Security settings
Admin authentication, JWT and OAuth2 egress policy, CORS, rate limits and the channel filter. Every table on these pages carries the wire name, the default the code uses, and the ORION_* override.
| Page | Holds |
|---|---|
| Admin authentication settings | enabling admin authentication, the accepted and read-only API keys, hashed key storage, and the credential header. |
| JWT verification settings | the instance-wide egress policy for JWKS fetches, and why the per-issuer settings live on the channel or the jwt_verify task instead. |
| Inbound OAuth2 sign-in settings | the instance-wide egress policy for token endpoints on private addresses, and what a channel’s block owns instead. |
| CORS settings | allowed origins, the additive allowed and exposed header lists, credentials, and preflight caching, with the production rules. |
| Rate limit settings | the platform token bucket, per-plane limits, and trusted_proxies, which decides whether forwarded headers name the client. |
| Channel filter settings | include and exclude glob patterns over channel names, for running separate fleets off one database. |
Related
- Server configuration: every section, by what you are configuring.
- How settings are resolved: defaults, the file, and the environment.
- Production checklist: which settings to change before real traffic.
Last verified 14 September 2026