 }, "secrets": { "paths": ["passJWT"], "sealed": { "kdf": "PBKDF2-HMAC-SHA256", "iterations": 600000, "salt": "…", "cipher": "AES-256-GCM", "nonce": "…", "data": "…" } } } ``` ## Settings Every setting of the page, by card. A setting with a path is a setting of the servers : its Default is what applies when no layer names it. A setting without a path is kept with the other deployment settings and applies at once. ### Logging The logs of the calls of your APIs, where they are kept and their clean up. | Setting | Default | What it does | |---|---|---| | Log DB Connection String
secret | none | The MongoDB database the logs of the calls go to. Empty : `logs.mongo_db_connection_logs` of the `.env` file of each server; without either, calls are not logged. | | Log Remove CRON | `logs.logRemoveSchedulerInterval` of the `.env` file : `0 0 0 * * *` | When old logs are removed : a cron expression of six fields, the first one being the seconds. | | Max Logs Count | `logs.maxLogsCount` of the `.env` file : `100,000` logs | The logs each account keeps : older ones are removed each time the clock above ticks. | | `logs.enableLogs`
Log the calls | `true` | Whether calls are logged, as the log profile of each account says. Off : no call is logged. | | `cron_job_time_zone`
Time zone of the log clean up | the zone of the server | The time zone the clock which removes old logs reads its cron expression in. Your schedulers have a zone each. | ### Databases How API Maker reaches the databases of your instances. | Setting | Default | What it does | |---|---|---| | `oracleClientPath`
Oracle Instant Client | none | The folder of the Oracle Instant Client, which the instances of Oracle are reached with. LD_LIBRARY_PATH, when the process has it, is taken instead. Also read as `LD_LIBRARY_PATH`. | ### Redis The Redis of the cached answers of your APIs and of the keys your code keeps, and what API Maker keeps on its own Redis. | Setting | Default | What it does | |---|---|---| | Redis for Cache & Code
secret | none | The Redis the cached answers of your APIs and the keys your code sets (`g.sys.cache`) are kept on : its host, its port and its password. Named here, it wins over `redisExternal` of the `.env` file of each server; no node here : the one of each server, if it names one, else nothing is cached. One node : API Maker caches nothing on a cluster of several nodes. Servers and sandboxes take a change at once. | | Cached Answers Kept For | `7200` seconds | Every cached answer expires after this many seconds. | | Longest Cached Answer | `1,000,000` characters | An answer longer than this many characters is not cached. | | `redisInternal.maxCharsToStoreInConsoleLogs`
Console kept per account | `15,000,000` characters | What the code of an account prints is kept on the Redis of API Maker, for its console, up to this many characters : then it is emptied. 0 : 15,000,000. | ### Security In two parts : what protects API Maker itself, and what the APIs of your accounts use. #### API Maker The security of API Maker itself : the sign in to its admin panel, and the secrets of the installation, the same on every server. | Setting | Default | What it does | |---|---|---| | Universal Login Captcha | none | A captcha value every sign in to the admin panel accepts : for automated sign ins of your own. Empty : the captcha drawn on the page only. | | `passCommunication`
Communication secret · secret · required | none | The secret of the values the admin panel and API Maker exchange outside the encrypted channel of the panel : passwords and code sent by an older panel, by the API of Operate API Maker using API, and by a git pull. Required, the same on every server. | | `passJWT`
Secret of the admin panel's tokens · secret · required | none | The secret the tokens of the people of the admin panel are signed with, and the key of the tickets of its encrypted channel. Required, the same on every server. A new value signs everybody out of the admin panel. | | `nodeJsCompatibleTokens`
Tokens a Node.js backend reads | off | On while a Node.js backend of API Maker (version 3) still answers requests of this installation next to this one : the tokens of the admin panel then say the password of their person as the database keeps it, which is what that backend compares. Off, they say a keyed hash of it, and nobody who holds a token learns anything of the password. Tokens of either kind are taken. Leave it off unless a Node.js backend shares the installation : a token is read by whoever holds it. | | `sealedSecrets`
