# System Configuration

You can set several configuration variables for the Appmixer engine through the Backoffice. We'll specify which variables can be configured in this section.

### Using the System section

You can find the *System* section in the left menu. When you click it, you will see a screen like this:

![System Configuration](https://1411580035-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2wQccpxu7ZEfAoEgdnOc%2Fuploads%2FRVnll6nYOTB0ftYoGyBk%2FAppmixer_Backoffice.png?alt=media\&token=599d9cab-072a-4765-b8b2-75449b579695)

There is a table with a list of the variables already defined. Each variable has the options for viewing in detail, editing, and removing. 

You can also add a new configuration option using the "Add" button on the top right. Then a new row will be created with the key and value inputs for you to fill in.

### Possible configuration values

Here is a list of the possible configuration values, a short explanation for each of them, and their default value (the value that Appmixer uses, in case it is not defined anywhere):

<table><thead><tr><th width="227.37507552383653">Key</th><th width="321.0215459330474">Detail</th><th width="150">Default value</th><th data-type="checkbox">Needs restart</th></tr></thead><tbody><tr><td>API_USER_CREATE_SCOPE</td><td>By default, the POST /user API is open to enable the sign-in feature for everyone. This option can restrict the access to this endpoint. It takes a list of scopes (comma-separated). If the value is not null, then a JWT token has to be used to call this API. Typically, the value is set to <code>admin</code>.</td><td>null</td><td>true</td></tr><tr><td>APP_NAME</td><td>This will for example appear in the head title of a sign-in popup for Api Key services.</td><td>Appmixer</td><td>false</td></tr><tr><td>DEFAULT_USER_VENDOR</td><td>Vendor assigned to newly created users.</td><td><em>No value</em></td><td>false</td></tr><tr><td>AUTH_POPUP_DISPLAY_ERR</td><td>Whether to display <a href="../../component-definition/authentication#validate-function-object-or-string">validation errors</a> from the authentication modules.</td><td>true</td><td>false</td></tr><tr><td>AUTH_POPUP_TIMEOUT_ERR</td><td>How many seconds before automatically closing the <em>Connecting Account Failed</em> popup window.</td><td>5</td><td>false</td></tr><tr><td>BROKER_MESSAGE_ACK_TIMEOUT</td><td>Timeout for message processing.</td><td>1500000</td><td>false</td></tr><tr><td>COMPONENT_FACTORY_TIMEOUT</td><td>An attempt to create a component will fail after this timeout.</td><td>300000</td><td>false</td></tr><tr><td>COMPONENT_RECEIVE_TIMEOUT</td><td>A message will be retried if the receive() function does not return within this timeout.</td><td>1380000</td><td>false</td></tr><tr><td>DISPATCHER_PREFETCH_COUNT</td><td>The maximum number of Rabbit messages being dispatched at the same time.</td><td>500</td><td>true</td></tr><tr><td>INPUT_QUEUE_PREFETCH_COUNT</td><td>The maximum number of outgoing Rabbit messages waiting for aknowledgement at the time in the Input Queue. Subsequent incoming messages will not be sent until pending messages are aknowledged.</td><td>300</td><td>true</td></tr><tr><td>LIMIT_FLOW_UPDATE_BYTES</td><td>The max size in bytes of a flow descriptor to be able to be saved.</td><td>2097152</td><td>false</td></tr><tr><td>LIMIT_CC_ARCHIVE_MAX_BYTES</td><td>Maximum size in bytes for custom components.</td><td>10485760</td><td>false</td></tr><tr><td>LIMIT_WEBHOOK_BYTES</td><td>Maximum payload size in bytes for webhook components.</td><td>1048576</td><td>false</td></tr><tr><td>LIMIT_COMPONENT_STATIC_CALL_MAX_BYTES</td><td>Maximum size in bytes of the payload for component static calls.</td><td>104857600</td><td>false</td></tr><tr><td>PUBLIC_FILES_PREFIX</td><td><a href="public-files">Public files</a> (needed usually for domain verification) can be served from different paths. Path prefixes have to be separated by <code>:</code></td><td><p></p><pre><code>/:/.well-known
</code></pre></td><td>true</td></tr><tr><td>RETRY_INIT_EXP</td><td>In case of an error, message for a Component is rescheduled for another attempt. Backoff strategy is used. This  retryInitExpiration is the initial value for the backoff, it says after how many milliseconds the first attempt after a failure is going to happen.</td><td>60000</td><td>true</td></tr><tr><td>RETRY_MAX_COUNT</td><td>How many times does the engine try to process the message before rejecting it forever (and moving into the Unprocessed Messages collection).</td><td>30</td><td>true</td></tr><tr><td>RETRY_MAX_EXP</td><td>Maximum interval in milliseconds between retry attempts.</td><td>3600000</td><td>true</td></tr><tr><td>STRICT_COOKIES</td><td>If set to true, the engine will reject any incoming HTTP requests that have cookies that don't comply with the <a href="https://www.rfc-editor.org/rfc/rfc6265">HTTP cookies RFC specification</a>.</td><td>true</td><td>true</td></tr><tr><td>WEBHOOK_PREFETCH_COUNT</td><td>This is for webhooks from Appmixer to registered URLs. This is the amount of webhook messages that will be processing at a time.</td><td>50</td><td>true</td></tr><tr><td>WEBHOOK_RETRY_COUNT</td><td>Number of times that Appmixer will retry sending a webhook. Applies for all webhooks.</td><td>20</td><td>false</td></tr><tr><td>WEBHOOK_RETRY_INTERVAL</td><td>Initial interval in milliseconds for retries. Subsequent retries will take longer (multiplied by an internal factor).</td><td>30000</td><td>false</td></tr><tr><td>WEBHOOK_RETRY_MAX</td><td>Maximum interval in milliseconds between retries.</td><td>1800000</td><td>false</td></tr><tr><td>WEBHOOK_REQUEST_TIMEOUT</td><td>Timeout in milliseconds for webhook component requests.</td><td>10000</td><td>false</td></tr><tr><td>WEBHOOK_USER_CREATED</td><td>URL that will be called when new user is created (sign-up).</td><td><em>No value</em></td><td>false</td></tr><tr><td>WEBHOOK_FLOW_COMPONENT_ERROR</td><td>URL that will be called when a running flow encounters an error.</td><td><em>No value</em></td><td>false</td></tr></tbody></table>

