Configuration

Remote Management API

Manage this server from the OpenRun CLI on other machines

MCP API

Remote management (REST)

https://utils.demo.clace.io
disabled

Lets the OpenRun CLI on other machines manage this server as the logged-in user: apps, versions, services, syncs and config, within their RBAC permissions. Enabling needs:

  • ✓ RBAC enforcement - always on
  • ✓ HTTPS listener or a trusted TLS proxy - HTTPS listener on
  • ✓ External URL - https://utils.demo.clace.io
api.rest.auth

login mechanisms for openrun login (API keys work regardless); at least one is required, admin by default

dynamic
Additional settings
api.rest.enable_apis
no options available

operations disabled for the remote API by default, opted back in (none currently)

api.rest.disable_apis

operations turned off for remote CLI callers (the local unix socket CLI is never affected)

Shared settings

the external url and token lifetimes, used by the REST API and the MCP endpoints
api.external_url

canonical https origin (https://host[:port]) for API tokens and the OAuth metadata; defaults to security.callback_url. Required by an enabled surface, along with an HTTPS listener (or security.trusted_proxies) and RBAC enforcement

Additional settings
api.access_token_ttl

OAuth access token lifetime (Go duration, default 1h)

api.refresh_token_ttl

OAuth refresh token lifetime per rotation (default 720h)

api.grant_max_ttl

absolute OAuth grant lifetime, after which a new interactive login is required (default 2160h)

api.federated_identity_ttl

provider-derived group snapshot max age (default 720h)

api.pat_default_ttl

default API key lifetime (default 2160h); --expires=never is required for non-expiring keys