Sealed secrets in the database | off | On : what API Maker encrypts for its own database with `passDBEncryptDecrypt` (the passwords of the people and of the API users, the secrets and their code, the second factors, git addresses with their credentials, the secrets of the deployment settings) is written sealed : AES-256-GCM with a key derived from that secret, so a value which was changed in the database is refused where it would be read as something else. Off : written as the Node.js backend writes it. Both are read, whatever this says, and a value is written anew when it is saved the next time. A Node.js backend does not read sealed values : turn it on once no Node.js backend shares the installation. People, and the tokens of API users, sign in once more after their password was saved sealed for the first time. | #### Your APIs The tokens API Maker signs for the users of your APIs and of your databases, and the encrypted data your apps send. The tokens of the admin panel are made the same way. | Setting | Default | What it does | |---|---|---| | Secret of the API Users' Tokens
secret | made when the settings of the root user are made | Signs the tokens of the API users and of the users of your databases. A new value signs out every user of your apps. | | API User's Token Across Admin Users | off | Accepts the `x-am-authorization` token of an API user, and the `x-am-user-authorization` token of a user of a database, in other admin user accounts, but only where a user with the same username and password exists there. Off keeps every token to the admin user that issued it. | | Tokens Expire After | `259200` seconds | How long the tokens of the API users and of the users of your databases are valid, and the tokens of the admin panel too : 259200 is 3 days. From 60 to 103680000. Empty : `jwtOptions.expiresIn` of the `.env` file, 259,200 by default. | | `refreshTokenValidForS`
Refresh token extra lifetime | `900` seconds | A refresh token stays valid this many seconds longer than the token it came with. | | `jwtOptions.issuer`
Token issuer | `AM_JWT` | Written into every token API Maker signs (the admin panel and the API users), and checked when a token is read. Empty : none. | | `jwtOptions.algorithm`
Token algorithm | HS256 | The HMAC the tokens are signed with. One of `HS256`, `HS384`, `HS512`. | | `jwtOptions.audience`
Token audience | none | Written into every token API Maker signs (aud), and checked when a token is read : a token signed for another audience is refused. One value or several. | | `jwtOptions.subject`
Token subject | none | Written into every token API Maker signs (sub), and checked when a token is read. | | `jwtOptions.keyid`
Token key id | none | The kid of the header of every token API Maker signs. | | `feTransferDataValidityInSecondsDefault`
Encrypted payloads valid for | `15` seconds | Seconds encrypted data sent by a web or mobile app stays valid, when the secret of the account sets no feTransferDataValidityInSeconds. | ### API Access | Setting | Default | What it does | |---|---|---| | Operate API Maker Using API | off | Lets your scripts operate API Maker through its API : see [Operate API Maker using API](https://docs.apimaker.dev/v4/docs/am-resources/operate-api-maker-using-api.html). | | Communication Token
secret | none | Authenticates the calls of that API. At least 48 characters. | ### Sandboxes Where the code of the accounts runs : its time and its memory. The sandbox count of each account is in its [Sandbox settings](https://docs.apimaker.dev/v4/docs/settings/sandboxSettings.html), and a sandbox opens as many runners of a language as the machine has [cores](https://docs.apimaker.dev/v4/docs/am-resources/api-maker-configurations.html#one-process). | Setting | Default | What it does | |---|---|---| | `sandbox.sandboxReqTimeout`
Code timeout | `13000` milliseconds | Milliseconds a run of code may take when the item it belongs to names no time of its own ([time of a run](https://docs.apimaker.dev/v4/docs/settings/sandboxSettings.html#time-of-a-run)). The header x-am-sandbox-timeout changes it for one request. At least 1. | | `sandbox.removeSandboxInactiveSinceMinutes`
