# Framework Settings Reference

This reference lists framework-recognized setting keys (names only, no values).

## Startup/Bootstrap Keys (Restart Required)

These are read while URL/module bootstrap happens, so changes require a process restart.

- `MOJO_API_MODULE`
- `MOJO_APPEND_SLASH`
- `MOJO_PREFIX`
- `REST_AUTO_PREFIX`

## Runtime Keys

These are read through `mojo.helpers.settings.settings` during normal runtime.

### ALLOW

- `ALLOW_EMAIL_CHANGE`
- `ALLOW_PHONE_CHANGE`
- `ALLOW_PHONE_LOGIN`
- `ALLOW_SELF_DEACTIVATION`
- `ALLOW_USER_REGISTRATION`
- `ALLOW_USERNAME_CHANGE`

### ALLOWED

- `ALLOWED_REDIRECT_URLS`

### API

- `API_METRICS`
- `API_METRICS_GRANULARITY`

### APPLE

- `APPLE_CLIENT_ID`
- `APPLE_KEY_ID`
- `APPLE_PRIVATE_KEY`
- `APPLE_TEAM_ID`

### AUTH

- `AUTH_BEARER_HANDLERS`
- `AUTH_BEARER_NAME_MAP`

### AWS

- `AWS_DEFAULT_REGION`
- `AWS_KEY`
- `AWS_REGION`
- `AWS_SECRET`

### BASE

- `BASE_URL`

### DEACTIVATE

- `DEACTIVATE_TOKEN_TTL`

### DUID

- `DUID_HEADER`

### EMAIL

- `EMAIL_CHANGE_CODE_TTL`
- `EMAIL_CHANGE_TOKEN_TTL`
- `EMAIL_TASK_CHANNEL`
- `EMAIL_VERIFY_CODE_TTL`
- `EMAIL_VERIFY_TOKEN_TTL`

### EVENTS

- `EVENTS_ON_ERRORS`

### GEOIP

- `GEOIP_ADDITIONAL_PROVIDERS`
- `GEOIP_API_KEY_IP-API`
- `GEOIP_API_KEY_IPINFO`
- `GEOIP_API_KEY_IPSTACK`
- `GEOIP_ENABLE_CLOUD_DETECTION`
- `GEOIP_ENABLE_TOR_DETECTION`
- `GEOIP_ENABLE_VPN_DETECTION`
- `GEOIP_FALLBACK_PROVIDER`
- `GEOIP_PRIMARY_PROVIDER`

### GEOLOCATION

- `GEOLOCATION_ALLOW_SUBNET_LOOKUP`
- `GEOLOCATION_CACHE_DURATION_DAYS`
- `GEOLOCATION_DEVICE_LOCATION_AGE`
- `GEOLOCATION_ENABLE_BLOCKLIST_CHECK`
- `GEOLOCATION_ENABLE_INTERNAL_THREAT_CHECK`
- `GEOLOCATION_INTERNAL_ATTACKER_LEVEL_THRESHOLD`
- `GEOLOCATION_INTERNAL_THREAT_EVENT_THRESHOLD`
- `GEOLOCATION_INTERNAL_THREAT_LOOKBACK_DAYS`

### GOOGLE

- `GOOGLE_CLIENT_ID`
- `GOOGLE_CLIENT_SECRET`
- `GOOGLE_MAPS_API_KEY`
- `GOOGLE_SCOPES`
- `GOOGLE_SERVICE_ACCOUNT_FILE`

### GROUP

- `GROUP_LAST_ACTIVITY_FREQ`

### INCIDENT

- `INCIDENT_EVENT_METRICS`
- `INCIDENT_EVENT_PRUNE_DAYS`
- `INCIDENT_LEVEL_THRESHOLD`
- `INCIDENT_METRICS_MIN_GRANULARITY`

### INFO

- `INFO_KEY`

### INSTALLED

- `INSTALLED_APPS`

### INVITE

- `INVITE_TOKEN_TTL`

### IPVERIFY

- `IPVERIFY_API_KEY`
- `IPVERIFY_HOST`

### JOBS

- `JOBS_CHANNELS`
- `JOBS_DAEMON_WORKDIR`
- `JOBS_DEBUG`
- `JOBS_DEFAULT_BACKOFF_BASE`
- `JOBS_DEFAULT_BACKOFF_MAX`
- `JOBS_DEFAULT_CHANNEL`
- `JOBS_DEFAULT_EXPIRES_SEC`
- `JOBS_DEFAULT_MAX_RETRIES`
- `JOBS_ENGINE_CLAIM_BATCH`
- `JOBS_ENGINE_CLAIM_BUFFER`
- `JOBS_ENGINE_LOGFILE`
- `JOBS_ENGINE_MAX_WORKERS`
- `JOBS_ENGINE_READ_TIMEOUT`
- `JOBS_IDLE_TIMEOUT_MS`
- `JOBS_LOCAL_QUEUE_MAXSIZE`
- `JOBS_PAYLOAD_MAX_BYTES`
- `JOBS_REDIS_PREFIX`
- `JOBS_REDIS_URL`
- `JOBS_RUNNER_HEARTBEAT_SEC`
- `JOBS_SCHEDULER_LOCK_TTL_MS`
- `JOBS_SCHEDULER_LOGFILE`
- `JOBS_STREAM_MAXLEN`
- `JOBS_VISIBILITY_TIMEOUT_MS`
- `JOBS_WEBHOOK_DEFAULT_TIMEOUT`
- `JOBS_WEBHOOK_MAX_RETRIES`
- `JOBS_WEBHOOK_MAX_TIMEOUT`
- `JOBS_XPENDING_IDLE_MS`