Setting some configuration values won't take effect immediately, but the Appmixer engine needs to be restarted.

### Forgot Password Service

Appmixer engine has an [API](https://docs.appmixer.com/6.0/5.1/api/user#forgot-password) to reset forgotten passwords. This works together with the Appmixer Frontend application (not the Appmixer SDK), if you use the frontend application, you can set up the forgot password service.&#x20;

![](https://1411580035-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2wQccpxu7ZEfAoEgdnOc%2Fuploads%2FiKcI0jZCdsgi6ZIpzql6%2FAppmixer.png?alt=media\&token=e2759f34-2c7a-4f51-801f-db0559d4b7da)

In order to create a link that can be sent to the user, the Appmixer engine needs to know the frontend URL, there are two variables that can be set for that:

<table><thead><tr><th width="232">Key</th><th>Detail</th><th>Default value</th><th data-type="checkbox">Required</th></tr></thead><tbody><tr><td>APPMIXER_FE_URL</td><td>The Frontned URL</td><td>http://localhost:8080</td><td>false</td></tr><tr><td>RESET_PASSWORD_FE_URL_SUFFIX</td><td>URL path with the reset password form</td><td>reset-password</td><td>false</td></tr></tbody></table>

Without any changes, the *link* will be <http://localhost:8080/reset-password?code=\\{{code\\}}>.

![](https://1411580035-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2wQccpxu7ZEfAoEgdnOc%2Fuploads%2FvDn8MKgf7IWDosn4zOVt%2FAppmixer.png?alt=media\&token=6d1e0c0d-6622-45d1-bbb3-8082a621517c)

That link has to be then delivered to the user. There are two ways this can be done:

#### Webhook

You can register a system webhook that will be triggered every time a user requests to change their password. The webhook URL can be registered under the key WEBHOOK\_USER\_FORGOT\_PASSWORD and the JSON object sent to that URL will be:

```json
{
  "code": 'unique code generated for identifying forgot password request',
  "email": 'email address of the user',
  "userId": 'User Id',
  "created": 'date when a user requested for forgot password',
  "link": 'Link to access forgot password page on the frontend'
}
```

You can use Appmixer to create a simple flow, that would send emails with the *reset password* link.

![](https://1411580035-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2wQccpxu7ZEfAoEgdnOc%2Fuploads%2FxZnd8hU6wWsjlw7B8i94%2FAppmixer.png?alt=media\&token=d6e165e9-b856-4c6a-b14a-72d67c46fbec)

#### SMTP

The other way is to configure the SMTP server, Appmixer will then send an email with the reset password link to the user's email address.

<table><thead><tr><th width="249">Key</th><th>Detail</th><th>Default value</th><th data-type="checkbox">Required</th></tr></thead><tbody><tr><td>MAIL_SMTP_HOST</td><td>SMTP server address</td><td></td><td>true</td></tr><tr><td>MAIL_SMTP_PORT</td><td>SMTP server port</td><td>465</td><td>false</td></tr><tr><td>MAIL_SMTP_USER</td><td>username</td><td></td><td>true</td></tr><tr><td>MAIL_SMTP_PASS</td><td>password</td><td></td><td>true</td></tr><tr><td>MAIL_FROM_NAME</td><td>Sender name</td><td>Appmixer</td><td>false</td></tr><tr><td>MAIL_FROM_EMAIL</td><td>Sender email</td><td>info@appmixer.com</td><td>false</td></tr><tr><td>FORGOT_PASSWORD_MAIL_SUBJECT</td><td>Reset password email subject.</td><td>Reset your password</td><td>false</td></tr><tr><td>FORGOT_PASSWORD_MAIL_BODY</td><td>The reset password email body.</td><td>See below</td><td>false</td></tr></tbody></table>

The default email body:

```
<p>Hi,</p>
<p>You have requested to reset your password. Please click on the link below to reset your password.</p>
<p><a href="{{link}}">Reset Password</a></p>
<p>If you are unable to click on the link, please copy and paste the following link into your browser:</p>
<p>{{link}}</p>
```

{% hint style="info" %}
If the forgot password webhook is configured as explained above, the Appmixer engine will not send the email to the user and it will trigger the webhook instead.
{% endhint %}