# Access and authoring settings

Every access and authoring settings field served by the server configuration types.

Lys pass validation and JWT validation are separate auth modes. The assistant account section supplies account names, not harness launch commands.

## Authentication

- `auth.enabled`: Default false. Auth-off callers have operator authority; enable an authenticated mode before exposing the listener.
- `auth.jwks_url`: Required nonempty JWKS URL for JWT mode without Lys. On main, a binary without the auth feature refuses this mode at boot; crates/aion-server/src/run.rs:536–544 enforces that requirement.
- `auth.jwks_refresh_seconds`: Positive JWKS refresh interval. Default 300 seconds.
- `auth.lys`: Optional Lys pass configuration. With authentication enabled, selects Lys pass validation instead of ordinary JWT validation.
- `auth.namespace_claim`: Required in authenticated non-Lys mode. Names the one claim granting namespaces. Forbidden with Lys or auth disabled; sub, exp, deploy and assistant.sessions are reserved.
- `auth.liminal_token_file`: Optional shared connection-token file for the liminal worker listener. Requires authentication and liminal_namespace; it does not identify individual workers.
- `auth.liminal_namespace`: The one namespace admitted by the authenticated liminal listener. Required with liminal_token_file.


## Lys

- `auth.lys.issuer`: Required trusted Lys origin. Published keys are read from its OAuth JWKS route at boot.
- `auth.lys.connector_credential_file`: Required path to the app connector credential provisioned by the installer. The draft runner uses it to pull and close approved drafts.
- `auth.lys.drafts_pull_seconds`: Required positive seconds between draft pulls. No code default; choose it for the deployment.


## TLS

- `tls.certificate_chain_path`: Required certificate-chain file path when TLS is configured.
- `tls.private_key_path`: Required private-key file path when TLS is configured.


## Console

- `ops_console.source`: Embedded by default. A FileSystem source supplies an operator-built asset_path directory instead.


## Metrics

- `metrics.enabled`: Expose Prometheus metrics. Default true.


## Deployment

- `deploy.enabled`: Default false in typed config. Enables runtime deployment APIs. The shipped first-run file sets true explicitly.
- `deploy.max_archive_bytes`: Positive upload ceiling when deployment is enabled. Merged default 67108864 bytes. The starter file chooses 16777216.
- `deploy.max_inflated_bytes`: Positive archive inflation ceiling, at least the upload ceiling. Merged default 268435456 bytes. The starter file chooses 67108864.


## Authoring

- `authoring.gleam_path`: Optional external Gleam executable. Enables server-side Gleam compilation and requires project_root.
- `authoring.project_root`: Required when gleam_path is set. A provisioned, built Gleam workflow project with its descriptor and schemas.
- `authoring.workspace_dir`: AWL source workspace. Merged default is the authoring directory under Aion home.


## Development

- `dev.enabled`: Default false. Enables development run, mock and replay endpoints.


## Assistant harness accounts

- `assistant.harness.name`: Required catalogue harness id for these account declarations. Unknown and duplicate ids are refused.
- `assistant.harness.account`: Optional named accounts for this harness. Absence leaves the harness offered with no declared accounts.


## Assistant account environment

- `assistant.harness.account.name`: Required nonempty account name, unique within the harness.
- `assistant.harness.account.env`: Child variable name to server variable name. Values are read at spawn. Invalid or credential-shaped child names and missing source values are refused.


Read [configuration discovery and the starter file](/aion/reference/configuration/). With Lys, omit the namespace-claim setting: the pass grants namespaces. Supply all required Lys connector and draft-runner fields. Without Lys, enabled JWT auth requires the namespace claim and JWKS settings.