Server settings
Advanced
Auth-code and invite expiry, the digest hour, media token lifetimes and server bot roles — plus the knobs that have no UI at all.
The catch-all tab: short-lived credentials, the daily digest schedule, signed-media lifetimes, and which bot account plays which server role.
Authentication codes
validateEmails booleanRequire users to confirm their email address before they can sign in.
resetPasswordCodeExpiryMinutes 1–1440How long a password-reset code stays valid after it’s issued.
emailChallengeExpiryMinutes 1–1440Same, for the one-time code in an email-confirmation challenge.
invitationExpiryHours 1–720 default 72How long an admin-issued account invitation stays usable.
Notifications
digestHour 0–23 (UTC)Hour of the day the daily email digest is dispatched — per-user opt-in, rendered in each recipient’s own language.
Media token lifetimes
Files are never served from a public bucket — every link is signed and expiring:
mediaTokenTtlSeconds secondsHow long signed URLs for attachments, avatars and logos remain valid.
communityEmojiTokenTtlSeconds secondsSame for custom emoji images — safely much longer, since emoji rarely change. Emoji URLs use bucketed signing so timelines full of :shortcodes: stay cacheable.
Longer TTL = browser caches work harder; shorter = a revoked member loses media access sooner. The size and format limits for the same files are on the Uploads tab.
Bot roles
Bot accounts (created in admin → Users) can hold server roles:
defaultBotIdThe server’s general-purpose bot identity, used for system messages when a role has no bot of its own.
welcomeBotIdPosts localized greetings in communities’ welcome channels.
autoModeratorBotIdIssues the automatic timeouts.
Unassigned roles fall back to the default bot; with no bots configured the related features quietly do nothing.
Settings with no UI
Two more groups exist in the registry but have no field on any tab.
HTTP cache
A built-in shared cache sits in front of read-heavy endpoints. Entries are
keyed per access context — private content never leaks across viewers —
and mutations purge affected pages immediately. Both TTLs are reachable
through PATCH /api/admin/server-config, but not from the admin panel:
httpCachePageTtlSeconds seconds default 0 = off API onlyMessage-history pages and other cached read surfaces. Short TTLs already absorb most read load.
httpCachePresenceTtlSeconds seconds default 0 = off API onlyPresence summaries — TTL-only (no purging); the client polls every 30s, so ~15s is a good value.
Webhooks
These three are not in the admin API either — set them directly in the settings store:
webhookMaxQueued integer default 1000 not in admin UICap on deliveries buffered while an endpoint is disabled. Once a disabled webhook has this many queued deliveries, new events are skipped — the buffer already collected is kept intact for replay, not rotated.
webhookLogRetentionDays days default 30 not in admin UIHow long delivery attempts stay inspectable in the admin panel.
webhookAllowInternalUrls boolean default false not in admin UISSRF guard, shared with web-push endpoints — enable only to deliberately target services on the server’s own network.