Idle sandboxes stop after | `5` minutes | A sandbox nothing used for this many minutes is stopped; the next request starts it again. Fractions are allowed, half a minute at the least. | | `sandbox.sandboxMaxOldSpaceMB`
Heap of a Node.js runner | the memory of the machine ÷ its cores, at least 2500 | The heap of a runner of Node.js in a sandbox (--max-old-space-size). Empty or 0 : the memory of the machine divided by its cores, at least 2500. | | `sandbox.codeInServer`
Code in the server | on | Code in TypeScript which needs nothing of a sandbox (a hook which only reads and changes its request) runs inside API Maker. Off : every piece of code runs in its sandbox. | ### SSR websites The [SSR websites](https://docs.apimaker.dev/v4/docs/ssr/index.html) your accounts write in TSX are rendered by API Maker itself : threads of their own, each with an engine (QuickJS) per website it renders. A website can ask for less or more in its `site.config.ts` (`limits`). | Setting | Default | What it does | |---|---|---| | `ssr.threads`
Render threads | one per core | Threads which render the pages of the websites, each with the engines of the websites it renders. 0 : one per core of the machine. From 0 to 256. | | `ssr.memoryMb`
Memory of a website | `64` MB | The memory of the engine of one website on one render thread. A page which takes more fails alone, and its engine is made anew. From 8 to 4096. | | `ssr.cpuMs`
Time of the code of a page | `2000` milliseconds | The time the code of one render may run. The waits for the databases and the APIs do not count. From 10 to 600000. | | `ssr.timeoutMs`
Time of a page | `30000` milliseconds | The time one render may take in all, the waits for the databases and the APIs counted. From 100 to 3600000. | | `ssr.cacheMb`
Cache of the pages | `64` MB | The memory of the answers of pages each server keeps (the pages which say `config.cache`). 0 : none is kept. From 0 to 65536. | | `ssr.enginesPerThread`
Engines per thread | `64` | The engines of websites one render thread keeps : the one used longest ago goes for a new one. From 1 to 10000. | ### Requests and limits Sizes, counts and caches of the requests a server answers. | Setting | Default | What it does | |---|---|---| | `bodyLimit`
Largest request body | `16,777,216` bytes | A body is kept in memory while its request is answered (JSON, a text, a form without files) : a request whose body is longer is refused before it is read. Files are sent in a form, which has a limit of its own (`uploadLimit`). 0 : 536,870,912 (512 MiB), what the Node.js backend takes. Where the setting is not given, the Node.js backend takes 512 MiB and this server 16 MiB : give it where the APIs are sent more in one body. | | `uploadLimit`
Largest form with files | `536,870,912` bytes | The longest form of several parts (multipart) a request may send. Its files are written to the folder of the uploads while they arrive, never kept in memory. 0 : 536,870,912 (512 MiB). | | `uploadMaxFiles`
Most files of a form | `1000` files | A form with more files is refused, and what it wrote is removed. 0 : 1,000. | | `bodyMemoryLimit`
Memory of all request bodies | `1,073,741,824` bytes | The memory the bodies which are read at the same time may take together. A body which finds none waits for the others, then is answered 503. Never less than the largest body one request may send (`bodyLimit`, `uploadLimit`). 0 : no limit. | | `maxConnections`
Most open connections | `0` connections | The most connections a server holds open at the same time, the web sockets among them : one more waits until one closes. 0 : as many as the process may have open files (`ulimit -n`), less what it keeps for its own files and databases. The web sockets take no more than their share of them : a sixteenth of the connections (64 at the least, 4,096 at the most) is kept for the calls of the APIs, and one more WebSocket client is answered `503` with `Retry-After`. | | `tcpMemoryPercent`