### JWT

- `JWT_ALGORITHM`
- `JWT_REFRESH_TOKEN_EXPIRY`
- `JWT_TOKEN_EXPIRY`

### KMS

- `KMS_KEY_ID`

### LOG

- `LOG_PUSH_MESSAGES`

### LOGIT

- `LOGIT_ALWAYS_LOG_PREFIX`
- `LOGIT_DB_ALL`
- `LOGIT_DEBUG_ALL`
- `LOGIT_FILE_ALL`
- `LOGIT_MAX_RESPONSE_SIZE`
- `LOGIT_NO_LOG_PREFIX`
- `LOGIT_PRUNE_DAYS`
- `LOGIT_REQUEST_BODY`
- `LOGIT_RETURN_REAL_ERROR`

### MAGIC

- `MAGIC_LOGIN_TOKEN_TTL`

### MAXMIND

- `MAXMIND_ACCOUNT_ID`
- `MAXMIND_LICENSE_KEY`

### MEDIA

- `MEDIA_HOST`
- `MEDIA_URL`

### MEMBER

- `MEMBER_PERMS_PROTECTION`

### METRICS

- `METRICS_DEFAULT_MAX_GRANULARITY`
- `METRICS_DEFAULT_MIN_GRANULARITY`
- `METRICS_TIMEZONE`
- `METRICS_TRACK_USER_ACTIVITY`

### MFA

- `MFA_TOKEN_TTL`

### MISC

- `DEBUG`
- `VERSION`

### MOJO

- `MOJO_APP_STATUS_200_ON_ERROR`
- `MOJO_CUSTOM_SERIALIZERS`
- `MOJO_DEFAULT_SERIALIZER`
- `MOJO_REST_LIST_PERM_DENY`
- `MOJO_SERIALIZER_CACHE`
- `MOJO_TEMP_DIR`

### NOTIFICATION

- `NOTIFICATION_DEFAULT_EXPIRY`

### OAUTH

- `OAUTH_ALLOW_REGISTRATION`
- `OAUTH_REDIRECT_URI`
- `OAUTH_STATE_TTL`

### OPENAPI

- `OPENAPI_DOCS_KEY`

### PASSKEYS

- `PASSKEYS_RP_NAME`

### PASSWORD

- `PASSWORD_RESET_CODE_TTL`
- `PASSWORD_RESET_TOKEN_TTL`

### PHONE

- `PHONE_CHANGE_TOKEN_TTL`
- `PHONE_VERIFY_CODE_TTL`

### REDIS

- `REDIS_CONNECT_TIMEOUT`
- `REDIS_DB_INDEX`
- `REDIS_MAX_CONN`
- `REDIS_PASSWORD`
- `REDIS_PORT`
- `REDIS_READ_FROM_REPLICAS`
- `REDIS_SCHEME`
- `REDIS_SERVER`
- `REDIS_SOCKET_TIMEOUT`
- `REDIS_URL`
- `REDIS_USERNAME`

### REQUIRE

- `REQUIRE_VERIFIED_EMAIL`
- `REQUIRE_VERIFIED_PHONE`

### REQUIRES

- `REQUIRES_PERMS_IS_GROUP`

### SECRET

- `SECRET_KEY`

### SERIALIZE

- `SERIALIZE_DATETIME_TO_FLOAT`

### SHORTLINK

- `SHORTLINK_BASE_URL`
- `SHORTLINK_FALLBACK_URL`

### SMS

- `SMS_FAKE_MAPPINGS`
- `SMS_INBOUND_HANDLER`
- `SMS_OTP_TTL`

### SNS

- `SNS_CERT_TTL_SECONDS`
- `SNS_VALIDATION_BYPASS_DEBUG`

### THREAT

- `THREAT_INTEL_ABUSEIPDB_API_KEY`
- `THREAT_INTEL_ABUSEIPDB_ENABLED`
- `THREAT_INTEL_BLOCKLIST_DE_ENABLED`
- `THREAT_INTEL_SPAMHAUS_ENABLED`

### TOR

- `TOR_EXIT_NODE_LIST_URL`

### TOTP

- `TOTP_ISSUER`

### TWILIO

- `TWILIO_ACCOUNT_SID`
- `TWILIO_AUTH_TOKEN`
- `TWILIO_NUMBER`

### USE

- `USE_TZ`

### USER

- `USER_LAST_ACTIVITY_FREQ`
- `USER_PERMS_PROTECTION`

### USPS

- `USPS_CLIENT_ID`
- `USPS_CLIENT_SECRET`
- `USPS_USE_TEST_ENVIRONMENT`

### WEBAPP

- `WEBAPP_AUTH_PATH`
- `WEBAPP_BASE_URL`

## Notes

- Source: static scan of `settings.get(...)`, `getattr(settings, ...)`, and `settings.KEY` across `mojo/` (excluding migrations).
- Keys here are framework-known knobs only; project-specific settings may exist in your Django project and are not listed unless referenced by framework code.
