Configuration

Configuration
API Access

API Access

MCP and remote management API access: login mechanisms per surface and the operations each surface exposes - changes take effect immediately

Settings

dynamic values override the static openrun.toml value; clear a field and save to reset

External URL

api.external_url

canonical https origin (https://host[:port]) for API tokens and the OAuth metadata; defaults to security.callback_url. Required by an enabled surface, along with an HTTPS listener (or security.trusted_proxies) and RBAC enforcement

› Additional settings

Access token TTL

api.access_token_ttl

OAuth access token lifetime (Go duration, default 1h)

Refresh token TTL

api.refresh_token_ttl

OAuth refresh token lifetime per rotation (default 720h)

api.grant_max_ttl

absolute OAuth grant lifetime, after which a new interactive login is required (default 2160h)

Federated identity TTL

api.federated_identity_ttl

provider-derived group snapshot max age (default 720h)

API key default expiry

api.pat_default_ttl

default API key lifetime (default 2160h); --expires=never is required for non-expiring keys

MCP

the Model Context Protocol endpoint at <external url>/_openrun/mcp for AI clients

Enabled

api.mcp.enable

serve the MCP endpoint; needs an HTTPS listener (or trusted proxies), the external URL and RBAC enforcement

api.mcp.auth

admin builtin github github_demo google

browser login mechanisms for MCP OAuth clients (API keys minted with --resource mcp work regardless); at least one is required, admin by default

› Additional settings

Additional APIs to enable

api.mcp.enable_apis

binding_show_account config_update create_apikey_other delete_apikey_other provider_install provider_uninstall restart_server secret_rekey secret_reveal stop_server user_add user_delete

dangerous operations disabled for MCP by default, opted back in (logged at startup)

APIs to disable

api.mcp.disable_apis

apply apply_delete approve_apps binding_create binding_delete binding_get binding_health binding_run_command binding_show_account binding_update config_get config_update create_apikey create_app create_preview delete_apikey delete_apps get_app list_apikeys list_apps list_bindings list_files list_providers list_secrets list_services list_sync list_versions list_webhooks promote_apps provider_install provider_uninstall reload_apps replication_status restart_server secret_create secret_delete secret_get secret_rekey secret_reveal server_status server_version service_create service_delete service_health service_update stop_server sync_create sync_delete sync_run token_create token_delete update_links update_metadata update_params update_settings user_add user_delete user_list version_switch

operations turned off for MCP on top of the defaults; secret_create is on by default, disable it if secret values must never pass through an AI client

Skip destructive confirmation

api.mcp.skip_destructive_confirm

disable the dry-run preview + confirmation prompt on destructive MCP tools (headless automation)

Remote management (REST)

the management REST API over HTTPS, used by the OpenRun CLI on other machines

Enabled

api.rest.enable

serve the management API over HTTPS; needs an HTTPS listener (or trusted proxies), the external URL and RBAC enforcement

api.rest.auth

admin builtin github github_demo google

› Additional settings

Additional APIs to enable

api.rest.enable_apis

no options available

operations disabled for the remote API by default, opted back in (none currently)

APIs to disable

api.rest.disable_apis

apply apply_delete approve_apps binding_create binding_delete binding_get binding_health binding_run_command binding_show_account binding_update config_get config_update create_apikey create_apikey_other create_app create_preview delete_apikey delete_apikey_other delete_apps export_apps get_app list_apikeys list_apps list_bindings list_files list_providers list_secrets list_services list_sync list_versions list_webhooks metadata_health pretty_print promote_apps provider_install provider_uninstall reload_apps replication_status restart_server secret_create secret_delete secret_get secret_rekey secret_reveal server_status server_version service_create service_delete service_health service_update stop_server sync_create sync_delete sync_run token_create token_delete update_links update_metadata update_params update_settings user_add user_delete user_list version_switch

operations turned off for remote CLI callers (the local unix socket CLI is never affected)

Overview
Deploy
Apps
Syncs
Bindings
Operate
Containers
Audit Logs
Configuration

⚠ Sign-in required

Management and builder operations are disabled for anonymous users.

Enable authentication for the Console app.

🌙 ☀️

anonymous