Memory of the network, at most | `25` % of the memory | Linux gives all its TCP connections together a part of the memory of the machine (`net.ipv4.tcp_mem`, about 9 % as it sets it up), and slows every one of them down past it : the ones to the databases and to Redis too. A server which holds tens of thousands of connections raises that part as they come, two pages for each connection, never above this share of the memory, and never lowers it ; a server with fewer connections than the kernel has room for writes nothing. It says so in its log, and when it may not (it is not root, or runs in a container) it says the line to run by hand. 0 : the kernel is left as it is. See [many clients](https://docs.apimaker.dev/v4/docs/pages/web-socket-event-page.html#many-clients). | | `compressThreshold`
Compress answers from | `51200` bytes | Answers longer than this many bytes are compressed, when the client accepts it. | | `maximum_test_user_count`
Test users read | `1000` users | The most test users read from a table when its schema gives no count : the tokens the API Testing page and the test cases sign in with. | | `dbTokenCache.ttlSeconds`
Database token users kept for | `60` seconds | How long the person behind a database token is trusted without reading the table again. 0 : the table is read on every call. | | `dbTokenCache.maxEntries`
Database token users kept | `100,000` users | The most people behind database tokens a server keeps in memory. At least 1. | ### Uploads The clean up of the files sent to your APIs. | Setting | Default | What it does | |---|---|---| | `uploadedFileCleaningSchedulerCron`
Uploads cleaned at | `0 */30 * * * *` | When each server removes old uploaded files from its uploads folder : a cron expression of six fields, the first one being the seconds. | | `uploadedFileRemoveOlderThanThisTimeInSeconds`
Uploads kept for | `1800` seconds | Uploaded files older than this are removed when the clock above ticks. From 60 to 864000 (10 days). | ## One process, every core A server is one process of API Maker, with as many threads as its machine has cores : every request, web socket and job of the server is shared between them. A sandbox opens one runner of a language, and one more while all of its runners are busy, up to as many as the machine has cores. Neither is a setting. ## The settings of each server Set in the `.env` file of each server (the installer writes them there), its environment or its command line. The page does not show them : a server reads them before it reads its database. | Setting | Default | What it does | |---|---|---| | `port`
Port | `48246` | The port of the APIs and of the web sockets of the server : one port for both. It also tells the servers of one machine apart : their containers and folders of sandboxes are named after it. The installer writes 38246. Change `BE_HOST_PORT` with it. From 1 to 65535. | | `BE_HOST_PORT`
Public address | `http://__ip_address__:48246` | Where the admin panel and the URLs API Maker prints reach the server. `__ip_address__` is replaced by the host the browser opened the admin panel with. Behind a proxy : `https://api.example.com`. The web sockets are on the same address : `ws://` for `http://`, `wss://` for `https://`. | | `serverName`
Server name | `server1` | The name of the server on the dashboard, in the Server column of the Schedulers page, in the details of a git pull and in the runs of test cases. | | `logFilePath`
Log file | none | The file the log of the process goes to : the service the installer makes appends the output of API Maker to it. The dashboard shows, downloads and empties this file. | | `adminPanel.folder`
Admin panel | none : no admin panel on this server | The folder of the built admin panel. API Maker serves its files on the port below, and writes `BE_HOST_PORT` and its version into them as it sends them. | | `adminPanel.port`
Port of the admin panel | `4626` | The port the admin panel is served on, when the folder above is set. Behind Caddy, the panel is on port 80 or on its domain. | | `mongo_db_connection`
MongoDB of API Maker · secret · required | none | The MongoDB database which holds API Maker's own data : accounts, schemas, code, settings. A replica set. | | `passDBEncryptDecrypt`
Encryption secret of the data · secret · required | none | The secret of every value API Maker keeps encrypted, in MongoDB and in Git : 32 characters. The same on every server, and in every installation which shares a Git repository. The secrets of the Deployment Settings page are encrypted with it. | | `sandbox.sandboxCountForAdmin`
