Skip to main content

Instance settings

Instance-wide settings live on two admin pages: Admin → General and Admin → Authentication. Owner and Admin staff can open and change them; Support and Auditor staff can't see them (see Staff roles).

Settings save themselves: switches and choices on change, text and numbers when you leave the field. Every change is recorded in the audit log with the value before and after. Secrets, such as an OIDC client secret, are never written to the log.

Some settings are not in the admin area but in the server's environment, for example the public address of the instance, storage and email delivery. See Configuration.

Admin → General​

Name and language​

  • Instance name — shown in page titles and emails (for example, the subject "3 updates on …").
  • Default language for new users — the language of new accounts, and of emails to people who haven't chosen one.

Workspace creation​

People can sign in without belonging to any workspace. Decide who may create their own:

  • Who can create workspaces — Everyone who can sign in, or Owners and admins of the instance only.
  • Workspaces per person — 0 means no limit. It counts the workspaces a person created.

You can override both for a single person on their page in Admin → Users (Can create workspaces). Owners and Admins can always create workspaces.

Notifications​

Email task updates turns the email digest on or off for the whole instance (off by default). When it's on, people get an email about changes to tasks they're assigned to or members of, and about mentions. Changes are batched: one email once things have been quiet for 10 minutes, and at most one an hour while work goes on. Anything already read in the app is left out.

Each person can still turn the digest off for themselves in Settings → Notifications. Emails that are an admin duty — such as sign-up approvals — and security emails are sent regardless of this setting.

With plans turned on, an organization's plan can also leave out email notifications: its workspaces then notify in the app only. This switch stays the master — while it's off, nobody gets task update emails, whatever the plan.

note

Emails only go out when email delivery is configured. See Email.

Uploads​

Limits for attachments and for images in descriptions and comments:

  • Maximum file size (MB) — default 100. Leave blank for no limit.
  • Chunk size (MB) — default 8. Files are sent in parts of this size, and an interrupted upload picks up where it stopped. Leave blank to send each file in one request. With S3 storage, chunks must be at least 5 MB.

Workspace admins can set a lower limit for their workspace (Settings → Workspace → Access & integrations); the smaller limit wins.

warning

A reverse proxy in front of sol2flow limits the size of each request (for example nginx's client_max_body_size). With chunking, set it above the chunk size. Without chunking, it must allow the largest file, or big uploads are rejected. See Reverse proxy.

API​

  • Allow API keys (on by default) — off: "API keys" disappears from the account menu and every existing key is refused. The keys aren't deleted; they work again when you turn the switch back on. This is also the fastest way to stop all API access at once.
  • API documentation (on by default) — the interactive API reference and the OpenAPI document. Turn it off to hide them, for example on a production instance that shouldn't advertise its API. The API itself keeps working.
  • Allow webhooks (on by default) — off: nothing is sent and every workspace's Webhooks section is locked.
  • Allow webhooks to private network addresses (off by default) — lets webhooks reach addresses like 10.x, 192.168.x or localhost, for tools inside your network. The same setting allows imports from a server on your private network. Cloud metadata addresses always stay blocked.

Workspace admins have their own REST API and Webhooks switches under Settings → Workspace → Access & integrations. They work under the instance's: a switch the instance has turned off stays off in every workspace. See REST API and Webhooks.

Public board links have no instance-wide switch. Workspace admins decide for their own workspace with Allow public links under Settings → Workspace → Access & integrations; board admins then turn a board's link on or off in its Share dialog. See Share a board publicly.

On a self-hosted instance, the "Shared with sol2flow" footer of public boards links to the address in PUBLIC_WEBSITE_URL (see Configuration).

Audit log​

Keep events for (days) — from 30 to 3650 days, default 365. Older events are deleted by a daily cleanup. See Audit log.

Data & legal​

  • Keep deleted workspaces for (days) — the grace period in which a deleted workspace can be restored, from 1 to 365 days (default 30). A change applies to workspaces deleted from then on. See Data export and deletion.
  • Terms of service URL and Privacy policy URL — optional, full addresses starting with https:// or http://. They're linked below the sign-in and sign-up forms. When a link is set, sign-up and finishing an invitation show a checkbox that must be ticked, and the time of acceptance is recorded. Accounts created automatically by single sign-on don't get the checkbox.
  • Imprint URL — optional: your legal notice (required in Germany, § 5 DDG). Linked below the sign-in forms and in Settings → Your data; nobody has to accept it. See Privacy and GDPR.

Admin → Authentication​

This page controls how people sign in and how accounts are created.

Sign-in methods at a glance​

  • Username & password — people sign in with credentials stored in sol2flow. Accounts can add two-factor authentication and passkeys in Settings → Security.
  • Self sign-up — anyone can create a password account from the sign-in page, optionally limited to Allowed email domains, joining a workspace you choose, and optionally waiting for approval (Require admin approval). See Users and sign-up.
  • Require email verification — on by default. New accounts confirm their address with an emailed link before they can sign in, and a changed address only applies once it is confirmed. Also for single sign-on accounts whose provider doesn't confirm the address. Sign-ups nobody confirms are deleted after 7 days. Turn it off if your instance can't send email. See Email verification.
  • OIDC providers — single sign-on through any OpenID Connect provider, such as Keycloak, Authentik, Okta, Entra ID or Google. Choose Add provider, pick a preset or Custom OIDC, and fill in the issuer, client ID and secret. The page shows the Redirect URI to register at your identity provider.

For each OIDC provider you can also set:

  • Claim mapping — which claims hold the username, email and groups.
  • Admin group and Support group — members get the Admin or Support staff role on sign-in. Owners are never changed.
  • Create users on first sign-in, and which workspace new users are added to (Add new users to, With role), or none.
  • Group mappings — people in a provider group are added to a workspace with a given role on every sign-in. A group can also be mapped to No workspace access: its members are removed from every workspace and board on each sign-in, and that rule wins over every other mapping.
  • Enabled — whether the provider appears on the sign-in page.

Step-by-step setup for common identity providers is in Sign-in.

tip

Before you turn off Username & password, make sure at least one Owner can sign in through single sign-on, or you may lock yourself out of the admin area.