Sandboxes per account | `2` sandboxes | The sandboxes of one language an account has at most on each server, unless its Sandbox settings say otherwise. From 1 to 5. | ## Variables of the process Read before a server reaches its database. The **Server environment** card of the page shows the variables of the `.env` file and the environment, and what each server has. | Variable | Default | What it does | |---|---|---| | `uniqueServerId`
Server id | the name of the machine and the port : machine:48246 | What tells this server from the others of the installation, the same after a restart. Servers which share a .env file are told apart by their machine and port when it is not set. | | `LD_LIBRARY_PATH`
Library path | not set | When set, it is the folder of the Oracle Instant Client (oracleClientPath). | | `AM_SANDBOX_HOST`
Sandboxes on the machine | not set | local : the sandboxes are processes of the machine instead of Docker containers. The runtimes of every language have to be installed, and nothing keeps the code of an account apart from the machine : for development and for a machine of one account. | | `AM_SANDBOX_UNIX`
Sockets of the sandboxes | not set | 0 : the sandboxes are reached by their ports only. The absolute path of a folder : the Unix sockets of the sandboxes are made there (for a server in a container which has that folder of the machine at the same path). | | `AM_SANDBOX_DIRECT`
Sandboxes on their ports | not set | 0 : every sandbox is reached on its published port, without a Unix socket. | | `AM_SANDBOX_CORE`, `--sandboxCore`
Core of the agents | not set | The library of API Maker the agents of the sandboxes load, or the folder of those libraries. Unset : next to the program of API Maker, as the releases deliver it. On macOS and Windows the `api-maker` command and API Maker Launchpad set it to the sandbox package of the processor (`@sava-info-systems/api-maker-engine-sandbox-linux-x64` or `-arm64`). | | `AM_SANDBOX_CORE_ANY`
Core of another build | not set | Set (and not 0) : the agents use a core of another build than the one of the server. For who builds the two apart and knows that they match. | | `AM_NATIVE_CORE`, `--nativeCore`
Core of the native process | not set | The library of API Maker the runners of the native process load (code with `runOnNativeProcess: true`), built for the machine of the server, or the folder of those libraries. Unset : the libraries of the sandboxes when they are built for this machine (a release on Linux), else the ones cargo built next to the program of API Maker (a debug build of the program takes an optimized build of them first : `target/fast`, `target/release`). | | `AM_SANDBOX_AGENT`, `--sandboxAgent`
Agent of the sandboxes | not set | The program put into the containers of the sandboxes : the launcher `am_agent`. Unset : the one next to the program of API Maker, else one built inside Docker once. A program which is not the launcher (the server `api_maker_be`, an agent library) is refused with a warning, and the next of these places is taken. On macOS and Windows the `api-maker` command and API Maker Launchpad name the `am_agent` of the sandbox package. | | `AM_SANDBOX_AGENT_BUILDER`
Image the agent is built in | rust:1-alpine | The image of Docker the agent of the sandboxes is compiled in, when it has to be built. | | `AM_TOOLS_PROGRAM`, `--toolsProgram`
Program of the tools | not set | The program `am_tools` : the compiler of TypeScript and its declarations, the reader of code (whether code can run inside API Maker is found when it is saved, what the hooks of the security report do), quicktype, postman, the audit of packages and the encoders of images, which API Maker starts when code is saved or a page asks for one, and which ends when nothing asked for a while. Unset : the one next to the program of API Maker, as the releases deliver it. | | `AM_TOOLS_IDLE_SECONDS`
Idle time of the tools | 30, and 300 once it loaded the compiler of TypeScript or a library | `am_tools` ends when nothing was asked of it for this many seconds, and what its compilers and libraries took goes back to the system ; the next save starts it again. Unset : 30 seconds, and 300 once it loaded what takes seconds to load (the compiler of TypeScript of the declarations, quicktype, postman, the audit). | | `AM_LOCAL_RUN_TOKEN`
Token of Launchpad | not set | Enables the API of API Maker Launchpad when it has at least 24 characters : the app sets it when it starts API Maker on a computer. | Arguments of the command line : | Argument | Default | What it does | |---|---|---| | `--appRoot`
Folder of API Maker | the folder API Maker is started in | The folder API Maker runs in : its package.json, its .env file, uploads and license file. | | `--envPath`
.env file | .env of the folder of API Maker | The .env file to read. A file named here must exist; the default one may be missing. Only the command line names it. | | `--settingsPath`
Settings file | package.json of the folder of API Maker | A file whose am object, or the whole file when it has none, is the lowest layer of the settings after the built-in defaults. | | `--ACCESS_TOKEN`
Access token of tests | not set | A value of the authorization header accepted without any check, as the installation itself. For tests and development only : never on a server people use. | ## Removed settings Older `.env` files and settings files may name these. A server starts with them, and does nothing with them. | Setting | Now | |---|---| | `BE_WS_HOST_PORT` | The web sockets are on the port of the APIs : the admin panel reaches them at the address of `BE_HOST_PORT`, with `ws://` or `wss://`. | | `workerThreads` | The threads of a server are the [cores](https://docs.apimaker.dev/v4/docs/am-resources/api-maker-configurations.html#one-process) of its machine. | | `cpuCount` | A sandbox opens up to as many runners of a language as the machine has [cores](https://docs.apimaker.dev/v4/docs/am-resources/api-maker-configurations.html#one-process). | | `docker.socketPath`, `docker.host`, `docker.port`, `docker.protocol` | API Maker reaches Docker where the system has it : `/var/run/docker.sock` on Linux; on macOS that socket, else the one of Docker Desktop, Colima, OrbStack or Rancher Desktop in the home folder; the named pipe of Docker Desktop on Windows. | | `db.mongo.max_rows_return` | A read of MongoDB returns as many rows as the request asks for, up to 100,000,000,000,000. | | `ACCESS_TOKEN` in `.env` or the environment | Read from the command line only : `--ACCESS_TOKEN`. | | `envPath` in `.env`, the environment or the `am` block | The `.env` file is named on the command line only : `--envPath`. | | `PGSSLMODE`, `PGSSLNEGOTIATION` | The connection string of a PostgreSQL instance says whether it uses TLS (`sslmode`, `sslnegotiation`). | | `RUST_BACKTRACE` | Every panic writes its backtrace in the log. | | `processTitle`, `integrity`, `wsPort` | Not used. | | `debugging.portStart`, `debugging.portEnd` | Not used. | | `redisInternal.otherRedisClusterOptions`, `redisExternal.otherRedisClusterOptions` | Not used. | | `db.common.start_with_test_data`, `db.mongo.default_id` | Not used. | | Server Startup Script (deployment settings) | Not used. | ## A `.env` file **.env** ```bash BE_HOST_PORT=https://api.example.com am__serverName=api-1 am__port=38246 am__mongo_db_connection=mongodb://…/api_maker?replicaSet=rs0 am__redisInternal__nodes=[{"host":"127.0.0.1","port":6379}] am__passCommunication=… am__passJWT=… am__passDBEncryptDecrypt=… ``` A cluster is several servers, each with its process, behind a reverse proxy. They share MongoDB and Redis : [schedulers](https://docs.apimaker.dev/v4/docs/apis-all/schedulers/user-created-schedulers-api.html) are spread over them and run once per tick, a change saved on one server reaches the others at once, and they all read the same Deployment Settings. The three secrets must be the same on every server of an environment, and `passDBEncryptDecrypt` the same in every environment which shares a Git repository : values encrypted with one can not be read with another. ## Related - [Server dashboard](https://docs.apimaker.dev/v4/docs/logs/logs-and-dashboards.html#servers) · [How API Maker works](https://docs.apimaker.dev/v4/docs/getting-started/how-it-works.html) · [Sandbox settings](https://docs.apimaker.dev/v4/docs/settings/sandboxSettings.html) · [Operate API Maker using API](https://docs.apimaker.dev/v4/docs/am-resources/operate-api-maker-using-api.html) · [Install on a server](https://docs.apimaker.dev/v4/docs/getting-started/install-on-server.html) · [Deploy API Maker](https://docs.apimaker.dev/v4/docs/features/deploy-api-maker.html)